Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
MPJ_1281565D#U00ae.msi

Overview

General Information

Sample name:MPJ_1281565D#U00ae.msi
renamed because original name is a hash value
Original sample name:MPJ_1281565D.msi
Analysis ID:1562228
MD5:c3541cf72e6fd5b278f8cc899dae304a
SHA1:fe9864fa355777efbe3f94a83abf51fa9272b6c6
SHA256:49e22d098f3713fe44f1d75757904e13e758424288b81f7bb517d356f48cf88f
Tags:ConnectWisemsiuser-Porcupine
Infos:

Detection

ScreenConnect Tool
Score:72
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

.NET source code references suspicious native API functions
AI detected suspicious sample
Contains functionality to hide user accounts
Enables network access during safeboot for specific services
Modifies security policies related information
Possible COM Object hijacking
Reads the Security eventlog
Reads the System eventlog
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks for available system drives (often done to infect USB drives)
Contains functionality to launch a process as a different user
Creates files inside the system directory
Creates or modifies windows services
Deletes files inside the Windows folder
Detected potential crypto function
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Found dropped PE file which has not been started or loaded
May sleep (evasive loops) to hinder dynamic analysis
May use bcdedit to modify the Windows boot settings
Modifies existing windows services
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara detected ScreenConnect Tool

Classification

Process Tree

  • System is w10x64
  • msiexec.exe (PID: 6784 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\MPJ_1281565D#U00ae.msi" MD5: E5DA170027542E25EDE42FC54C929077)
  • msiexec.exe (PID: 5556 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)
    • msiexec.exe (PID: 1012 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 390FD6DCD7E50BFBF112F96E3A0DE021 C MD5: 9D09DC1EDA745A5F87553048E57620CF)
      • rundll32.exe (PID: 1776 cmdline: rundll32.exe "C:\Users\user\AppData\Local\Temp\MSI31E4.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5518000 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments MD5: 889B99C52A60DD49227C5E485A016679)
    • msiexec.exe (PID: 6300 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 1B5721C1CE0E7EF98DD0EC09055781AD MD5: 9D09DC1EDA745A5F87553048E57620CF)
    • msiexec.exe (PID: 5032 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding A228E7CE75C97BE8E56E19BF17938851 E Global\MSI0000 MD5: 9D09DC1EDA745A5F87553048E57620CF)
  • ScreenConnect.ClientService.exe (PID: 6596 cmdline: "C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-c89u33-relay.screenconnect.com&p=443&s=8f47f859-e57f-4bd8-9f9a-e730d3b0dc96&k=BgIAAACkAABSU0ExAAgAAAEAAQDpI9qfgaQF9EqFatMP06CsRNHBTKHOK5%2bUtX0qmq8CA4QJH2XTUdjK0ggTdGE4t0YfU4unuKYheAHWWjw%2bjMFfbdlJ1G50ApzOoLoB%2b7pQWX2ZnbVh%2bLfj4JIFwgKtc6Wpc%2fHElrzDuV3d5egfIjs2stKs6RmevReV2ZtwZXMrYZKFQK5QgwhmOTs1pFbFBaiusdjG8NTEcpq2zEicxl0jNKmCw71zqxPy1Lyu3YkOHeZqzMfRsWjzH%2fYVBCAx2I5sAn2Al2rwnZGCoxiYVwlWGITSxEHyjKXWvvVVaCBwjSzlM79WD5B4aCG5QDHn9IzvPCVw%2bHuInNUKsgj2iTG7&t=pdfconvitHir" MD5: 75B21D04C69128A7230A0998086B61AA)
    • ScreenConnect.WindowsClient.exe (PID: 4592 cmdline: "C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exe" "RunRole" "d04726a4-55e2-40d7-93a5-312106824cb3" "User" MD5: 1778204A8C3BC2B8E5E4194EDBAF7135)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Config.Msi\5435dd.rbsJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
    C:\Windows\Installer\MSI3A9F.tmpJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
      C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security

        Memory Dumps

        SourceRuleDescriptionAuthorStrings
        00000008.00000000.2072833360.00000000007A2000.00000002.00000001.01000000.00000010.sdmpJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
          00000008.00000002.3297693904.0000000002C01000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
            Process Memory Space: rundll32.exe PID: 1776JoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
              Process Memory Space: ScreenConnect.WindowsClient.exe PID: 4592JoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security

                Unpacked PEs

                SourceRuleDescriptionAuthorStrings
                8.2.ScreenConnect.WindowsClient.exe.2c7fa10.4.raw.unpackJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
                  8.0.ScreenConnect.WindowsClient.exe.7a0000.0.unpackJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security

                    Sigma Signatures

                    Sigma detected: CurrentVersion Autorun Keys Modification
                    Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: ScreenConnect Client (909a0bac52a7095f) Credential Provider, EventID: 13, EventType: SetValue, Image: C:\Windows\System32\msiexec.exe, ProcessId: 5556, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{6FF59A85-BC37-4CD4-9B96-92D47DCB003A}\(Default)

                    Suricata Signatures

                    ⊘No Suricata rule has matched

                    Joe Sandbox Signatures

                    Click to jump to signature section

                    Show All Signature Results

                    AV Detection

                    barindex
                    AI detected suspicious sample
                    Source: Submited SampleIntegrated Neural Analysis Model: Matched 95.7% probability
                    Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsFileManager\obj\Release\ScreenConnect.WindowsFileManager.pdb source: ScreenConnect.WindowsFileManager.exe.1.dr
                    Source: Binary string: C:\builds\cc\cwcontrol\Product\ClientService\obj\Release\ScreenConnect.ClientService.pdb source: ScreenConnect.WindowsClient.exe, 00000008.00000002.3297693904.0000000002C01000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.3297016236.0000000000DA0000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.3297409679.0000000001122000.00000002.00000001.01000000.0000000B.sdmp, ScreenConnect.ClientService.dll.1.dr
                    Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetServiceRunner.pdb source: ScreenConnect.ClientService.exe, 00000007.00000000.2064073724.0000000000EBD000.00000002.00000001.01000000.0000000A.sdmp, ScreenConnect.ClientService.exe.1.dr
                    Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\Compression.Cab\Microsoft.Deployment.Compression.Cab.pdb source: rundll32.exe, 00000004.00000003.2040950060.00000000046C0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2037797193.0000000004834000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.Cab.dll.4.dr
                    Source: Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdb source: rundll32.exe, 00000004.00000003.2037797193.00000000047C5000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.3300906861.000000001B972000.00000002.00000001.01000000.0000000D.sdmp, ScreenConnect.Windows.dll.1.dr, ScreenConnect.Windows.dll.4.dr
                    Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdb source: Microsoft.Deployment.WindowsInstaller.dll.4.dr
                    Source: Binary string: C:\builds\cc\cwcontrol\Product\InstallerActions\obj\Release\net20\ScreenConnect.InstallerActions.pdb source: ScreenConnect.InstallerActions.dll.4.dr
                    Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdbT source: Microsoft.Deployment.WindowsInstaller.dll.4.dr
                    Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\Compression\Microsoft.Deployment.Compression.pdb source: rundll32.exe, 00000004.00000003.2037797193.00000000047C5000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.dll.4.dr
                    Source: Binary string: C:\build\work\eca3d12b\wix3\build\ship\x86\wixca.pdb source: MPJ_1281565D#U00ae.msi, 5435dd.rbs.1.dr, MSI3A9F.tmp.1.dr, MSI3D60.tmp.1.dr, 5435de.msi.1.dr, 5435dc.msi.1.dr, MSI3B8A.tmp.1.dr
                    Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb source: ScreenConnect.WindowsBackstageShell.exe.1.dr
                    Source: Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdbS] source: rundll32.exe, 00000004.00000003.2037797193.00000000047C5000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.3300906861.000000001B972000.00000002.00000001.01000000.0000000D.sdmp, ScreenConnect.Windows.dll.1.dr, ScreenConnect.Windows.dll.4.dr
                    Source: Binary string: screenconnect_windows_credential_provider.pdb source: ScreenConnect.ClientService.exe, 00000007.00000002.3302471477.0000000002377000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.3299239769.0000000012C10000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsCredentialProvider.dll.1.dr
                    Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\WindowsInstaller.Package\Microsoft.Deployment.WindowsInstaller.Package.pdb source: Microsoft.Deployment.WindowsInstaller.Package.dll.4.dr
                    Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000008.00000000.2072833360.00000000007A2000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.WindowsClient.exe.1.dr
                    Source: Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdbi source: ScreenConnect.WindowsClient.exe, 00000008.00000002.3297349091.00000000010C2000.00000002.00000001.01000000.0000000E.sdmp, ScreenConnect.Client.dll.1.dr
                    Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdbu source: ScreenConnect.WindowsClient.exe, 00000008.00000000.2072833360.00000000007A2000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.WindowsClient.exe.1.dr
                    Source: Binary string: E:\delivery\Dev\wix37_public\build\ship\x86\SfxCA.pdb source: MPJ_1281565D#U00ae.msi, 5435de.msi.1.dr, 5435dc.msi.1.dr, MSI31E4.tmp.0.dr
                    Source: Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdb source: ScreenConnect.WindowsClient.exe, 00000008.00000002.3297349091.00000000010C2000.00000002.00000001.01000000.0000000E.sdmp, ScreenConnect.Client.dll.1.dr
                    Source: Binary string: C:\Compile\screenconnect\Product\WindowsAuthenticationPackage\bin\Release\ScreenConnect.WindowsAuthenticationPackage.pdb source: ScreenConnect.ClientService.exe, 00000007.00000002.3302471477.0000000002377000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.3299239769.0000000012C10000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsAuthenticationPackage.dll.1.dr
                    Source: Binary string: screenconnect_windows_credential_provider.pdb' source: ScreenConnect.ClientService.exe, 00000007.00000002.3302471477.0000000002377000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.3299239769.0000000012C10000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsCredentialProvider.dll.1.dr
                    Source: Binary string: C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: ScreenConnect.ClientService.exe, 00000007.00000002.3297056595.00000000008FC000.00000004.00000020.00020000.00000000.sdmp
                    Source: Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdb source: rundll32.exe, 00000004.00000003.2037797193.0000000004840000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.3297056595.00000000008FC000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.3299876394.000000001B3C2000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.Core.dll.1.dr, ScreenConnect.Core.dll.4.dr
                    Source: C:\Windows\System32\msiexec.exeFile opened: z:Jump to behavior
                    Source: C:\Windows\System32\msiexec.exeFile opened: x:Jump to behavior
                    Source: C:\Windows\System32\msiexec.exeFile opened: v:Jump to behavior
                    Source: C:\Windows\System32\msiexec.exeFile opened: t:Jump to behavior
                    Source: C:\Windows\System32\msiexec.exeFile opened: r:Jump to behavior
                    Source: C:\Windows\System32\msiexec.exeFile opened: p:Jump to behavior
                    Source: C:\Windows\System32\msiexec.exeFile opened: n:Jump to behavior
                    Source: C:\Windows\System32\msiexec.exeFile opened: l:Jump to behavior
                    Source: C:\Windows\System32\msiexec.exeFile opened: j:Jump to behavior
                    Source: C:\Windows\System32\msiexec.exeFile opened: h:Jump to behavior
                    Source: C:\Windows\System32\msiexec.exeFile opened: f:Jump to behavior
                    Source: C:\Windows\System32\msiexec.exeFile opened: b:Jump to behavior
                    Source: C:\Windows\System32\msiexec.exeFile opened: y:Jump to behavior
                    Source: C:\Windows\System32\msiexec.exeFile opened: w:Jump to behavior
                    Source: C:\Windows\System32\msiexec.exeFile opened: u:Jump to behavior
                    Source: C:\Windows\System32\msiexec.exeFile opened: s:Jump to behavior
                    Source: C:\Windows\System32\msiexec.exeFile opened: q:Jump to behavior
                    Source: C:\Windows\System32\msiexec.exeFile opened: o:Jump to behavior
                    Source: C:\Windows\System32\msiexec.exeFile opened: m:Jump to behavior
                    Source: C:\Windows\System32\msiexec.exeFile opened: k:Jump to behavior
                    Source: C:\Windows\System32\msiexec.exeFile opened: i:Jump to behavior
                    Source: C:\Windows\System32\msiexec.exeFile opened: g:Jump to behavior
                    Source: C:\Windows\System32\msiexec.exeFile opened: e:Jump to behavior
                    Source: C:\Windows\System32\msiexec.exeFile opened: c:Jump to behavior
                    Source: C:\Windows\System32\msiexec.exeFile opened: a:Jump to behavior

                    Networking

                    barindex
                    Enables network access during safeboot for specific services
                    Source: C:\Windows\System32\msiexec.exeRegistry value created: NULL ServiceJump to behavior
                    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                    Source: global trafficDNS traffic detected: DNS query: instance-c89u33-relay.screenconnect.com
                    Source: ScreenConnect.ClientService.exe, 00000007.00000002.3302471477.0000000002377000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.3299239769.0000000012C10000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsAuthenticationPackage.dll.1.dr, ScreenConnect.WindowsCredentialProvider.dll.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe.1.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
                    Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.3299239769.0000000012C10000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsAuthenticationPackage.dll.1.dr, ScreenConnect.WindowsCredentialProvider.dll.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe.1.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
                    Source: ScreenConnect.ClientService.exe, 00000007.00000002.3302471477.0000000002377000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.3299239769.0000000012C10000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsAuthenticationPackage.dll.1.dr, ScreenConnect.WindowsCredentialProvider.dll.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe.1.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
                    Source: ScreenConnect.ClientService.exe, 00000007.00000002.3302471477.0000000002377000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.3299239769.0000000012C10000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsAuthenticationPackage.dll.1.dr, ScreenConnect.WindowsCredentialProvider.dll.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe.1.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
                    Source: ScreenConnect.ClientService.exe, 00000007.00000002.3302471477.0000000002377000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.3299239769.0000000012C10000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsAuthenticationPackage.dll.1.dr, ScreenConnect.WindowsCredentialProvider.dll.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe.1.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
                    Source: ScreenConnect.ClientService.exe, 00000007.00000002.3302471477.0000000002377000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.3299239769.0000000012C10000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsAuthenticationPackage.dll.1.dr, ScreenConnect.WindowsCredentialProvider.dll.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe.1.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
                    Source: ScreenConnect.ClientService.exe, 00000007.00000002.3302471477.0000000002377000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.3299239769.0000000012C10000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsAuthenticationPackage.dll.1.dr, ScreenConnect.WindowsCredentialProvider.dll.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe.1.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
                    Source: ScreenConnect.ClientService.exe.1.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
                    Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.3299239769.0000000012C10000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsAuthenticationPackage.dll.1.dr, ScreenConnect.WindowsCredentialProvider.dll.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe.1.drString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
                    Source: ScreenConnect.ClientService.exe, 00000007.00000002.3297056595.00000000008FC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://instance-c89u33-relay.screenconnect.com:443/
                    Source: ScreenConnect.ClientService.exe, 00000007.00000002.3297056595.00000000008FC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://instance-c89u33-relay.screenconnect.com:443/Dw
                    Source: ScreenConnect.ClientService.exe, 00000007.00000002.3297056595.00000000008FC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://instance-c89u33-relay.screenconnect.com:443/Nt
                    Source: ScreenConnect.ClientService.exe, 00000007.00000002.3298215886.0000000001695000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.3298215886.00000000015E1000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.3298215886.00000000018CA000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.3298215886.0000000001735000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.3298215886.0000000001371000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.3298215886.00000000017E7000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.3298215886.000000000189D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://instance-c89u33-relay.screenconnect.com:443/d
                    Source: ScreenConnect.ClientService.exe, 00000007.00000002.3297056595.00000000008FC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://instance-c89u33-relay.screenconnect.com:443/jt
                    Source: ScreenConnect.ClientService.exe, 00000007.00000002.3297056595.00000000008FC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://instance-c89u33-relay.screenconnect.com:443/tZ
                    Source: ScreenConnect.ClientService.exe, 00000007.00000002.3297056595.00000000008FC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://instance-c89u33-relay.screenconnect.com:443/xt
                    Source: ScreenConnect.ClientService.exe, 00000007.00000002.3302471477.0000000002377000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.3299239769.0000000012C10000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsAuthenticationPackage.dll.1.dr, ScreenConnect.WindowsCredentialProvider.dll.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe.1.drString found in binary or memory: http://ocsp.digicert.com0
                    Source: ScreenConnect.ClientService.exe, 00000007.00000002.3302471477.0000000002377000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.3299239769.0000000012C10000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsAuthenticationPackage.dll.1.dr, ScreenConnect.WindowsCredentialProvider.dll.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe.1.drString found in binary or memory: http://ocsp.digicert.com0A
                    Source: ScreenConnect.ClientService.exe, 00000007.00000002.3302471477.0000000002377000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.3299239769.0000000012C10000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsAuthenticationPackage.dll.1.dr, ScreenConnect.WindowsCredentialProvider.dll.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe.1.drString found in binary or memory: http://ocsp.digicert.com0C
                    Source: ScreenConnect.ClientService.exe, 00000007.00000002.3302471477.0000000002377000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.3299239769.0000000012C10000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsAuthenticationPackage.dll.1.dr, ScreenConnect.WindowsCredentialProvider.dll.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe.1.drString found in binary or memory: http://ocsp.digicert.com0X
                    Source: ScreenConnect.ClientService.exe, 00000007.00000002.3298215886.0000000001371000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                    Source: rundll32.exe, 00000004.00000003.2037998683.00000000046C3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2037797193.00000000047C5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2037797193.0000000004834000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.WindowsInstaller.dll.4.dr, Microsoft.Deployment.WindowsInstaller.Package.dll.4.dr, Microsoft.Deployment.Compression.dll.4.dr, Microsoft.Deployment.Compression.Cab.dll.4.drString found in binary or memory: http://wixtoolset.org/Whttp://wixtoolset.org/telemetry/v
                    Source: rundll32.exe, 00000004.00000003.2037998683.00000000046C3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2037797193.00000000047C5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2037797193.0000000004834000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.WindowsInstaller.dll.4.dr, Microsoft.Deployment.WindowsInstaller.Package.dll.4.dr, Microsoft.Deployment.Compression.dll.4.dr, Microsoft.Deployment.Compression.Cab.dll.4.drString found in binary or memory: http://wixtoolset.org/news/
                    Source: rundll32.exe, 00000004.00000003.2037998683.00000000046C3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2037797193.00000000047C5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2037797193.0000000004834000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.WindowsInstaller.dll.4.dr, Microsoft.Deployment.WindowsInstaller.Package.dll.4.dr, Microsoft.Deployment.Compression.dll.4.dr, Microsoft.Deployment.Compression.Cab.dll.4.drString found in binary or memory: http://wixtoolset.org/releases/
                    Source: ScreenConnect.ClientService.exe, 00000007.00000002.3302471477.0000000002377000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.3299239769.0000000012C10000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsAuthenticationPackage.dll.1.dr, ScreenConnect.WindowsCredentialProvider.dll.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe.1.drString found in binary or memory: http://www.digicert.com/CPS0
                    Source: ScreenConnect.WindowsCredentialProvider.dll.1.drString found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
                    Source: ScreenConnect.Core.dll.4.drString found in binary or memory: https://feedback.screenconnect.com/Feedback.axd
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49820
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49706 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49707 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49705 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49820 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49872
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49947 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49726 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49704 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49872 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49707
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49706
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49705
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49947
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49704
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49726
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49778 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49778

                    Spam, unwanted Advertisements and Ransom Demands

                    barindex
                    Reads the Security eventlog
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SecurityJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\ScreenConnectJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SecurityJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SecurityJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\ScreenConnectJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SecurityJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\ScreenConnectJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SecurityJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\ScreenConnectJump to behavior
                    Reads the System eventlog
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SystemJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SystemJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SystemJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SystemJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SystemJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeCode function: 7_2_05130110 CreateProcessAsUserW,7_2_05130110
                    Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\5435dc.msiJump to behavior
                    Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\inprogressinstallinfo.ipiJump to behavior
                    Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\SourceHash{FC4B6052-A51F-D41F-8C25-3D41FD6C6B5C}Jump to behavior
                    Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI3A9F.tmpJump to behavior
                    Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI3B8A.tmpJump to behavior
                    Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI3D60.tmpJump to behavior
                    Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\5435de.msiJump to behavior
                    Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\5435de.msiJump to behavior
                    Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\{FC4B6052-A51F-D41F-8C25-3D41FD6C6B5C}Jump to behavior
                    Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\{FC4B6052-A51F-D41F-8C25-3D41FD6C6B5C}\DefaultIconJump to behavior
                    Source: C:\Windows\SysWOW64\msiexec.exeFile created: C:\Windows\Installer\wix{FC4B6052-A51F-D41F-8C25-3D41FD6C6B5C}.SchedServiceConfig.rmiJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (909a0bac52a7095f)Jump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (909a0bac52a7095f)\33z52vm4.tmpJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (909a0bac52a7095f)\33z52vm4.newcfgJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (909a0bac52a7095f)\qo0hcons.tmpJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (909a0bac52a7095f)\qo0hcons.newcfgJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (909a0bac52a7095f)\alszbl3u.tmpJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (909a0bac52a7095f)\alszbl3u.newcfgJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (909a0bac52a7095f)\nmnun0hu.tmpJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (909a0bac52a7095f)\nmnun0hu.newcfgJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (909a0bac52a7095f)\r2kg0cka.tmpJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (909a0bac52a7095f)\r2kg0cka.newcfgJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (909a0bac52a7095f)\srp51sxk.tmpJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (909a0bac52a7095f)\srp51sxk.newcfgJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (909a0bac52a7095f)\yv4abzkt.tmpJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (909a0bac52a7095f)\yv4abzkt.newcfgJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (909a0bac52a7095f)\fp5c33kt.tmpJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (909a0bac52a7095f)\fp5c33kt.newcfgJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (909a0bac52a7095f)\vxgokhmo.tmpJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (909a0bac52a7095f)\vxgokhmo.newcfgJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (909a0bac52a7095f)\kajzydm0.tmpJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (909a0bac52a7095f)\kajzydm0.newcfgJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (909a0bac52a7095f)\flmhfwwk.tmpJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (909a0bac52a7095f)\flmhfwwk.newcfgJump to behavior
                    Source: C:\Windows\System32\msiexec.exeFile deleted: C:\Windows\Installer\MSI3B8A.tmpJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeCode function: 7_2_00B8D5887_2_00B8D588
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeCode function: 8_2_00007FF848A810CF8_2_00007FF848A810CF
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeCode function: 8_2_00007FF848A810D78_2_00007FF848A810D7
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeCode function: 8_2_00007FF848D96E8B8_2_00007FF848D96E8B
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeCode function: 8_2_00007FF848D95C318_2_00007FF848D95C31
                    Source: MPJ_1281565D#U00ae.msiBinary or memory string: OriginalFilenameScreenConnect.InstallerActions.dll< vs MPJ_1281565D#U00ae.msi
                    Source: MPJ_1281565D#U00ae.msiBinary or memory string: OriginalFilenameSfxCA.dllL vs MPJ_1281565D#U00ae.msi
                    Source: MPJ_1281565D#U00ae.msiBinary or memory string: OriginalFilenamewixca.dll\ vs MPJ_1281565D#U00ae.msi
                    Source: ScreenConnect.WindowsBackstageShell.exe.1.dr, PopoutPanelTaskbarButton.csTask registration methods: 'CreateDefaultDropDown'
                    Source: ScreenConnect.WindowsBackstageShell.exe.1.dr, ProgramTaskbarButton.csTask registration methods: 'CreateDefaultDropDown'
                    Source: ScreenConnect.WindowsBackstageShell.exe.1.dr, TaskbarButton.csTask registration methods: 'CreateDefaultDropDown'
                    Source: ScreenConnect.Windows.dll.1.dr, WindowsExtensions.csSecurity API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
                    Source: ScreenConnect.Windows.dll.1.dr, WindowsExtensions.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                    Source: ScreenConnect.Windows.dll.1.dr, WindowsExtensions.csSecurity API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
                    Source: ScreenConnect.ClientService.dll.1.dr, WindowsLocalUserExtensions.csSecurity API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
                    Source: classification engineClassification label: mal72.evad.winMSI@13/61@4/1
                    Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)Jump to behavior
                    Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.logJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeMutant created: NULL
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeMutant created: \BaseNamedObjects\Global\netfxeventlog.1.0
                    Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Temp\MSI31E4.tmpJump to behavior
                    Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                    Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\MSI31E4.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5518000 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
                    Source: MPJ_1281565D#U00ae.msiStatic file information: TRID: Microsoft Windows Installer (60509/1) 57.88%
                    Source: unknownProcess created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\MPJ_1281565D#U00ae.msi"
                    Source: unknownProcess created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
                    Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 390FD6DCD7E50BFBF112F96E3A0DE021 C
                    Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\MSI31E4.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5518000 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
                    Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 1B5721C1CE0E7EF98DD0EC09055781AD
                    Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding A228E7CE75C97BE8E56E19BF17938851 E Global\MSI0000
                    Source: unknownProcess created: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exe "C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-c89u33-relay.screenconnect.com&p=443&s=8f47f859-e57f-4bd8-9f9a-e730d3b0dc96&k=BgIAAACkAABSU0ExAAgAAAEAAQDpI9qfgaQF9EqFatMP06CsRNHBTKHOK5%2bUtX0qmq8CA4QJH2XTUdjK0ggTdGE4t0YfU4unuKYheAHWWjw%2bjMFfbdlJ1G50ApzOoLoB%2b7pQWX2ZnbVh%2bLfj4JIFwgKtc6Wpc%2fHElrzDuV3d5egfIjs2stKs6RmevReV2ZtwZXMrYZKFQK5QgwhmOTs1pFbFBaiusdjG8NTEcpq2zEicxl0jNKmCw71zqxPy1Lyu3YkOHeZqzMfRsWjzH%2fYVBCAx2I5sAn2Al2rwnZGCoxiYVwlWGITSxEHyjKXWvvVVaCBwjSzlM79WD5B4aCG5QDHn9IzvPCVw%2bHuInNUKsgj2iTG7&t=pdfconvitHir"
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess created: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exe "C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exe" "RunRole" "d04726a4-55e2-40d7-93a5-312106824cb3" "User"
                    Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 390FD6DCD7E50BFBF112F96E3A0DE021 CJump to behavior
                    Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 1B5721C1CE0E7EF98DD0EC09055781ADJump to behavior
                    Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding A228E7CE75C97BE8E56E19BF17938851 E Global\MSI0000Jump to behavior
                    Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\MSI31E4.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5518000 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArgumentsJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess created: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exe "C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exe" "RunRole" "d04726a4-55e2-40d7-93a5-312106824cb3" "User"Jump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: apphelp.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: aclayers.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: sfc.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: sfc_os.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: msi.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: srpapi.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: tsappcmp.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: uxtheme.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: textinputframework.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: coreuicomponents.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: coremessaging.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: ntmarta.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: wintypes.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: wintypes.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: wintypes.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: propsys.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: textshaping.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: netapi32.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: wkscli.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: netutils.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: version.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: mscoree.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: profapi.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: sspicli.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: msihnd.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: pcacli.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: mpr.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: apphelp.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: aclayers.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: sfc.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: sfc_os.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: msi.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: tsappcmp.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: userenv.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: profapi.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: sspicli.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: netapi32.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: wkscli.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: netutils.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: srclient.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: spp.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: powrprof.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: vssapi.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: vsstrace.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: umpdc.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: mscoree.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: version.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: rstrtmgr.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: ncrypt.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: ntasn1.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: pcacli.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: mpr.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: ntmarta.dllJump to behavior
                    Source: C:\Windows\System32\msiexec.exeSection loaded: cabinet.dllJump to behavior
                    Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: apphelp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: aclayers.dllJump to behavior
                    Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: mpr.dllJump to behavior
                    Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc.dllJump to behavior
                    Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc_os.dllJump to behavior
                    Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: cabinet.dllJump to behavior
                    Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: apphelp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: aclayers.dllJump to behavior
                    Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: mpr.dllJump to behavior
                    Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc.dllJump to behavior
                    Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc_os.dllJump to behavior
                    Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: version.dllJump to behavior
                    Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: apphelp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: aclayers.dllJump to behavior
                    Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: mpr.dllJump to behavior
                    Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc.dllJump to behavior
                    Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc_os.dllJump to behavior
                    Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: version.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeSection loaded: apphelp.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeSection loaded: mscoree.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeSection loaded: cryptsp.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeSection loaded: rsaenh.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeSection loaded: cryptbase.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeSection loaded: urlmon.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeSection loaded: iertutil.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeSection loaded: srvcli.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeSection loaded: netutils.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeSection loaded: sspicli.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeSection loaded: propsys.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeSection loaded: version.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeSection loaded: profapi.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeSection loaded: dpapi.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeSection loaded: amsi.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeSection loaded: userenv.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeSection loaded: msasn1.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeSection loaded: gpapi.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeSection loaded: wtsapi32.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeSection loaded: winsta.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeSection loaded: mswsock.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeSection loaded: dnsapi.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeSection loaded: iphlpapi.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeSection loaded: rasadhlp.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeSection loaded: netapi32.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeSection loaded: samcli.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeSection loaded: samlib.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeSection loaded: fwpuclnt.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeSection loaded: dhcpcsvc6.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeSection loaded: dhcpcsvc.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeSection loaded: winnsi.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeSection loaded: rasapi32.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeSection loaded: rasman.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeSection loaded: rtutils.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeSection loaded: winhttp.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeSection loaded: ntmarta.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeSection loaded: mscoree.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeSection loaded: apphelp.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeSection loaded: version.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeSection loaded: uxtheme.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeSection loaded: cryptsp.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeSection loaded: rsaenh.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeSection loaded: cryptbase.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeSection loaded: profapi.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeSection loaded: amsi.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeSection loaded: userenv.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeSection loaded: urlmon.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeSection loaded: iertutil.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeSection loaded: srvcli.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeSection loaded: netutils.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeSection loaded: sspicli.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeSection loaded: propsys.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeSection loaded: windowscodecs.dllJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32Jump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                    Source: MPJ_1281565D#U00ae.msiStatic file information: File size 9920512 > 1048576
                    Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsFileManager\obj\Release\ScreenConnect.WindowsFileManager.pdb source: ScreenConnect.WindowsFileManager.exe.1.dr
                    Source: Binary string: C:\builds\cc\cwcontrol\Product\ClientService\obj\Release\ScreenConnect.ClientService.pdb source: ScreenConnect.WindowsClient.exe, 00000008.00000002.3297693904.0000000002C01000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.3297016236.0000000000DA0000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.3297409679.0000000001122000.00000002.00000001.01000000.0000000B.sdmp, ScreenConnect.ClientService.dll.1.dr
                    Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetServiceRunner.pdb source: ScreenConnect.ClientService.exe, 00000007.00000000.2064073724.0000000000EBD000.00000002.00000001.01000000.0000000A.sdmp, ScreenConnect.ClientService.exe.1.dr
                    Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\Compression.Cab\Microsoft.Deployment.Compression.Cab.pdb source: rundll32.exe, 00000004.00000003.2040950060.00000000046C0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2037797193.0000000004834000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.Cab.dll.4.dr
                    Source: Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdb source: rundll32.exe, 00000004.00000003.2037797193.00000000047C5000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.3300906861.000000001B972000.00000002.00000001.01000000.0000000D.sdmp, ScreenConnect.Windows.dll.1.dr, ScreenConnect.Windows.dll.4.dr
                    Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdb source: Microsoft.Deployment.WindowsInstaller.dll.4.dr
                    Source: Binary string: C:\builds\cc\cwcontrol\Product\InstallerActions\obj\Release\net20\ScreenConnect.InstallerActions.pdb source: ScreenConnect.InstallerActions.dll.4.dr
                    Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdbT source: Microsoft.Deployment.WindowsInstaller.dll.4.dr
                    Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\Compression\Microsoft.Deployment.Compression.pdb source: rundll32.exe, 00000004.00000003.2037797193.00000000047C5000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.dll.4.dr
                    Source: Binary string: C:\build\work\eca3d12b\wix3\build\ship\x86\wixca.pdb source: MPJ_1281565D#U00ae.msi, 5435dd.rbs.1.dr, MSI3A9F.tmp.1.dr, MSI3D60.tmp.1.dr, 5435de.msi.1.dr, 5435dc.msi.1.dr, MSI3B8A.tmp.1.dr
                    Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb source: ScreenConnect.WindowsBackstageShell.exe.1.dr
                    Source: Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdbS] source: rundll32.exe, 00000004.00000003.2037797193.00000000047C5000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.3300906861.000000001B972000.00000002.00000001.01000000.0000000D.sdmp, ScreenConnect.Windows.dll.1.dr, ScreenConnect.Windows.dll.4.dr
                    Source: Binary string: screenconnect_windows_credential_provider.pdb source: ScreenConnect.ClientService.exe, 00000007.00000002.3302471477.0000000002377000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.3299239769.0000000012C10000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsCredentialProvider.dll.1.dr
                    Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\WindowsInstaller.Package\Microsoft.Deployment.WindowsInstaller.Package.pdb source: Microsoft.Deployment.WindowsInstaller.Package.dll.4.dr
                    Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000008.00000000.2072833360.00000000007A2000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.WindowsClient.exe.1.dr
                    Source: Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdbi source: ScreenConnect.WindowsClient.exe, 00000008.00000002.3297349091.00000000010C2000.00000002.00000001.01000000.0000000E.sdmp, ScreenConnect.Client.dll.1.dr
                    Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdbu source: ScreenConnect.WindowsClient.exe, 00000008.00000000.2072833360.00000000007A2000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.WindowsClient.exe.1.dr
                    Source: Binary string: E:\delivery\Dev\wix37_public\build\ship\x86\SfxCA.pdb source: MPJ_1281565D#U00ae.msi, 5435de.msi.1.dr, 5435dc.msi.1.dr, MSI31E4.tmp.0.dr
                    Source: Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdb source: ScreenConnect.WindowsClient.exe, 00000008.00000002.3297349091.00000000010C2000.00000002.00000001.01000000.0000000E.sdmp, ScreenConnect.Client.dll.1.dr
                    Source: Binary string: C:\Compile\screenconnect\Product\WindowsAuthenticationPackage\bin\Release\ScreenConnect.WindowsAuthenticationPackage.pdb source: ScreenConnect.ClientService.exe, 00000007.00000002.3302471477.0000000002377000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.3299239769.0000000012C10000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsAuthenticationPackage.dll.1.dr
                    Source: Binary string: screenconnect_windows_credential_provider.pdb' source: ScreenConnect.ClientService.exe, 00000007.00000002.3302471477.0000000002377000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.3299239769.0000000012C10000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsCredentialProvider.dll.1.dr
                    Source: Binary string: C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: ScreenConnect.ClientService.exe, 00000007.00000002.3297056595.00000000008FC000.00000004.00000020.00020000.00000000.sdmp
                    Source: Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdb source: rundll32.exe, 00000004.00000003.2037797193.0000000004840000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.3297056595.00000000008FC000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.3299876394.000000001B3C2000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.Core.dll.1.dr, ScreenConnect.Core.dll.4.dr
                    Source: ScreenConnect.Client.dll.1.drStatic PE information: 0x94F102E7 [Mon Mar 8 13:28:07 2049 UTC]
                    Source: MSI31E4.tmp.0.drStatic PE information: real checksum: 0x2f213 should be: 0x1125d0
                    Source: ScreenConnect.WindowsAuthenticationPackage.dll.1.drStatic PE information: section name: _RDATA
                    Source: ScreenConnect.WindowsCredentialProvider.dll.1.drStatic PE information: section name: _RDATA
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeCode function: 7_2_05139541 pushfd ; retn 0004h7_2_05139542
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeCode function: 7_2_051395A8 pushfd ; retn 0004h7_2_051395AA
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeCode function: 7_2_051395D9 pushfd ; retn 0004h7_2_051395DA
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeCode function: 7_2_051365D8 pushad ; retn 0004h7_2_051365D9
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeCode function: 7_2_05130460 push cs; retn 0004h7_2_05130462
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeCode function: 7_2_05134730 push edx; retn 0004h7_2_05134732
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeCode function: 7_2_05139650 pushfd ; retn 0004h7_2_05139652
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeCode function: 7_2_05134658 push ecx; retn 0004h7_2_0513465A
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeCode function: 7_2_0513969F pushfd ; retn 0004h7_2_051396A2
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeCode function: 7_2_051346EF push ecx; retn 0004h7_2_051346F2
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeCode function: 7_2_05138220 pushfd ; iretd 7_2_05138229
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeCode function: 7_2_05134F40 push edi; retn 0004h7_2_05134F42
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeCode function: 7_2_05134FC1 push edi; retn 0004h7_2_05134FC2
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeCode function: 7_2_05134FF1 push edi; retn 0004h7_2_05134FF2
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeCode function: 7_2_051349F8 push ebx; retn 0004h7_2_051349FA
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeCode function: 7_2_05134A41 push ebx; retn 0004h7_2_05134A42
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeCode function: 8_2_00007FF848A9096D push ebx; retf 8_2_00007FF848A9098A
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeCode function: 8_2_00007FF848A922B1 push ebx; retf 8_2_00007FF848A922FA
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeCode function: 8_2_00007FF848A908CD push ebx; retf 8_2_00007FF848A9098A
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeCode function: 8_2_00007FF848A800BD pushad ; iretd 8_2_00007FF848A800C1
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeCode function: 8_2_00007FF848D92F5A pushfd ; iretd 8_2_00007FF848D92F5B

                    Persistence and Installation Behavior

                    barindex
                    Possible COM Object hijacking
                    Source: c:\program files (x86)\screenconnect client (909a0bac52a7095f)\screenconnect.windowscredentialprovider.dllCOM Object registered for dropped file: hkey_local_machine\software\classes\clsid\{6ff59a85-bc37-4cd4-9b96-92d47dcb003a}\inprocserver32
                    Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.Client.dllJump to dropped file
                    Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsFileManager.exeJump to dropped file
                    Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.dllJump to dropped file
                    Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI3D60.tmpJump to dropped file
                    Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.Core.dllJump to dropped file
                    Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\MSI31E4.tmp-\Microsoft.Deployment.Compression.Cab.dllJump to dropped file
                    Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.Windows.dllJump to dropped file
                    Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\MSI31E4.tmp-\ScreenConnect.InstallerActions.dllJump to dropped file
                    Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\MSI31E4.tmp-\ScreenConnect.Core.dllJump to dropped file
                    Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsCredentialProvider.dllJump to dropped file
                    Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeJump to dropped file
                    Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsAuthenticationPackage.dllJump to dropped file
                    Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeJump to dropped file
                    Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\MSI31E4.tmp-\Microsoft.Deployment.WindowsInstaller.dllJump to dropped file
                    Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\MSI31E4.tmp-\ScreenConnect.Windows.dllJump to dropped file
                    Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\MSI31E4.tmp-\Microsoft.Deployment.Compression.dllJump to dropped file
                    Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Temp\MSI31E4.tmpJump to dropped file
                    Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\MSI31E4.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dllJump to dropped file
                    Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsBackstageShell.exeJump to dropped file
                    Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI3B8A.tmpJump to dropped file
                    Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI3D60.tmpJump to dropped file
                    Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI3B8A.tmpJump to dropped file
                    Source: ScreenConnect.ClientService.dll.1.drBinary or memory string: bcdedit.exeg/copy {current} /d "Reboot and Reconnect Safe Mode"7{.{8}-.{4}-.{4}-.{4}-.{12}}
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeRegistry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\ApplicationJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeRegistry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (909a0bac52a7095f)Jump to behavior

                    Hooking and other Techniques for Hiding and Protection

                    barindex
                    Contains functionality to hide user accounts
                    Source: rundll32.exe, 00000004.00000003.2037797193.0000000004840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
                    Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.3300906861.000000001B972000.00000002.00000001.01000000.0000000D.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
                    Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.3297693904.0000000002C01000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
                    Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.3297016236.0000000000DA0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
                    Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.3297409679.0000000001122000.00000002.00000001.01000000.0000000B.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
                    Source: ScreenConnect.ClientService.dll.1.drString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
                    Source: ScreenConnect.Windows.dll.1.drString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
                    Source: ScreenConnect.Windows.dll.4.drString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
                    Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeMemory allocated: B80000 memory reserve | memory write watchJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeMemory allocated: 1370000 memory reserve | memory write watchJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeMemory allocated: 3370000 memory reserve | memory write watchJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeMemory allocated: D60000 memory reserve | memory write watchJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeMemory allocated: 1AC00000 memory reserve | memory write watchJump to behavior
                    Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.Client.dllJump to dropped file
                    Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsFileManager.exeJump to dropped file
                    Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.dllJump to dropped file
                    Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Installer\MSI3D60.tmpJump to dropped file
                    Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.Core.dllJump to dropped file
                    Source: C:\Windows\SysWOW64\rundll32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI31E4.tmp-\Microsoft.Deployment.Compression.Cab.dllJump to dropped file
                    Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.Windows.dllJump to dropped file
                    Source: C:\Windows\SysWOW64\rundll32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI31E4.tmp-\ScreenConnect.InstallerActions.dllJump to dropped file
                    Source: C:\Windows\SysWOW64\rundll32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI31E4.tmp-\ScreenConnect.Core.dllJump to dropped file
                    Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsCredentialProvider.dllJump to dropped file
                    Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsAuthenticationPackage.dllJump to dropped file
                    Source: C:\Windows\SysWOW64\rundll32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI31E4.tmp-\Microsoft.Deployment.WindowsInstaller.dllJump to dropped file
                    Source: C:\Windows\SysWOW64\rundll32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI31E4.tmp-\ScreenConnect.Windows.dllJump to dropped file
                    Source: C:\Windows\SysWOW64\rundll32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI31E4.tmp-\Microsoft.Deployment.Compression.dllJump to dropped file
                    Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI31E4.tmpJump to dropped file
                    Source: C:\Windows\SysWOW64\rundll32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI31E4.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dllJump to dropped file
                    Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsBackstageShell.exeJump to dropped file
                    Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Installer\MSI3B8A.tmpJump to dropped file
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exe TID: 5880Thread sleep count: 49 > 30Jump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exe TID: 5560Thread sleep time: -30000s >= -30000sJump to behavior
                    Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                    Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                    Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                    Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                    Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                    Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                    Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                    Source: ScreenConnect.ClientService.exe, 00000007.00000002.3305338984.00000000048C2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                    Source: C:\Windows\System32\msiexec.exeProcess information queried: ProcessInformationJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeProcess token adjusted: DebugJump to behavior
                    Source: C:\Windows\SysWOW64\rundll32.exeMemory allocated: page read and write | page guardJump to behavior

                    HIPS / PFW / Operating System Protection Evasion

                    barindex
                    .NET source code references suspicious native API functions
                    Source: ScreenConnect.ClientService.dll.1.dr, ClientService.csReference to suspicious API methods: WindowsExtensions.OpenProcess(processID, (ProcessAccess)33554432)
                    Source: ScreenConnect.Windows.dll.1.dr, WindowsMemoryNativeLibrary.csReference to suspicious API methods: WindowsNative.VirtualAlloc(attemptImageBase, dwSize, WindowsNative.MEM.MEM_COMMIT | WindowsNative.MEM.MEM_RESERVE, WindowsNative.PAGE.PAGE_READWRITE)
                    Source: ScreenConnect.Windows.dll.1.dr, WindowsMemoryNativeLibrary.csReference to suspicious API methods: WindowsNative.LoadLibrary(loadedImageBase + ptr[i].Name)
                    Source: ScreenConnect.Windows.dll.1.dr, WindowsMemoryNativeLibrary.csReference to suspicious API methods: WindowsNative.GetProcAddress(intPtr, ptr5)
                    Source: ScreenConnect.Windows.dll.1.dr, WindowsMemoryNativeLibrary.csReference to suspicious API methods: WindowsNative.VirtualProtect(loadedImageBase + sectionHeaders[i].VirtualAddress, (IntPtr)num, flNewProtect, &pAGE)
                    Source: unknownProcess created: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exe "c:\program files (x86)\screenconnect client (909a0bac52a7095f)\screenconnect.clientservice.exe" "?e=access&y=guest&h=instance-c89u33-relay.screenconnect.com&p=443&s=8f47f859-e57f-4bd8-9f9a-e730d3b0dc96&k=bgiaaackaabsu0exaagaaaeaaqdpi9qfgaqf9eqfatmp06csrnhbtkhok5%2butx0qmq8ca4qjh2xtudjk0ggtdge4t0yfu4unukyheahwwjw%2bjmffbdlj1g50apzoolob%2b7pqwx2znbvh%2blfj4jifwgktc6wpc%2fhelrzduv3d5egfijs2stks6rmevrev2ztwzxmryzkfqk5qgwhmots1pfbfbaiusdjg8ntecpq2zeicxl0jnkmcw71zqxpy1lyu3ykohezqzmfrswjzh%2fyvbcax2i5san2al2rwnzgcoxiyvwlwgitsxehyjkxwvvvvacbwjszlm79wd5b4acg5qdhn9izvpcvw%2bhuinnuksgj2itg7&t=pdfconvithir"
                    Source: ScreenConnect.WindowsClient.exe, 00000008.00000000.2072833360.00000000007A2000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.WindowsClient.exe.1.drBinary or memory string: Progman
                    Source: ScreenConnect.WindowsClient.exe, 00000008.00000000.2072833360.00000000007A2000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.WindowsClient.exe.1.drBinary or memory string: Shell_TrayWnd-Shell_SecondaryTrayWnd%MsgrIMEWindowClass
                    Source: C:\Windows\System32\msiexec.exeQueries volume information: C:\ VolumeInformationJump to behavior
                    Source: C:\Windows\System32\msiexec.exeQueries volume information: C:\ VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Users\user\AppData\Local\Temp\MSI31E4.tmp-\Microsoft.Deployment.WindowsInstaller.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Users\user\AppData\Local\Temp\MSI31E4.tmp-\ScreenConnect.InstallerActions.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Users\user\AppData\Local\Temp\MSI31E4.tmp-\ScreenConnect.Core.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Users\user\AppData\Local\Temp\MSI31E4.tmp-\ScreenConnect.Windows.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.dll VolumeInformationJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.dll VolumeInformationJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.Core.dll VolumeInformationJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.Windows.dll VolumeInformationJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformationJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.Client.dll VolumeInformationJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exe VolumeInformationJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.Client.dll VolumeInformationJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.Core.dll VolumeInformationJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.Windows.dll VolumeInformationJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformationJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.dll VolumeInformationJump to behavior
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeCode function: 7_2_0513119C CreateNamedPipeW,7_2_0513119C
                    Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exeCode function: 7_2_00B84C62 RtlGetVersion,7_2_00B84C62
                    Source: C:\Windows\SysWOW64\rundll32.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                    Lowering of HIPS / PFW / Operating System Security Settings

                    barindex
                    Modifies security policies related information
                    Source: C:\Windows\System32\msiexec.exeRegistry key created or modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa Authentication PackagesJump to behavior
                    Source: Yara matchFile source: 8.2.ScreenConnect.WindowsClient.exe.2c7fa10.4.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 8.0.ScreenConnect.WindowsClient.exe.7a0000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000008.00000000.2072833360.00000000007A2000.00000002.00000001.01000000.00000010.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000008.00000002.3297693904.0000000002C01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 1776, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: ScreenConnect.WindowsClient.exe PID: 4592, type: MEMORYSTR
                    Source: Yara matchFile source: C:\Config.Msi\5435dd.rbs, type: DROPPED
                    Source: Yara matchFile source: C:\Windows\Installer\MSI3A9F.tmp, type: DROPPED
                    Source: Yara matchFile source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exe, type: DROPPED

                    Mitre Att&ck Matrix

                    ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                    Gather Victim Identity InformationAcquire Infrastructure1
                    Valid Accounts                    		1
                    Native API                    		1
                    DLL Side-Loading                    		1
                    DLL Side-Loading                    		11
                    Disable or Modify Tools                    		OS Credential Dumping11
                    Peripheral Device Discovery                    		Remote Services1
                    Archive Collected Data                    		12
                    Encrypted Channel                    		Exfiltration Over Other Network MediumAbuse Accessibility Features
                    CredentialsDomains1
                    Replication Through Removable Media                    		1
                    Command and Scripting Interpreter                    		1
                    Component Object Model Hijacking                    		1
                    Component Object Model Hijacking                    		1
                    Obfuscated Files or Information                    		LSASS Memory14
                    System Information Discovery                    		Remote Desktop ProtocolData from Removable Media1
                    Non-Application Layer Protocol                    		Exfiltration Over BluetoothNetwork Denial of Service
                    Email AddressesDNS ServerDomain Accounts1
                    Scheduled Task/Job                    		1
                    Valid Accounts                    		1
                    Valid Accounts                    		1
                    Timestomp                    		Security Account Manager1
                    Security Software Discovery                    		SMB/Windows Admin SharesData from Network Shared Drive2
                    Application Layer Protocol                    		Automated ExfiltrationData Encrypted for Impact
                    Employee NamesVirtual Private ServerLocal AccountsCron2
                    Windows Service                    		1
                    Access Token Manipulation                    		1
                    DLL Side-Loading                    		NTDS2
                    Virtualization/Sandbox Evasion                    		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
                    Gather Victim Network InformationServerCloud AccountsLaunchd1
                    Scheduled Task/Job                    		2
                    Windows Service                    		1
                    File Deletion                    		LSA Secrets2
                    Process Discovery                    		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
                    Domain PropertiesBotnetReplication Through Removable MediaScheduled Task1
                    Bootkit                    		3
                    Process Injection                    		22
                    Masquerading                    		Cached Domain CredentialsWi-Fi DiscoveryVNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                    DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup Items1
                    Scheduled Task/Job                    		1
                    Valid Accounts                    		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                    Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
                    Access Token Manipulation                    		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                    Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt2
                    Virtualization/Sandbox Evasion                    		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
                    IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron3
                    Process Injection                    		Network SniffingNetwork Service DiscoveryShared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
                    Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchd1
                    Hidden Users                    		Input CaptureSystem Network Connections DiscoverySoftware Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption
                    Gather Victim Org InformationDNS ServerCompromise Software Supply ChainWindows Command ShellScheduled TaskScheduled Task1
                    Bootkit                    		KeyloggingProcess DiscoveryTaint Shared ContentScreen CaptureDNSExfiltration Over Physical MediumResource Hijacking
                    Determine Physical LocationsVirtual Private ServerCompromise Hardware Supply ChainUnix ShellSystemd TimersSystemd Timers1
                    Rundll32                    		GUI Input CapturePermission Groups DiscoveryReplication Through Removable MediaEmail CollectionProxyExfiltration over USBNetwork Denial of Service

                    Behavior Graph

                    Hide Legend

                    Legend:

                    • Process
                    • Signature
                    • Created File
                    • DNS/IP Info
                    • Is Dropped
                    • Is Windows Process
                    • Number of created Registry Values
                    • Number of created Files
                    • Visual Basic
                    • Delphi
                    • Java
                    • .Net C# or VB.NET
                    • C, C++ or other language
                    • Is malicious
                    • Internet
                    behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1562228 Sample: MPJ_1281565D#U00ae.msi Startdate: 25/11/2024 Architecture: WINDOWS Score: 72 48 server-nix3a3cd951-relay.screenconnect.com 2->48 50 instance-c89u33-relay.screenconnect.com 2->50 54 .NET source code references suspicious native API functions 2->54 56 Contains functionality to hide user accounts 2->56 58 Possible COM Object hijacking 2->58 60 AI detected suspicious sample 2->60 8 msiexec.exe 94 49 2->8         started        12 ScreenConnect.ClientService.exe 17 25 2->12         started        15 msiexec.exe 6 2->15         started        signatures3 process4 dnsIp5 30 ScreenConnect.Wind...dentialProvider.dll, PE32+ 8->30 dropped 32 C:\...\ScreenConnect.ClientService.exe, PE32 8->32 dropped 34 C:\Windows\Installer\MSI3D60.tmp, PE32 8->34 dropped 38 9 other files (none is malicious) 8->38 dropped 64 Enables network access during safeboot for specific services 8->64 66 Modifies security policies related information 8->66 17 msiexec.exe 8->17         started        19 msiexec.exe 1 8->19         started        21 msiexec.exe 8->21         started        52 server-nix3a3cd951-relay.screenconnect.com 147.75.63.88, 443, 49704, 49705 PACKETUS Switzerland 12->52 68 Reads the Security eventlog 12->68 70 Reads the System eventlog 12->70 23 ScreenConnect.WindowsClient.exe 2 12->23         started        36 C:\Users\user\AppData\Local\...\MSI31E4.tmp, PE32 15->36 dropped file6 signatures7 process8 signatures9 26 rundll32.exe 11 17->26         started        62 Contains functionality to hide user accounts 23->62 process10 file11 40 C:\Users\user\...\ScreenConnect.Windows.dll, PE32 26->40 dropped 42 C:\...\ScreenConnect.InstallerActions.dll, PE32 26->42 dropped 44 C:\Users\user\...\ScreenConnect.Core.dll, PE32 26->44 dropped 46 4 other files (none is malicious) 26->46 dropped 72 Contains functionality to hide user accounts 26->72 signatures12

                    Screenshots

                    Thumbnails

                    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                    windows-stand

                    Antivirus, Machine Learning and Genetic Malware Detection

                    Initial Sample

                    ⊘No Antivirus matches

                    Dropped Files

                    SourceDetectionScannerLabelLink
                    C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.Client.dll0%ReversingLabs
                    C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.dll0%ReversingLabs
                    C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exe0%ReversingLabs
                    C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.Core.dll0%ReversingLabs
                    C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.Windows.dll0%ReversingLabs
                    C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsAuthenticationPackage.dll0%ReversingLabs
                    C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsBackstageShell.exe0%ReversingLabs
                    C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exe0%ReversingLabs
                    C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsCredentialProvider.dll0%ReversingLabs
                    C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsFileManager.exe0%ReversingLabs
                    C:\Users\user\AppData\Local\Temp\MSI31E4.tmp0%ReversingLabs
                    C:\Users\user\AppData\Local\Temp\MSI31E4.tmp-\Microsoft.Deployment.Compression.Cab.dll0%ReversingLabs
                    C:\Users\user\AppData\Local\Temp\MSI31E4.tmp-\Microsoft.Deployment.Compression.dll0%ReversingLabs
                    C:\Users\user\AppData\Local\Temp\MSI31E4.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll0%ReversingLabs
                    C:\Users\user\AppData\Local\Temp\MSI31E4.tmp-\Microsoft.Deployment.WindowsInstaller.dll0%ReversingLabs
                    C:\Users\user\AppData\Local\Temp\MSI31E4.tmp-\ScreenConnect.Core.dll0%ReversingLabs
                    C:\Users\user\AppData\Local\Temp\MSI31E4.tmp-\ScreenConnect.InstallerActions.dll0%ReversingLabs
                    C:\Users\user\AppData\Local\Temp\MSI31E4.tmp-\ScreenConnect.Windows.dll0%ReversingLabs
                    C:\Windows\Installer\MSI3B8A.tmp0%ReversingLabs
                    C:\Windows\Installer\MSI3D60.tmp0%ReversingLabs

                    Unpacked PE Files

                    ⊘No Antivirus matches

                    Domains

                    ⊘No Antivirus matches

                    URLs

                    SourceDetectionScannerLabelLink
                    http://instance-c89u33-relay.screenconnect.com:443/d0%Avira URL Cloudsafe
                    http://instance-c89u33-relay.screenconnect.com:443/Nt0%Avira URL Cloudsafe
                    http://instance-c89u33-relay.screenconnect.com:443/jt0%Avira URL Cloudsafe
                    http://instance-c89u33-relay.screenconnect.com:443/xt0%Avira URL Cloudsafe
                    http://instance-c89u33-relay.screenconnect.com:443/0%Avira URL Cloudsafe
                    http://instance-c89u33-relay.screenconnect.com:443/tZ0%Avira URL Cloudsafe
                    http://instance-c89u33-relay.screenconnect.com:443/Dw0%Avira URL Cloudsafe

                    Domains and IPs

                    Contacted Domains

                    NameIPActiveMaliciousAntivirus DetectionReputation
                    server-nix3a3cd951-relay.screenconnect.com
                    		147.75.63.88
                    		truefalse
                      		unknown
                      instance-c89u33-relay.screenconnect.com
                      		unknown
                      		unknownfalse
                        		unknown

                        URLs from Memory and Binaries

                        NameSourceMaliciousAntivirus DetectionReputation
                        http://wixtoolset.org/releases/rundll32.exe, 00000004.00000003.2037998683.00000000046C3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2037797193.00000000047C5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2037797193.0000000004834000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.WindowsInstaller.dll.4.dr, Microsoft.Deployment.WindowsInstaller.Package.dll.4.dr, Microsoft.Deployment.Compression.dll.4.dr, Microsoft.Deployment.Compression.Cab.dll.4.drfalse
                          		high
                          http://instance-c89u33-relay.screenconnect.com:443/dScreenConnect.ClientService.exe, 00000007.00000002.3298215886.0000000001695000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.3298215886.00000000015E1000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.3298215886.00000000018CA000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.3298215886.0000000001735000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.3298215886.0000000001371000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.3298215886.00000000017E7000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.3298215886.000000000189D000.00000004.00000800.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          http://instance-c89u33-relay.screenconnect.com:443/xtScreenConnect.ClientService.exe, 00000007.00000002.3297056595.00000000008FC000.00000004.00000020.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          http://instance-c89u33-relay.screenconnect.com:443/NtScreenConnect.ClientService.exe, 00000007.00000002.3297056595.00000000008FC000.00000004.00000020.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          http://instance-c89u33-relay.screenconnect.com:443/tZScreenConnect.ClientService.exe, 00000007.00000002.3297056595.00000000008FC000.00000004.00000020.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          http://wixtoolset.org/Whttp://wixtoolset.org/telemetry/vrundll32.exe, 00000004.00000003.2037998683.00000000046C3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2037797193.00000000047C5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2037797193.0000000004834000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.WindowsInstaller.dll.4.dr, Microsoft.Deployment.WindowsInstaller.Package.dll.4.dr, Microsoft.Deployment.Compression.dll.4.dr, Microsoft.Deployment.Compression.Cab.dll.4.drfalse
                            		high
                            https://feedback.screenconnect.com/Feedback.axdScreenConnect.Core.dll.4.drfalse
                              		high
                              https://docs.rs/getrandom#nodejs-es-module-supportScreenConnect.WindowsCredentialProvider.dll.1.drfalse
                                		high
                                http://instance-c89u33-relay.screenconnect.com:443/jtScreenConnect.ClientService.exe, 00000007.00000002.3297056595.00000000008FC000.00000004.00000020.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                http://instance-c89u33-relay.screenconnect.com:443/ScreenConnect.ClientService.exe, 00000007.00000002.3297056595.00000000008FC000.00000004.00000020.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                http://wixtoolset.org/news/rundll32.exe, 00000004.00000003.2037998683.00000000046C3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2037797193.00000000047C5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2037797193.0000000004834000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.WindowsInstaller.dll.4.dr, Microsoft.Deployment.WindowsInstaller.Package.dll.4.dr, Microsoft.Deployment.Compression.dll.4.dr, Microsoft.Deployment.Compression.Cab.dll.4.drfalse
                                  		high
                                  http://instance-c89u33-relay.screenconnect.com:443/DwScreenConnect.ClientService.exe, 00000007.00000002.3297056595.00000000008FC000.00000004.00000020.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameScreenConnect.ClientService.exe, 00000007.00000002.3298215886.0000000001371000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high

                                    World Map of Contacted IPs

                                    • No. of IPs < 25%
                                    • 25% < No. of IPs < 50%
                                    • 50% < No. of IPs < 75%
                                    • 75% < No. of IPs

                                    Public IPs

                                    IPDomainCountryFlagASNASN NameMalicious
                                    147.75.63.88
                                    		server-nix3a3cd951-relay.screenconnect.comSwitzerland
                                    		54825PACKETUSfalse

                                    General Information

                                    Joe Sandbox version:41.0.0 Charoite
                                    Analysis ID:1562228
                                    Start date and time:2024-11-25 11:20:11 +01:00
                                    Joe Sandbox product:CloudBasic
                                    Overall analysis duration:0h 7m 0s
                                    Hypervisor based Inspection enabled:false
                                    Report type:full
                                    Cookbook file name:default.jbs
                                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                    Number of analysed new started processes analysed:11
                                    Number of new started drivers analysed:0
                                    Number of existing processes analysed:0
                                    Number of existing drivers analysed:0
                                    Number of injected processes analysed:0
                                    Technologies:
                                    • HCA enabled
                                    • EGA enabled
                                    • AMSI enabled
                                    Analysis Mode:default
                                    Analysis stop reason:Timeout
                                    Sample name:MPJ_1281565D#U00ae.msi
                                    renamed because original name is a hash value
                                    Original Sample Name:MPJ_1281565D.msi
                                    Detection:MAL
                                    Classification:mal72.evad.winMSI@13/61@4/1
                                    EGA Information:
                                    • Successful, ratio: 66.7%
                                    HCA Information:
                                    • Successful, ratio: 72%
                                    • Number of executed functions: 177
                                    • Number of non-executed functions: 1
                                    Cookbook Comments:
                                    • Found application associated with file extension: .msi

                                    Warnings

                                    • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
                                    • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                    • Execution Graph export aborted for target rundll32.exe, PID 1776 because it is empty
                                    • Report size exceeded maximum capacity and may have missing behavior information.
                                    • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                    • Report size getting too big, too many NtEnumerateKey calls found.
                                    • Report size getting too big, too many NtOpenKeyEx calls found.
                                    • Report size getting too big, too many NtQueryValueKey calls found.
                                    • Report size getting too big, too many NtSetInformationFile calls found.
                                    • VT rate limit hit for: MPJ_1281565D#U00ae.msi

                                    Simulations

                                    Behavior and APIs

                                    TimeTypeDescription
                                    05:21:11API Interceptor2x Sleep call for process: ScreenConnect.ClientService.exe modified

                                    Joe Sandbox View / Context

                                    IPs

                                    ⊘No context

                                    Domains

                                    ⊘No context

                                    ASNs

                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                    PACKETUShmips.elfGet hashmaliciousUnknownBrowse
                                    • 103.136.150.114
                                    arm7.elfGet hashmaliciousUnknownBrowse
                                    • 103.136.150.114
                                    x86.elfGet hashmaliciousUnknownBrowse
                                    • 103.136.150.114
                                    hmips.elfGet hashmaliciousUnknownBrowse
                                    • 103.136.150.114
                                    o4QEzeCniw.exeGet hashmaliciousUnknownBrowse
                                    • 193.26.115.43
                                    q1M9Xfi0yC.exeGet hashmaliciousScreenConnect ToolBrowse
                                    • 173.46.80.52
                                    iZRt9uAa2V.exeGet hashmaliciousScreenConnect ToolBrowse
                                    • 173.46.80.52
                                    QyCFuoyz9G.exeGet hashmaliciousScreenConnect ToolBrowse
                                    • 147.75.50.76
                                    q1M9Xfi0yC.exeGet hashmaliciousScreenConnect ToolBrowse
                                    • 173.46.80.52
                                    iZRt9uAa2V.exeGet hashmaliciousScreenConnect ToolBrowse
                                    • 173.46.80.52

                                    JA3 Fingerprints

                                    ⊘No context

                                    Dropped Files

                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                    C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.Client.dllAdobeAcrobatReader.ClientSetup.exeGet hashmaliciousScreenConnect ToolBrowse
                                      AdobeAcrobatReader.ClientSetup.exeGet hashmaliciousScreenConnect ToolBrowse
                                        Support.Client (1).exeGet hashmaliciousScreenConnect ToolBrowse
                                          Support.Client (1).exeGet hashmaliciousScreenConnect ToolBrowse
                                            Rechnung_10401.jsGet hashmaliciousScreenConnect ToolBrowse
                                              Rechnung_Datum_November 24_6957.jsGet hashmaliciousScreenConnect ToolBrowse
                                                file.exeGet hashmaliciousScreenConnect ToolBrowse
                                                  file.exeGet hashmaliciousScreenConnect ToolBrowse
                                                    C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.dllAdobeAcrobatReader.ClientSetup.exeGet hashmaliciousScreenConnect ToolBrowse
                                                      AdobeAcrobatReader.ClientSetup.exeGet hashmaliciousScreenConnect ToolBrowse
                                                        Support.Client (1).exeGet hashmaliciousScreenConnect ToolBrowse
                                                          Support.Client (1).exeGet hashmaliciousScreenConnect ToolBrowse
                                                            Rechnung_10401.jsGet hashmaliciousScreenConnect ToolBrowse
                                                              Rechnung_Datum_November 24_6957.jsGet hashmaliciousScreenConnect ToolBrowse
                                                                file.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                  file.exeGet hashmaliciousScreenConnect ToolBrowse

                                                                    Created / dropped Files

                                                                    C:\Config.Msi\5435dd.rbs

                                                                    Download File
                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                    File Type:data
                                                                    Category:modified
                                                                    Size (bytes):219312
                                                                    Entropy (8bit):6.582916431208033
                                                                    Encrypted:false
                                                                    SSDEEP:3072:q+49LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGac3:N4uH2aCGw1ST1wQLdqvac3
                                                                    MD5:570828F3081913321F14DF11F8F4361F
                                                                    SHA1:72FA8EB4FEEBB34E21ED61F75DA2666346B45E9F
                                                                    SHA-256:2085A5DB18D6142221A60BADCC79BB5E1B8E0D5969A90A658064830DEA062838
                                                                    SHA-512:C39251BD88558470441D3F5A75CC67453D1F9346510B7E1A7333D5E296BEF0D7486F0A97E01626E3AFD404C3E2A06F1B1837E57F96F1A1348BCF4754880F96F5
                                                                    Malicious:false
                                                                    Yara Hits:
                                                                    • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Config.Msi\5435dd.rbs, Author: Joe Security
                                                                    Reputation:low
                                                                    Preview:...@IXOS.@.....@.*yY.@.....@.....@.....@.....@.....@......&.{FC4B6052-A51F-D41F-8C25-3D41FD6C6B5C}'.ScreenConnect Client (909a0bac52a7095f)..MPJ_1281565D#U00ae.msi.@.....@.....@.....@......DefaultIcon..&.{FC4B6052-A51F-D41F-8C25-3D41FD6C6B5C}.....@.....@.....@.....@.......@.....@.....@.......@....'.ScreenConnect Client (909a0bac52a7095f)......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{47A26A37-A09C-9C2B-F052-17D016FF460A}&.{FC4B6052-A51F-D41F-8C25-3D41FD6C6B5C}.@......&.{FFA60116-BCE6-09BA-2F93-D6DD451B89E4}&.{FC4B6052-A51F-D41F-8C25-3D41FD6C6B5C}.@......&.{4AE84DA6-0F60-EBBC-A87C-9F0E681E5F22}&.{FC4B6052-A51F-D41F-8C25-3D41FD6C6B5C}.@......&.{D3E00442-84FA-B382-45F2-F5FD094C6BCC}&.{FC4B6052-A51F-D41F-8C25-3D41FD6C6B5C}.@......&.{604A5AFD-E5C3-442C-132B-10096593AAF6}&.{FC4B6052-A51F-D41F-8C25-3D41FD6C6B5C}.@......&.{0265A5B7-3750-60DF-278A-26B0155A5FF8}&.{FC4B6052-A51F-D41F-8C25-3D41FD

                                                                    C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\Client.en-US.resources

                                                                    Download File
                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                    File Type:data
                                                                    Category:dropped
                                                                    Size (bytes):50133
                                                                    Entropy (8bit):4.759054454534641
                                                                    Encrypted:false
                                                                    SSDEEP:1536:p1+F+UTQd/3EUDv8vw+Dsj2jr0FJK97w/Leh/KR1exJKekmrg9:p1+F+UTQWUDv8vw+Dsj2jr0FJK97w/LR
                                                                    MD5:D524E8E6FD04B097F0401B2B668DB303
                                                                    SHA1:9486F89CE4968E03F6DCD082AA2E4C05AEF46FCC
                                                                    SHA-256:07D04E6D5376FFC8D81AFE8132E0AA6529CCCC5EE789BEA53D56C1A2DA062BE4
                                                                    SHA-512:E5BC6B876AFFEB252B198FEB8D213359ED3247E32C1F4BFC2C5419085CF74FE7571A51CAD4EAAAB8A44F1421F7CA87AF97C9B054BDB83F5A28FA9A880D4EFDE5
                                                                    Malicious:false
                                                                    Reputation:moderate, very likely benign file
                                                                    Preview:...........lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.q...'..6....wp.......y....C|.)>..Ldt..... $...X..........1$.../...2.%%3./>>...L.y.0.C._.........1Y..Qj.o....<....=...R..;...C....&.......1p2.r.x.u?Y..R...c......X.....I.5.2q..R...>.E.pw .@ ).w.l.....S...X..'.C.I......-.Y........4.J..P<.E..=c!.@To..#.._.2.....K.!..h...z......t......^..4...D...f..Q...:..%.z.<......^.....;<...r..yC.....Q........4_.Sns..z.......=..]t...X..<....8.e`}..n....S.H[..S@?.~....,...j.2..*v.......B....A...a......D..c..w..K,..t...S.....*v....7.6|..&.....r....#....G......Y...i..'.............'.......Z.....#2e..........|....)..%....A.....4{..u;N......&q...}.tD..x.....4...J...L......5.Q..M....K..3U..M..............5...........t.>.......lYu....3TY.?...r...'.......3.m........=.H...#.o.........n.....,4.~...<h..u...i.H...V......V/...P.$%..z...

                                                                    C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\Client.resources

                                                                    Download File
                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                    File Type:data
                                                                    Category:dropped
                                                                    Size (bytes):26722
                                                                    Entropy (8bit):7.7401940386372345
                                                                    Encrypted:false
                                                                    SSDEEP:384:rAClIRkKxFCQPZhNAmutHcRIfvVf6yMt+FRVoSVCdcDk6jO0n/uTYUq5ZplYKlBy:MV3PZrXgTf6vEVm6zjpGYUElerG49
                                                                    MD5:5CD580B22DA0C33EC6730B10A6C74932
                                                                    SHA1:0B6BDED7936178D80841B289769C6FF0C8EEAD2D
                                                                    SHA-256:DE185EE5D433E6CFBB2E5FCC903DBD60CC833A3CA5299F2862B253A41E7AA08C
                                                                    SHA-512:C2494533B26128FBF8149F7D20257D78D258ABFFB30E4E595CB9C6A742F00F1BF31B1EE202D4184661B98793B9909038CF03C04B563CE4ECA1E2EE2DEC3BF787
                                                                    Malicious:false
                                                                    Preview:...........lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP)...s^.J.....E.....(....jF.C...1P)...H..../..72J..I.J.a.K8c._.ks`.k.`.kK..m.M6p............b...P...........'...!...............K...............w.......P.......1......."A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.1.6.....$A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.2.5.6....."A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.3.2....."A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.4.8.....,A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.B.l.a.n.k.1.6.;...(A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.M.a.c.2.2.....0A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.O.p.a.q.u.e.1.9.2.8...,A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.T.i.t.l.e.1.6.....6B.l.a.n.k.M.o.n.i.t.o.r.B.a.c.k.g.r.o.u.n.d.C.o.l.o.r.4...6B.l.a.n.k.M.o.n.i.t.o.r.B.a.c.k.g.r.o.u.n.d.I.m.a.g.e.:...DB.l.a.n.k.M.o.n.i.t.o.r.B.a.c.k.g.r.o.u.n.d.I.m.a.g.e.V.i.s.i.b.l.e.xb..*B.l.a.n.k.M.o.n.i.t.o.r.T.e.x.t.C.o.l.o.r..b..*D.a.r.k.T.h.e.m.e.B.a.r.B.a.s.e.C.o.l.o.r..b..<D.a.r.k.T.h.

                                                                    C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.Client.dll

                                                                    Download File
                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                    Category:dropped
                                                                    Size (bytes):197120
                                                                    Entropy (8bit):6.586775768189165
                                                                    Encrypted:false
                                                                    SSDEEP:3072:/xLtNGTlIyS7/ObjusqVFJRJcyzvYqSmzDvJXYF:FtNGTGySabqPJYbqSmG
                                                                    MD5:3724F06F3422F4E42B41E23ACB39B152
                                                                    SHA1:1220987627782D3C3397D4ABF01AC3777999E01C
                                                                    SHA-256:EA0A545F40FF491D02172228C1A39AE68344C4340A6094486A47BE746952E64F
                                                                    SHA-512:509D9A32179A700AD76471B4CD094B8EB6D5D4AE7AD15B20FD76C482ED6D68F44693FC36BCB3999DA9346AE9E43375CD8FE02B61EDEABE4E78C4E2E44BF71D42
                                                                    Malicious:false
                                                                    Antivirus:
                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                    Joe Sandbox View:
                                                                    • Filename: AdobeAcrobatReader.ClientSetup.exe, Detection: malicious, Browse
                                                                    • Filename: AdobeAcrobatReader.ClientSetup.exe, Detection: malicious, Browse
                                                                    • Filename: Support.Client (1).exe, Detection: malicious, Browse
                                                                    • Filename: Support.Client (1).exe, Detection: malicious, Browse
                                                                    • Filename: Rechnung_10401.js, Detection: malicious, Browse
                                                                    • Filename: Rechnung_Datum_November 24_6957.js, Detection: malicious, Browse
                                                                    • Filename: file.exe, Detection: malicious, Browse
                                                                    • Filename: file.exe, Detection: malicious, Browse
                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.................. ... ....... .......................`......#.....@.................................A...O.... ..|....................@..........8............................................ ............... ..H............text........ ...................... ..`.rsrc...|.... ......................@..@.reloc.......@......................@..B................u.......H...........4............_...... .........................................(....*..(....*^.(...........%...}....*:.(......}....*:.(......}....*:.(......}....*..{....*:.(......}....*.0..A........(....s....%.~(...%-.&~'.....y...s....%.(...(...+(...+o"...o....*....0..s.......~#.....2. ....+...j..... ......... ...............%.r...p.%.r...p............%.&...($....5..............s%....=...*..0...........~*...%-.&~).....|...s&...%.*...(...+..~+...%-.&~).....}...s(...%.+...(...+.r9..

                                                                    C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.dll

                                                                    Download File
                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                    Category:dropped
                                                                    Size (bytes):68096
                                                                    Entropy (8bit):6.06942231395039
                                                                    Encrypted:false
                                                                    SSDEEP:1536:+A0ZscQ5V6TsQqoSD6h6+39QFVIl1zJhb8gq:p0Zy3gUOQFVQzJq
                                                                    MD5:5DB908C12D6E768081BCED0E165E36F8
                                                                    SHA1:F2D3160F15CFD0989091249A61132A369E44DEA4
                                                                    SHA-256:FD5818DCDF5FC76316B8F7F96630EC66BB1CB5B5A8127CF300E5842F2C74FFCA
                                                                    SHA-512:8400486CADB7C07C08338D8876BC14083B6F7DE8A8237F4FE866F4659139ACC0B587EB89289D281106E5BAF70187B3B5E86502A2E340113258F03994D959328D
                                                                    Malicious:false
                                                                    Antivirus:
                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                    Joe Sandbox View:
                                                                    • Filename: AdobeAcrobatReader.ClientSetup.exe, Detection: malicious, Browse
                                                                    • Filename: AdobeAcrobatReader.ClientSetup.exe, Detection: malicious, Browse
                                                                    • Filename: Support.Client (1).exe, Detection: malicious, Browse
                                                                    • Filename: Support.Client (1).exe, Detection: malicious, Browse
                                                                    • Filename: Rechnung_10401.js, Detection: malicious, Browse
                                                                    • Filename: Rechnung_Datum_November 24_6957.js, Detection: malicious, Browse
                                                                    • Filename: file.exe, Detection: malicious, Browse
                                                                    • Filename: file.exe, Detection: malicious, Browse
                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...nu............" ..0.............. ... ...@....... ..............................p.....@.................................e ..O....@.......................`..........8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................. ......H........n..@...................<.........................................(....*^.(...........%...}....*:.(......}....*:.(......}....*:.(......}....*.~,...%-.&~+.....i...s....%.,...(...+*vs....%.}P.........s....(....*....0...........s....}.....s....}...........}.......(&.....}.....(....&.()..........s....o.....()...~-...%-.&~+.....j...s....%.-...o ....s!...}.....s"...}.....s#...}...... .... 0u.........s....s=...}....... ..6........s....s=...}.....('...($............o%........

                                                                    C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exe

                                                                    Download File
                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                    Category:dropped
                                                                    Size (bytes):95512
                                                                    Entropy (8bit):6.504684691533346
                                                                    Encrypted:false
                                                                    SSDEEP:1536:Eg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkggU0HMx790K:dhbNDxZGXfdHrX7rAc6myJkggU0HqB
                                                                    MD5:75B21D04C69128A7230A0998086B61AA
                                                                    SHA1:244BD68A722CFE41D1F515F5E40C3742BE2B3D1D
                                                                    SHA-256:F1B5C000794F046259121C63ED37F9EFF0CFE1258588ECA6FD85E16D3922767E
                                                                    SHA-512:8D51B2CD5F21C211EB8FEA4B69DC9F91DFFA7BB004D9780C701DE35EAC616E02CA30EF3882D73412F7EAB1211C5AA908338F3FA10FDF05B110F62B8ECD9D24C2
                                                                    Malicious:true
                                                                    Antivirus:
                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(..qF.qF.qF....qF.....qF....qF.<.B.qF.<.E.qF.<.C.qF....qF.#..qF.qG..qF.2.O.qF.2...qF.2.D.qF.Rich.qF.........................PE..L.....wc...............!.............!............@.................................>)....@.................................p...x....`..P............L...)...p......`!..p............................ ..@............................................text...:........................... ..`.rdata...f.......h..................@..@.data........@.......,..............@....rsrc...P....`.......6..............@..@.reloc.......p.......<..............@..B........................................................................................................................................................................................................................................................................................

                                                                    C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.Core.dll

                                                                    Download File
                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                    Category:dropped
                                                                    Size (bytes):548864
                                                                    Entropy (8bit):6.034211651049746
                                                                    Encrypted:false
                                                                    SSDEEP:12288:xC2YKhQCNc6kVTplfWL/YTHUYCBdySISYz:HhE6O7WL/EC
                                                                    MD5:14E7489FFEBBB5A2EA500F796D881AD9
                                                                    SHA1:0323EE0E1FAA4AA0E33FB6C6147290AA71637EBD
                                                                    SHA-256:A2E9752DE49D18E885CBD61B29905983D44B4BC0379A244BFABDAA3188C01F0A
                                                                    SHA-512:2110113240B7D803D8271139E0A2439DBC86AE8719ECD8B132BBDA2520F22DC3F169598C8E966AC9C0A40E617219CB8FE8AAC674904F6A1AE92D4AC1E20627CD
                                                                    Malicious:false
                                                                    Antivirus:
                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l............." ..0..X...........s... ........... ..............................].....@.................................as..O.......t............................r..8............................................ ............... ..H............text....W... ...X.................. ..`.rsrc...t............Z..............@..@.reloc...............^..............@..B.................s......H........C..,/..................Dr........................................{:...*..{;...*V.(<.....}:.....};...*...0..A........u~.......4.,/(=....{:....{:...o>...,.(?....{;....{;...o@...*.*.*. ... )UU.Z(=....{:...oA...X )UU.Z(?....{;...oB...X*...0..b........r...p......%..{:......%q.........-.&.+.......oC....%..{;......%q.........-.&.+.......oC....(D...*..{E...*..{F...*V.(<.....}E.....}F...*.0..A........u........4.,/(=....{E....{E...o>...,.(?....{F....{F...o@...*.*.*. F.b# )UU.

                                                                    C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.Windows.dll

                                                                    Download File
                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                    Category:dropped
                                                                    Size (bytes):1721856
                                                                    Entropy (8bit):6.639085961200334
                                                                    Encrypted:false
                                                                    SSDEEP:24576:dx5xeYkYFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:dx5xTkYJkGYYpT0+TFiH7efP
                                                                    MD5:9AD3964BA3AD24C42C567E47F88C82B2
                                                                    SHA1:6B4B581FC4E3ECB91B24EC601DAA0594106BCC5D
                                                                    SHA-256:84A09ED81AFC5FF9A17F81763C044C82A2D9E26F852DE528112153EE9AB041D0
                                                                    SHA-512:CE557A89C0FE6DE59046116C1E262A36BBC3D561A91E44DCDA022BEF72CB75742C8B01BEDCC5B9B999E07D8DE1F94C665DD85D277E981B27B6BFEBEAF9E58097
                                                                    Malicious:false
                                                                    Antivirus:
                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...y............." ..0..>..........~]... ...`....... ..............................8.....@.................................+]..O....`..|............................\..8............................................ ............... ..H............text....=... ...>.................. ..`.rsrc...|....`.......@..............@..@.reloc...............D..............@..B................_]......H.......t...d..............0....\........................................()...*^.()..........%...}....*:.().....}....*:.().....}....*:.().....}....*..s*...*..s+...*:.(,.....(-...*..{....*"..}....*J.(/........(0...&*:.(,.....(1...*..{2...*"..}2...*.0..(........(3......+.............(0...&..X....i2.*v.(,....s4...}.....s5...}....*v.{.....r...p(...+.....o7....*.0...........o8....+..o9......(...+&.o....-....,..o......*..........."........{..........o:...&.......(.....*....0..L...

                                                                    C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsAuthenticationPackage.dll

                                                                    Download File
                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                    Category:dropped
                                                                    Size (bytes):260168
                                                                    Entropy (8bit):6.416438906122177
                                                                    Encrypted:false
                                                                    SSDEEP:3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
                                                                    MD5:5ADCB5AE1A1690BE69FD22BDF3C2DB60
                                                                    SHA1:09A802B06A4387B0F13BF2CDA84F53CA5BDC3785
                                                                    SHA-256:A5B8F0070201E4F26260AF6A25941EA38BD7042AEFD48CD68B9ACF951FA99EE5
                                                                    SHA-512:812BE742F26D0C42FDDE20AB4A02F1B47389F8D1ACAA6A5BB3409BA27C64BE444AC06D4129981B48FA02D4C06B526CB5006219541B0786F8F37CF2A183A18A73
                                                                    Malicious:false
                                                                    Antivirus:
                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........A........................T....................V.......V.......V......................=U......=U......=U$.....=U......Rich....................PE..d.....Qf.........." ...'.^...^.......................................................(....`..........................................e.......f..P................ ......HP..........P%..p............................$..@............p...............................text...t].......^.................. ..`.rdata.......p.......b..............@..@.data....+...........d..............@....pdata... ......."...x..............@..@_RDATA..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................

                                                                    C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsBackstageShell.exe

                                                                    Download File
                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                    File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                    Category:dropped
                                                                    Size (bytes):61208
                                                                    Entropy (8bit):6.310126082367387
                                                                    Encrypted:false
                                                                    SSDEEP:1536:kW/+lo6MOc8IoiKWjrNv8DtyQ4RE+TC6WAhVbb57bP8:kLlo6dccldyQGWy5s
                                                                    MD5:AFA97CAF20F3608799E670E9D6253247
                                                                    SHA1:7E410FDE0CA1350AA68EF478E48274888688F8EE
                                                                    SHA-256:E25F32BA3FA32FD0DDD99EB65B26835E30829B5E4B58573690AA717E093A5D8F
                                                                    SHA-512:FE0B378651783EF4ADD3851E12291C82EDCCDE1DBD1FA0B76D7A2C2DCD181E013B9361BBDAE4DAE946C0D45FB4BF6F75DC027F217326893C906E47041E3039B0
                                                                    Malicious:false
                                                                    Antivirus:
                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....c+..........."...0.................. ........@.. ....................... .......r....@.....................................O....... ................)..............8............................................ ............... ..H............text........ ...................... ..`.rsrc... ...........................@..@.reloc..............................@..B........................H........S......................x.........................................(....*^.(.......a...%...}....*:.(......}....*:.(......}....*:.(......}....*....0..........(....(....(....(....r...p(....o....(....r...p..~....(....(....r9..p..~....(....(.....g~).....(....rY..p.(....&(.....(....s....( ...s....(!...*...0...........(".....(#.....($....s....%.o%...%.o&...%.o'...%s!...o(...%~....o)...}......(....o*...o+....(,.....@...%..(.....o-....s....}.....{...........s/...o0....s....}..

                                                                    C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsBackstageShell.exe.config

                                                                    Download File
                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):266
                                                                    Entropy (8bit):4.842791478883622
                                                                    Encrypted:false
                                                                    SSDEEP:6:TMVBd1IffVKNC7VrfC7VNQpuAKr5KNZk2ygAyONO5W4QIT:TMHdG3VO+Qg9LNZoE0Oo4xT
                                                                    MD5:728175E20FFBCEB46760BB5E1112F38B
                                                                    SHA1:2421ADD1F3C9C5ED9C80B339881D08AB10B340E3
                                                                    SHA-256:87C640D3184C17D3B446A72D5F13D643A774B4ECC7AFBEDFD4E8DA7795EA8077
                                                                    SHA-512:FB9B57F4E6C04537E8FDB7CC367743C51BF2A0AD4C3C70DDDAB4EA0CF9FF42D5AEB9D591125E7331374F8201CEBF8D0293AD934C667C1394DC63CE96933124E7
                                                                    Malicious:false
                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" />.. <supportedRuntime version="v2.0.50727" />.. </startup>.. <runtime>.. <generatePublisherEvidence enabled="false" />.. </runtime>..</configuration>

                                                                    C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exe

                                                                    Download File
                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                    File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                    Category:dropped
                                                                    Size (bytes):602392
                                                                    Entropy (8bit):6.176232491934078
                                                                    Encrypted:false
                                                                    SSDEEP:6144:fybAk1FVMVTZL/4TvqpU0pSdRW3akod1sI5mgve8mZXuRFtSc4q2/R4IEyxuV5AN:qbAOwJ/MvIFptJoR5NmtiFsxsFE
                                                                    MD5:1778204A8C3BC2B8E5E4194EDBAF7135
                                                                    SHA1:0203B65E92D2D1200DD695FE4C334955BEFBDDD3
                                                                    SHA-256:600CF10E27311E60D32722654EF184C031A77B5AE1F8ABAE8891732710AFEE31
                                                                    SHA-512:A902080FF8EE0D9AEFFA0B86E7980457A4E3705789529C82679766580DF0DC17535D858FBE50731E00549932F6D49011868DEE4181C6716C36379AD194B0ED69
                                                                    Malicious:false
                                                                    Yara Hits:
                                                                    • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exe, Author: Joe Security
                                                                    Antivirus:
                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."...0.................. ... ....@.. .......................`............@.................................M...O.... ...................)...@..........8............................................ ............... ..H............text...p.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......XJ......................$.........................................{D...*..{E...*V.(F.....}D.....}E...*...0..A........u1.......4.,/(G....{D....{D...oH...,.(I....{E....{E...oJ...*.*.*. }.o )UU.Z(G....{D...oK...X )UU.Z(I....{E...oL...X*...0..b........r...p......%..{D......%q4....4...-.&.+...4...oM....%..{E......%q5....5...-.&.+...5...oM....(N...*..{O...*..{P...*V.(F.....}O.....}P...*.0..A........u6.......4.,/(G....{O....{O...oH...,.(I....{P....{P...oJ...*.*.*. 1.c. )UU.

                                                                    C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exe.config

                                                                    Download File
                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):266
                                                                    Entropy (8bit):4.842791478883622
                                                                    Encrypted:false
                                                                    SSDEEP:6:TMVBd1IffVKNC7VrfC7VNQpuAKr5KNZk2ygAyONO5W4QIT:TMHdG3VO+Qg9LNZoE0Oo4xT
                                                                    MD5:728175E20FFBCEB46760BB5E1112F38B
                                                                    SHA1:2421ADD1F3C9C5ED9C80B339881D08AB10B340E3
                                                                    SHA-256:87C640D3184C17D3B446A72D5F13D643A774B4ECC7AFBEDFD4E8DA7795EA8077
                                                                    SHA-512:FB9B57F4E6C04537E8FDB7CC367743C51BF2A0AD4C3C70DDDAB4EA0CF9FF42D5AEB9D591125E7331374F8201CEBF8D0293AD934C667C1394DC63CE96933124E7
                                                                    Malicious:false
                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" />.. <supportedRuntime version="v2.0.50727" />.. </startup>.. <runtime>.. <generatePublisherEvidence enabled="false" />.. </runtime>..</configuration>

                                                                    C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsCredentialProvider.dll

                                                                    Download File
                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                    Category:dropped
                                                                    Size (bytes):842248
                                                                    Entropy (8bit):6.268561504485627
                                                                    Encrypted:false
                                                                    SSDEEP:12288:q9vy8YABMuiAoPyEIrJs7jBjaau+EAaMVtw:P8Y4MuiAoPyZrJ8jrvDVtw
                                                                    MD5:BE74AB7A848A2450A06DE33D3026F59E
                                                                    SHA1:21568DCB44DF019F9FAF049D6676A829323C601E
                                                                    SHA-256:7A80E8F654B9DDB15DDA59AC404D83DBAF4F6EAFAFA7ECBEFC55506279DE553D
                                                                    SHA-512:2643D649A642220CEEE121038FE24EA0B86305ED8232A7E5440DFFC78270E2BDA578A619A76C5BB5A5A6FE3D9093E29817C5DF6C5DD7A8FBC2832F87AA21F0CC
                                                                    Malicious:true
                                                                    Antivirus:
                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}....}H..}H..}H.d~I..}H.dxIG.}H.dyI..}H..xI..}H..yI..}H..~I..}H..|H8.}H..}H..}H2.}I..}H2..I..}HRich..}H........PE..d.....Gf.........." ...'.P...........H....................................... ......q.....`......................................... ...t....................P...y.......(......,4.....T.......................(.......@............`...............................text....O.......P.................. ..`.rdata...z...`...|...T..............@..@.data....d.......0..................@....pdata...y...P...z..................@..@_RDATA...............z..............@..@.reloc..,4.......6...|..............@..B................................................................................................................................................................................................................................................................

                                                                    C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsFileManager.exe

                                                                    Download File
                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                    File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                    Category:dropped
                                                                    Size (bytes):81688
                                                                    Entropy (8bit):5.8618809599146005
                                                                    Encrypted:false
                                                                    SSDEEP:1536:Ety9l44Kzb1I5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7j27Vy:PvqukLdn2s
                                                                    MD5:1AEE526DC110E24D1399AFFCCD452AB3
                                                                    SHA1:04DB0E8772933BC57364615D0D104DC2550BD064
                                                                    SHA-256:EBD04A4540D6E76776BD58DEEA627345D0F8FBA2C04CC65BE5E979A8A67A62A1
                                                                    SHA-512:482A8EE35D53BE907BE39DBD6C46D1F45656046BACA95630D1F07AC90A66F0E61D41F940FB166677AC4D5A48CF66C28E76D89912AED3D673A80737732E863851
                                                                    Malicious:false
                                                                    Antivirus:
                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....o..........."...0..@...........^... ...`....@.. .......................`.......$....@..................................^..O....`...................)...@.......]..8............................................ ............... ..H............text....>... ...@.................. ..`.rsrc........`.......B..............@..@.reloc.......@......................@..B.................^......H....... +..@2..................`]........................................(....*^.(.......;...%...}....*:.(......}....*:.(......}....*:.(......}....*....0..........s>....(....(....(....(....(.....(....(......s....}B....s....}C....~@...%-.&~?.....<...s ...%.@...o...+.....@...s ...o...+......A...s!...o...+}D.......B...s"...o...+.......(#...&......(#...& .... ...........($...&s....t......r...prs..p(%...(&...~>...%-.&...'...s(...%.>.....A...().......(*........(+...o,...(-...t....

                                                                    C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsFileManager.exe.config

                                                                    Download File
                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):266
                                                                    Entropy (8bit):4.842791478883622
                                                                    Encrypted:false
                                                                    SSDEEP:6:TMVBd1IffVKNC7VrfC7VNQpuAKr5KNZk2ygAyONO5W4QIT:TMHdG3VO+Qg9LNZoE0Oo4xT
                                                                    MD5:728175E20FFBCEB46760BB5E1112F38B
                                                                    SHA1:2421ADD1F3C9C5ED9C80B339881D08AB10B340E3
                                                                    SHA-256:87C640D3184C17D3B446A72D5F13D643A774B4ECC7AFBEDFD4E8DA7795EA8077
                                                                    SHA-512:FB9B57F4E6C04537E8FDB7CC367743C51BF2A0AD4C3C70DDDAB4EA0CF9FF42D5AEB9D591125E7331374F8201CEBF8D0293AD934C667C1394DC63CE96933124E7
                                                                    Malicious:false
                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" />.. <supportedRuntime version="v2.0.50727" />.. </startup>.. <runtime>.. <generatePublisherEvidence enabled="false" />.. </runtime>..</configuration>

                                                                    C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\app.config

                                                                    Download File
                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):1408
                                                                    Entropy (8bit):4.6834451483854815
                                                                    Encrypted:false
                                                                    SSDEEP:24:389hKK5AfdHv05AfdHvv/dHva/dHvc/dHvLdHvidHvAOPdHvJOPdHvLOPdHvP:Oh95AfdH85AfdHH/dHS/dH0/dHjdH6dv
                                                                    MD5:6E52818C1E99B3A54A79E311C0E84D3F
                                                                    SHA1:C74942596522D2DA3D88966F1A357DD4BA014700
                                                                    SHA-256:0370AE43EBB8C44C6B5AE9CB0761E495829E301D3D380BFC3CF5AE1BD3298C53
                                                                    SHA-512:5C0E81133662DFF1EA743E706B819FE74D5E87C59DDC8A7D1A2AF28ACAA621DB4EC9DF4CB85665CE8F13DBC1C7B613365BA59BE98AE05C6029529BA858849FE5
                                                                    Malicious:false
                                                                    Preview:<?xml version="1.0"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="SupportShowUnderControlBanner" serializeAs="String">.. <value>false</value>.. </setting>.. <setting name="AccessShowUnderControlBanner" serializeAs="String">.. <value>false</value>.. </setting>.. <setting name="SupportShowBalloonOnConnect" serializeAs="String">.. <value>false</value>.. </setting>.. <setting name="AccessShowBalloonOnConnect" serializeAs="String">.. <value>false</value>.. </setting>.. <setting name="ShowBalloonOnConnect" serializeAs="String">.. <value>false</value>.. </setting>.. <setting name="SupportShowBalloonOnHide" serializeAs="String">.. <value>false</value>.. </setting>.. <setting name="AccessShowBalloonOnHide" serializeAs="String">.. <value>false</val

                                                                    C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\system.config

                                                                    Download File
                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                    File Type:XML 1.0 document, ASCII text, with very long lines (468), with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):958
                                                                    Entropy (8bit):5.7830327552367224
                                                                    Encrypted:false
                                                                    SSDEEP:24:2dL9hK6E4dl/5xxuv/unqopA36rW9hCDyLWPRvH:chh7HH5Kv/cqfjvov
                                                                    MD5:738622FEFB00B23C2343FD3F55677E34
                                                                    SHA1:311A6C27E59FEA3A7521F684B3BBF37BFA06A69D
                                                                    SHA-256:379F4C7AF43947BD659E7635AA9B366C22C748DB5EAD27AAB07C4EA8B166EAAF
                                                                    SHA-512:E14F201BF49B9FD29037AD14EB2559C0B98A68DE8A32D5C0D5B3CB1D1C2ADB94A35BBCE9DEFEF977383D051DB3CD49B64CB9BA0FAFEC8F25E571D0F0995072A5
                                                                    Malicious:false
                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="ClientLaunchParametersConstraint" serializeAs="String">.. <value>?h=instance-c89u33-relay.screenconnect.com&amp;p=443&amp;k=BgIAAACkAABSU0ExAAgAAAEAAQDpI9qfgaQF9EqFatMP06CsRNHBTKHOK5%2bUtX0qmq8CA4QJH2XTUdjK0ggTdGE4t0YfU4unuKYheAHWWjw%2bjMFfbdlJ1G50ApzOoLoB%2b7pQWX2ZnbVh%2bLfj4JIFwgKtc6Wpc%2fHElrzDuV3d5egfIjs2stKs6RmevReV2ZtwZXMrYZKFQK5QgwhmOTs1pFbFBaiusdjG8NTEcpq2zEicxl0jNKmCw71zqxPy1Lyu3YkOHeZqzMfRsWjzH%2fYVBCAx2I5sAn2Al2rwnZGCoxiYVwlWGITSxEHyjKXWvvVVaCBwjSzlM79WD5B4aCG5QDHn9IzvPCVw%2bHuInNUKsgj2iTG7</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                    C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log

                                                                    Download File
                                                                    Process:C:\Windows\SysWOW64\rundll32.exe
                                                                    File Type:ASCII text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):746
                                                                    Entropy (8bit):5.349174276064173
                                                                    Encrypted:false
                                                                    SSDEEP:12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhaOK9eDLI4MNJK9P/JNTK9yirkvoDLb:ML9E4KlKDE4KhKiKhPKIE4oKNzKogE4P
                                                                    MD5:ED994980CB1AABB953B2C8ECDC745E1F
                                                                    SHA1:9E9D3E00A69FC862F4D3C30F42BF26693A2D2A21
                                                                    SHA-256:D23B54CCF9F6327FE1158762D4E5846649699A7B78418D056A197835ED1EBE79
                                                                    SHA-512:61DFC93154BCD734B9836A6DECF93674499FF533E2B9A1188886E2CBD04DF35538368485AA7E775B641ADC120BAE1AC2551B28647951C592AA77F6747F0E9187
                                                                    Malicious:false
                                                                    Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

                                                                    C:\Users\user\AppData\Local\Temp\MSI31E4.tmp

                                                                    Download File
                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, InstallShield self-extracting archive
                                                                    Category:dropped
                                                                    Size (bytes):1088392
                                                                    Entropy (8bit):7.789940577622617
                                                                    Encrypted:false
                                                                    SSDEEP:24576:QUUGGHn+rUGemcPe9MpKL4Plb2sZWV+tLv0QYu5OPthT+gd:jGHpRPqMpvlqs0O4iO2k
                                                                    MD5:8A8767F589EA2F2C7496B63D8CCC2552
                                                                    SHA1:CC5DE8DD18E7117D8F2520A51EDB1D165CAE64B0
                                                                    SHA-256:0918D8AB2237368A5CEC8CE99261FB07A1A1BEEDA20464C0F91AF0FE3349636B
                                                                    SHA-512:518231213CA955ACDF37B4501FDE9C5B15806D4FC166950EB8706E8D3943947CF85324FAEE806D7DF828485597ECEFFCFA05CA1A5D8AB1BD51ED12DF963A1FE4
                                                                    Malicious:false
                                                                    Antivirus:
                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........S.c.2.0.2.0.2.0..|0.2.0..H0.2.0.Jq0.2.0.2.0.2.0..I0.2.0..y0.2.0..x0.2.0...0.2.0Rich.2.0................PE..L...9..P...........!.........H.......i.......................................p............@..............................*..l...x....@.......................P..d.......................................@...............h............................text............................... ..`.rdata..............................@..@.data....-..........................@....rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                    C:\Users\user\AppData\Local\Temp\MSI31E4.tmp-\CustomAction.config

                                                                    Download File
                                                                    Process:C:\Windows\SysWOW64\rundll32.exe
                                                                    File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):234
                                                                    Entropy (8bit):4.977464602412109
                                                                    Encrypted:false
                                                                    SSDEEP:6:JiMVBdTMkIffVymRMT4/0xC/C7VrfC7VNQpuAW4QIT:MMHd413VymhsS+Qg93xT
                                                                    MD5:6F52EBEA639FD7CEFCA18D9E5272463E
                                                                    SHA1:B5E8387C2EB20DD37DF8F4A3B9B0E875FA5415E3
                                                                    SHA-256:7027B69AB6EBC9F3F7D2F6C800793FDE2A057B76010D8CFD831CF440371B2B23
                                                                    SHA-512:B5960066430ED40383D39365EADB3688CADADFECA382404924024C908E32C670AFABD37AB41FF9E6AC97491A5EB8B55367D7199002BF8569CF545434AB2F271A
                                                                    Malicious:false
                                                                    Preview:.<?xml version="1.0" encoding="utf-8" ?>..<configuration>.. <startup useLegacyV2RuntimeActivationPolicy="true">.. <supportedRuntime version="v4.0" />.. <supportedRuntime version="v2.0.50727" />.. </startup>..</configuration>

                                                                    C:\Users\user\AppData\Local\Temp\MSI31E4.tmp-\Microsoft.Deployment.Compression.Cab.dll

                                                                    Download File
                                                                    Process:C:\Windows\SysWOW64\rundll32.exe
                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                    Category:dropped
                                                                    Size (bytes):49152
                                                                    Entropy (8bit):4.62694170304723
                                                                    Encrypted:false
                                                                    SSDEEP:768:sqbC2wmdVdX9Y6BCH+C/FEQl2ifnxwr02Gy/G4Xux+bgHGvLw4:sAtXPC/Cifnxs02Gyu4Xu0MeR
                                                                    MD5:77BE59B3DDEF06F08CAA53F0911608A5
                                                                    SHA1:A3B20667C714E88CC11E845975CD6A3D6410E700
                                                                    SHA-256:9D32032109FFC217B7DC49390BD01A067A49883843459356EBFB4D29BA696BF8
                                                                    SHA-512:C718C1AFA95146B89FC5674574F41D994537AF21A388335A38606AEC24D6A222CBCE3E6D971DFE04D86398E607815DF63A54DA2BB96CCF80B4F52072347E1CE6
                                                                    Malicious:false
                                                                    Antivirus:
                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....F.Y.........." ..0...... ........... ........... ...............................$....@....................................O.................................................................................... ............... ..H............text... .... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                    C:\Users\user\AppData\Local\Temp\MSI31E4.tmp-\Microsoft.Deployment.Compression.dll

                                                                    Download File
                                                                    Process:C:\Windows\SysWOW64\rundll32.exe
                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                    Category:dropped
                                                                    Size (bytes):36864
                                                                    Entropy (8bit):4.340550904466943
                                                                    Encrypted:false
                                                                    SSDEEP:384:GqJxldkxhW9N5u8IALLU0X9Z1kTOPJlqE:GqJxl6xsPIA9COxlqE
                                                                    MD5:4717BCC62EB45D12FFBED3A35BA20E25
                                                                    SHA1:DA6324A2965C93B70FC9783A44F869A934A9CAF7
                                                                    SHA-256:E04DE7988A2A39931831977FA22D2A4C39CF3F70211B77B618CAE9243170F1A7
                                                                    SHA-512:BB0ABC59104435171E27830E094EAE6781D2826ED2FC9009C8779D2CA9399E38EDB1EC6A10C1676A5AF0F7CACFB3F39AC2B45E61BE2C6A8FE0EDB1AF63A739CA
                                                                    Malicious:false
                                                                    Antivirus:
                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....F.Y.........." ..0..`... .......~... ........... ....................................@.................................X~..O................................... }............................................... ............... ..H............text....^... ...`.................. ..`.rsrc................p..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                    C:\Users\user\AppData\Local\Temp\MSI31E4.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll

                                                                    Download File
                                                                    Process:C:\Windows\SysWOW64\rundll32.exe
                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                    Category:dropped
                                                                    Size (bytes):57344
                                                                    Entropy (8bit):4.657268358041957
                                                                    Encrypted:false
                                                                    SSDEEP:768:BLNru62y+VqB4N5SBcDhDxW7ZkCmX2Qv1Sf0AQdleSBRxf+xUI3:BJ2yUGmh2O11AsleyRxf+xt
                                                                    MD5:A921A2B83B98F02D003D9139FA6BA3D8
                                                                    SHA1:33D67E11AD96F148FD1BFD4497B4A764D6365867
                                                                    SHA-256:548C551F6EBC5D829158A1E9AD1948D301D7C921906C3D8D6B6D69925FC624A1
                                                                    SHA-512:E1D7556DAF571C009FE52D6FFE3D6B79923DAEEA39D754DDF6BEAFA85D7A61F3DB42DFC24D4667E35C4593F4ED6266F4099B393EFA426FA29A72108A0EAEDD3E
                                                                    Malicious:false
                                                                    Antivirus:
                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....F.Y.........." ..0...... ........... ........... ....................... .......t....@.....................................O...................................`................................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                    C:\Users\user\AppData\Local\Temp\MSI31E4.tmp-\Microsoft.Deployment.WindowsInstaller.dll

                                                                    Download File
                                                                    Process:C:\Windows\SysWOW64\rundll32.exe
                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                    Category:dropped
                                                                    Size (bytes):176128
                                                                    Entropy (8bit):5.775360792482692
                                                                    Encrypted:false
                                                                    SSDEEP:3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
                                                                    MD5:5EF88919012E4A3D8A1E2955DC8C8D81
                                                                    SHA1:C0CFB830B8F1D990E3836E0BCC786E7972C9ED62
                                                                    SHA-256:3E54286E348EBD3D70EAED8174CCA500455C3E098CDD1FCCB167BC43D93DB29D
                                                                    SHA-512:4544565B7D69761F9B4532CC85E7C654E591B2264EB8DA28E60A058151030B53A99D1B2833F11BFC8ACC837EECC44A7D0DBD8BC7AF97FC0E0F4938C43F9C2684
                                                                    Malicious:false
                                                                    Antivirus:
                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....F.Y.........." ..0...... ......~.... ........... ..............................!|....@.................................,...O.................................................................................... ............... ..H............text....w... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                    C:\Users\user\AppData\Local\Temp\MSI31E4.tmp-\ScreenConnect.Core.dll

                                                                    Download File
                                                                    Process:C:\Windows\SysWOW64\rundll32.exe
                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                    Category:dropped
                                                                    Size (bytes):548864
                                                                    Entropy (8bit):6.034211651049746
                                                                    Encrypted:false
                                                                    SSDEEP:12288:xC2YKhQCNc6kVTplfWL/YTHUYCBdySISYz:HhE6O7WL/EC
                                                                    MD5:14E7489FFEBBB5A2EA500F796D881AD9
                                                                    SHA1:0323EE0E1FAA4AA0E33FB6C6147290AA71637EBD
                                                                    SHA-256:A2E9752DE49D18E885CBD61B29905983D44B4BC0379A244BFABDAA3188C01F0A
                                                                    SHA-512:2110113240B7D803D8271139E0A2439DBC86AE8719ECD8B132BBDA2520F22DC3F169598C8E966AC9C0A40E617219CB8FE8AAC674904F6A1AE92D4AC1E20627CD
                                                                    Malicious:false
                                                                    Antivirus:
                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l............." ..0..X...........s... ........... ..............................].....@.................................as..O.......t............................r..8............................................ ............... ..H............text....W... ...X.................. ..`.rsrc...t............Z..............@..@.reloc...............^..............@..B.................s......H........C..,/..................Dr........................................{:...*..{;...*V.(<.....}:.....};...*...0..A........u~.......4.,/(=....{:....{:...o>...,.(?....{;....{;...o@...*.*.*. ... )UU.Z(=....{:...oA...X )UU.Z(?....{;...oB...X*...0..b........r...p......%..{:......%q.........-.&.+.......oC....%..{;......%q.........-.&.+.......oC....(D...*..{E...*..{F...*V.(<.....}E.....}F...*.0..A........u........4.,/(=....{E....{E...o>...,.(?....{F....{F...o@...*.*.*. F.b# )UU.

                                                                    C:\Users\user\AppData\Local\Temp\MSI31E4.tmp-\ScreenConnect.InstallerActions.dll

                                                                    Download File
                                                                    Process:C:\Windows\SysWOW64\rundll32.exe
                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                    Category:dropped
                                                                    Size (bytes):11776
                                                                    Entropy (8bit):5.273875899788767
                                                                    Encrypted:false
                                                                    SSDEEP:192:V8/Qp6lCJuV3jHXtyVNamVNG1YZfCrMmbfHJ7kjvLjbuLd9NEFbM64:y/cBJaLXt2NaheUrMmb/FkjvLjbuZj64
                                                                    MD5:73A24164D8408254B77F3A2C57A22AB4
                                                                    SHA1:EA0215721F66A93D67019D11C4E588A547CC2AD6
                                                                    SHA-256:D727A640723D192AA3ECE213A173381682041CB28D8BD71781524DBAE3DDBF62
                                                                    SHA-512:650D4320D9246AAECD596AC8B540BF7612EC7A8F60ECAA6E9C27B547B751386222AB926D0C915698D0BB20556475DA507895981C072852804F0B42FDDA02B844
                                                                    Malicious:false
                                                                    Antivirus:
                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..&...........E... ...`....... ..............................D9....@..................................D..O....`..............................$D..8............................................ ............... ..H............text...4%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc...............,..............@..B.................E......H........'.......................C........................................(....*^.(.......&...%...}....*:.(......}....*:.(......}....*:.(......}....*....0..........s.......}.....s....}.....{....r...p(......,h.{....r...p......%...(.....rS..p.(....~....%-.&~..........s....%......(...+%-.&+.(...........s....(...+&.{....o....-!.{.....{.....{....rc..po....(.....{....o.........{.....{.....{....r}..po....(.....{....o....-..{....r...p......(.....*.{....s .....-..o!.......{....r}..p.o

                                                                    C:\Users\user\AppData\Local\Temp\MSI31E4.tmp-\ScreenConnect.Windows.dll

                                                                    Download File
                                                                    Process:C:\Windows\SysWOW64\rundll32.exe
                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                    Category:dropped
                                                                    Size (bytes):1721856
                                                                    Entropy (8bit):6.639085961200334
                                                                    Encrypted:false
                                                                    SSDEEP:24576:dx5xeYkYFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:dx5xTkYJkGYYpT0+TFiH7efP
                                                                    MD5:9AD3964BA3AD24C42C567E47F88C82B2
                                                                    SHA1:6B4B581FC4E3ECB91B24EC601DAA0594106BCC5D
                                                                    SHA-256:84A09ED81AFC5FF9A17F81763C044C82A2D9E26F852DE528112153EE9AB041D0
                                                                    SHA-512:CE557A89C0FE6DE59046116C1E262A36BBC3D561A91E44DCDA022BEF72CB75742C8B01BEDCC5B9B999E07D8DE1F94C665DD85D277E981B27B6BFEBEAF9E58097
                                                                    Malicious:false
                                                                    Antivirus:
                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...y............." ..0..>..........~]... ...`....... ..............................8.....@.................................+]..O....`..|............................\..8............................................ ............... ..H............text....=... ...>.................. ..`.rsrc...|....`.......@..............@..@.reloc...............D..............@..B................_]......H.......t...d..............0....\........................................()...*^.()..........%...}....*:.().....}....*:.().....}....*:.().....}....*..s*...*..s+...*:.(,.....(-...*..{....*"..}....*J.(/........(0...&*:.(,.....(1...*..{2...*"..}2...*.0..(........(3......+.............(0...&..X....i2.*v.(,....s4...}.....s5...}....*v.{.....r...p(...+.....o7....*.0...........o8....+..o9......(...+&.o....-....,..o......*..........."........{..........o:...&.......(.....*....0..L...

                                                                    C:\Windows\Installer\5435dc.msi

                                                                    Download File
                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                    File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Default, Author: ScreenConnect Software, Keywords: Default, Comments: Default, Template: Intel;1033, Revision Number: {FC4B6052-A51F-D41F-8C25-3D41FD6C6B5C}, Create Time/Date: Mon Oct 28 17:43:52 2024, Last Saved Time/Date: Mon Oct 28 17:43:52 2024, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.0.1701), Security: 2
                                                                    Category:dropped
                                                                    Size (bytes):9920512
                                                                    Entropy (8bit):7.960609527199316
                                                                    Encrypted:false
                                                                    SSDEEP:98304:IwJ4t1h0cG5FGJRPxow8OBwJ4t1h0cG5HwJ4t1h0cG5VwJ4t1h0cG52wJ4t1h0cW:RWh0cGwoWh0cGeWh0cG0Wh0cG9Wh0cG
                                                                    MD5:C3541CF72E6FD5B278F8CC899DAE304A
                                                                    SHA1:FE9864FA355777EFBE3F94A83ABF51FA9272B6C6
                                                                    SHA-256:49E22D098F3713FE44F1D75757904E13E758424288B81F7BB517D356F48CF88F
                                                                    SHA-512:3D617A7AD2C0B45EDB76BD014CEC628B743146C8686754D90779D1675BBA4C5800FED37890F584E41CD76FB2C8E7176BBB88E52B9869C65963585944915D8B62
                                                                    Malicious:false
                                                                    Preview:......................>.......................................................|...s...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                    C:\Windows\Installer\5435de.msi

                                                                    Download File
                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                    File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Default, Author: ScreenConnect Software, Keywords: Default, Comments: Default, Template: Intel;1033, Revision Number: {FC4B6052-A51F-D41F-8C25-3D41FD6C6B5C}, Create Time/Date: Mon Oct 28 17:43:52 2024, Last Saved Time/Date: Mon Oct 28 17:43:52 2024, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.0.1701), Security: 2
                                                                    Category:dropped
                                                                    Size (bytes):9920512
                                                                    Entropy (8bit):7.960609527199316
                                                                    Encrypted:false
                                                                    SSDEEP:98304:IwJ4t1h0cG5FGJRPxow8OBwJ4t1h0cG5HwJ4t1h0cG5VwJ4t1h0cG52wJ4t1h0cW:RWh0cGwoWh0cGeWh0cG0Wh0cG9Wh0cG
                                                                    MD5:C3541CF72E6FD5B278F8CC899DAE304A
                                                                    SHA1:FE9864FA355777EFBE3F94A83ABF51FA9272B6C6
                                                                    SHA-256:49E22D098F3713FE44F1D75757904E13E758424288B81F7BB517D356F48CF88F
                                                                    SHA-512:3D617A7AD2C0B45EDB76BD014CEC628B743146C8686754D90779D1675BBA4C5800FED37890F584E41CD76FB2C8E7176BBB88E52B9869C65963585944915D8B62
                                                                    Malicious:false
                                                                    Preview:......................>.......................................................|...s...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                    C:\Windows\Installer\MSI3A9F.tmp

                                                                    Download File
                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                    File Type:data
                                                                    Category:dropped
                                                                    Size (bytes):423435
                                                                    Entropy (8bit):6.577388403500759
                                                                    Encrypted:false
                                                                    SSDEEP:6144:CuH2aCGw1ST1wQLdqv5uH2aCGw1ST1wQLdqvn:CuH2anwohwQUv5uH2anwohwQUvn
                                                                    MD5:B2AE2303F2F435201011FDE22F39FF7A
                                                                    SHA1:03BA02E1D892312A337358EC063A3E331C71FB05
                                                                    SHA-256:8BFB31734848369D718C71564793CA80DF787A77E30C96506C44BDE72B3EE481
                                                                    SHA-512:DD5AAEE43DBF70FF68EB97FB07635E514B17F37A650E5AE1BB8FE6289F7F63FA6CBA49C216C77D038F0A45AB7C5B4B39897F2A793A56B48FC3DD4F3EE8718C47
                                                                    Malicious:false
                                                                    Yara Hits:
                                                                    • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Windows\Installer\MSI3A9F.tmp, Author: Joe Security
                                                                    Preview:...@IXOS.@.....@.*yY.@.....@.....@.....@.....@.....@......&.{FC4B6052-A51F-D41F-8C25-3D41FD6C6B5C}'.ScreenConnect Client (909a0bac52a7095f)..MPJ_1281565D#U00ae.msi.@.....@.....@.....@......DefaultIcon..&.{FC4B6052-A51F-D41F-8C25-3D41FD6C6B5C}.....@.....@.....@.....@.......@.....@.....@.......@....'.ScreenConnect Client (909a0bac52a7095f)......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{47A26A37-A09C-9C2B-F052-17D016FF460A}^.C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.dll.@.......@.....@.....@......&.{FFA60116-BCE6-09BA-2F93-D6DD451B89E4}f.C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsBackstageShell.exe.@.......@.....@.....@......&.{4AE84DA6-0F60-EBBC-A87C-9F0E681E5F22}c.C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsFileManager.e

                                                                    C:\Windows\Installer\MSI3B8A.tmp

                                                                    Download File
                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                    Category:dropped
                                                                    Size (bytes):207360
                                                                    Entropy (8bit):6.573348437503042
                                                                    Encrypted:false
                                                                    SSDEEP:3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
                                                                    MD5:BA84DD4E0C1408828CCC1DE09F585EDA
                                                                    SHA1:E8E10065D479F8F591B9885EA8487BC673301298
                                                                    SHA-256:3CFF4AC91288A0FF0C13278E73B282A64E83D089C5A61A45D483194AB336B852
                                                                    SHA-512:7A38418F6EE8DBC66FAB2CD5AD8E033E761912EFC465DAA484858D451DA4B8576079FE90FD3B6640410EDC8B3CAC31C57719898134F246F4000D60A252D88290
                                                                    Malicious:false
                                                                    Antivirus:
                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                    Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........AF../.../.../.'D..../.'D..../.'D..../...,.../...+.../...*.../......./......./.....n./.*.*.../.*./.../.*...../....../.*.-.../.Rich../.........................PE..L...pG.Y...........!.........L......&.....................................................@.................................P........P..x....................`......P...T...............................@...............<............................text...+........................... ..`.rdata..*...........................@..@.data...."... ......................@....rsrc...x....P......................@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................................

                                                                    C:\Windows\Installer\MSI3D60.tmp

                                                                    Download File
                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                    Category:dropped
                                                                    Size (bytes):207360
                                                                    Entropy (8bit):6.573348437503042
                                                                    Encrypted:false
                                                                    SSDEEP:3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
                                                                    MD5:BA84DD4E0C1408828CCC1DE09F585EDA
                                                                    SHA1:E8E10065D479F8F591B9885EA8487BC673301298
                                                                    SHA-256:3CFF4AC91288A0FF0C13278E73B282A64E83D089C5A61A45D483194AB336B852
                                                                    SHA-512:7A38418F6EE8DBC66FAB2CD5AD8E033E761912EFC465DAA484858D451DA4B8576079FE90FD3B6640410EDC8B3CAC31C57719898134F246F4000D60A252D88290
                                                                    Malicious:false
                                                                    Antivirus:
                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                    Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........AF../.../.../.'D..../.'D..../.'D..../...,.../...+.../...*.../......./......./.....n./.*.*.../.*./.../.*...../....../.*.-.../.Rich../.........................PE..L...pG.Y...........!.........L......&.....................................................@.................................P........P..x....................`......P...T...............................@...............<............................text...+........................... ..`.rdata..*...........................@..@.data...."... ......................@....rsrc...x....P......................@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................................

                                                                    C:\Windows\Installer\SourceHash{FC4B6052-A51F-D41F-8C25-3D41FD6C6B5C}

                                                                    Download File
                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                    File Type:Composite Document File V2 Document, Cannot read section info
                                                                    Category:dropped
                                                                    Size (bytes):20480
                                                                    Entropy (8bit):1.1692140901205845
                                                                    Encrypted:false
                                                                    SSDEEP:12:JSbX72FjBAGiLIlHVRpRh/7777777777777777777777777vDHFT+XHPD+l0i8Q:JPQI5FMF
                                                                    MD5:A89BD40B7130D9E54C67387A46B20CE1
                                                                    SHA1:1A2D428267ED0243759F2BE8FF4455380EB99BCE
                                                                    SHA-256:448139380C74B8F3BE808C883C1A52876B662A680B5055A17D0A772290BD08F8
                                                                    SHA-512:8B10B7B27C41D7DD135F09C2421EFFFBCA54CC9CD5B7084539E9500DBC38633D93F2C1844F0D4E039EDE5F9F669C6F6B7D9C838636E37191EDD251FD77DC5B10
                                                                    Malicious:false
                                                                    Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                    C:\Windows\Installer\inprogressinstallinfo.ipi

                                                                    Download File
                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                    File Type:Composite Document File V2 Document, Cannot read section info
                                                                    Category:dropped
                                                                    Size (bytes):20480
                                                                    Entropy (8bit):1.7871912368912732
                                                                    Encrypted:false
                                                                    SSDEEP:48:/948PhsuRc06WXJmFT5AyOCqcq56AduNsSimh4PdBWdRvAr8LQOv/C2CttOnr2AS:FHhs19FTqyO3pysfBd69jy2CttbsiHP
                                                                    MD5:17D7FEAA2FE1D42CA444A430D21006D1
                                                                    SHA1:8B0F1FB46A44BEDC146FB6741214A7308E9F6E99
                                                                    SHA-256:D0E829F441BDDE5709031D4A0FA7A875E833D04DD2AD25C73DBD1C5700768C41
                                                                    SHA-512:3092BFF0AE6A56CC195D67BE7521EB0AA025CBCB29C74EFC136FE171C9A1DB95E483323F468D0F600B6D6DDACA12F3E6ED688DBD7CA309132C4A0F5E3ED47B0C
                                                                    Malicious:false
                                                                    Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                    C:\Windows\Installer\{FC4B6052-A51F-D41F-8C25-3D41FD6C6B5C}\DefaultIcon

                                                                    Download File
                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                    File Type:MS Windows icon resource - 3 icons, 16x16 with PNG image data, 16 x 16, 8-bit colormap, non-interlaced, 4 bits/pixel, 32x32 with PNG image data, 32 x 32, 1-bit colormap, non-interlaced, 4 bits/pixel
                                                                    Category:dropped
                                                                    Size (bytes):435
                                                                    Entropy (8bit):5.289734780210945
                                                                    Encrypted:false
                                                                    SSDEEP:12:Kvv/7tghWPjScQZ/Ev/739Jgh5TZYR/v/71XfghNeZ:QOZZq9JOz0dONeZ
                                                                    MD5:F34D51C3C14D1B4840AE9FF6B70B5D2F
                                                                    SHA1:C761D3EF26929F173CEB2F8E01C6748EE2249A8A
                                                                    SHA-256:0DD459D166F037BB8E531EB2ECEB2B79DE8DBBD7597B05A03C40B9E23E51357A
                                                                    SHA-512:D6EEB5345A5A049A87BFBFBBBEBFBD9FBAEC7014DA41DB1C706E8B16DDEC31561679AAE9E8A0847098807412BD1306B9616C8E6FCFED8683B4F33BD05ADE38D1
                                                                    Malicious:false
                                                                    Preview:..............z...6... ..............00..........0....PNG........IHDR.............(-.S....PLTE....22.u......tRNS.@..f..."IDATx.c` .0"...$.(......SC..Q8....9b.i.Xa.....IEND.B`..PNG........IHDR... ... .....I......PLTE....22.u......tRNS.@..f...(IDATx.c`...... ... D.......vb.....A`..(.-s...q....IEND.B`..PNG........IHDR...0...0.....m.k.....PLTE....22.u......tRNS.@..f...+IDATx.c` .......Q...S.@..DQu...4...(.}DQD...3x........IEND.B`.

                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

                                                                    Download File
                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                    File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):364484
                                                                    Entropy (8bit):5.365500031595004
                                                                    Encrypted:false
                                                                    SSDEEP:1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26KgauB:zTtbmkExhMJCIpEm
                                                                    MD5:5A1FEAF6E7561BB12EFFBC2ADE66564A
                                                                    SHA1:CA19C3A9CFC1FB066A2690F3F01270D9464EF51B
                                                                    SHA-256:1F8A0F5595C99C54D2CAF0AD798795FEA4CB65AC63661EF17CF1EEC73C626786
                                                                    SHA-512:1CF812FBF8C413F8570CCD9AD79553DF9A476FC430235BF30F4363C4AC83947457BA9FA4637D4717C1A7588AC4EEF3E816554245DAF5EE243ECCB525E7050A76
                                                                    Malicious:false
                                                                    Preview:.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

                                                                    C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (909a0bac52a7095f)\33z52vm4.newcfg

                                                                    Download File
                                                                    Process:C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exe
                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):583
                                                                    Entropy (8bit):5.030189805200607
                                                                    Encrypted:false
                                                                    SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONlxci8Q4hv/vXbAa3xT:2dL9hK6E46YPRxDC3vH
                                                                    MD5:24BCF43FA74478844C2C5F4CA25E4E25
                                                                    SHA1:0C578A874A4AE5A13D99E1E19B275113369639A1
                                                                    SHA-256:F5AA8B82BC45EEB542A9D87C1684E5F8D99318627BED306BF71443A0E615271A
                                                                    SHA-512:148250AFAC00B1CA390FFA08923643AE6E903989EC380B8DD651EF42A4EE4287B3044D92FD9303558587ABDE7317C74D28C395B2C30EAA6DD77B142E148BAAB7
                                                                    Malicious:false
                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-c89u33-relay.screenconnect.com=147.75.63.88-25%2f11%2f2024%2010%3a21%3a05</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                    C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (909a0bac52a7095f)\alszbl3u.newcfg

                                                                    Download File
                                                                    Process:C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exe
                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):583
                                                                    Entropy (8bit):5.028922438011653
                                                                    Encrypted:false
                                                                    SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONlxci8Q42/vXbAa3xT:2dL9hK6E46YPRxD1vH
                                                                    MD5:E51D75D0910939AD83825F45ED8063CA
                                                                    SHA1:E7784C1ACB299FCACE15695AC535F10663DCC0A5
                                                                    SHA-256:0ACD386D73873436BFC982C8588573EB0A5FF355AAE20EE8AD35D54F094386E9
                                                                    SHA-512:A88BAFCC2113B9DB5EBAB498A81858B73F4FB83143C263CB69BE8DDC97679E7CB1E431D099DFFE0353343FE897724F2C899527B18DD0D82820AF9F014352A1FD
                                                                    Malicious:false
                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-c89u33-relay.screenconnect.com=147.75.63.88-25%2f11%2f2024%2010%3a21%3a11</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                    C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (909a0bac52a7095f)\flmhfwwk.newcfg

                                                                    Download File
                                                                    Process:C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exe
                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                    Category:modified
                                                                    Size (bytes):583
                                                                    Entropy (8bit):5.030189805200607
                                                                    Encrypted:false
                                                                    SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONlxci8Q4Vw/vXbAa3xT:2dL9hK6E46YPRxDZvH
                                                                    MD5:257091FAAC26E30BC462E5B1AE49BD1C
                                                                    SHA1:B9E471A5FD7545D7AEDCD377B667A12F1A98DEA0
                                                                    SHA-256:9BF22B789CAA2F6133CB325FBC08C7A9DFED2D60C32D4E04C14CB4F5E9916A0D
                                                                    SHA-512:24A42909247A376D72FA1CB3B941D0570840855B88E58DC388796E0C575D67427D7759619D4A22C83793ABE149A37DD36BC5484860B3C0A887C334109A87DCDB
                                                                    Malicious:false
                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-c89u33-relay.screenconnect.com=147.75.63.88-25%2f11%2f2024%2010%3a24%3a01</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                    C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (909a0bac52a7095f)\fp5c33kt.newcfg

                                                                    Download File
                                                                    Process:C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exe
                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):583
                                                                    Entropy (8bit):5.030001666970642
                                                                    Encrypted:false
                                                                    SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONlxci8Q4pk/vXbAa3xT:2dL9hK6E46YPRxDdvH
                                                                    MD5:333779FD319907D6C83B1B09BFF89008
                                                                    SHA1:B703EA63CB330E31038FA3F5F638C2123095A91E
                                                                    SHA-256:274E965B86ACD595FA9C228089BAC6F24C4A8F5917CF1974FE319CCFBADA4BF6
                                                                    SHA-512:D70EF31DF6A66FB89C896386A713EDD4060C9334C1C9A912552F507C059F10EC98335D071EC3C631F1E01CCE95F44C1DE4DC4361857C44A6945E9886727DB2E7
                                                                    Malicious:false
                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-c89u33-relay.screenconnect.com=147.75.63.88-25%2f11%2f2024%2010%3a22%3a18</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                    C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (909a0bac52a7095f)\kajzydm0.newcfg

                                                                    Download File
                                                                    Process:C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exe
                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):583
                                                                    Entropy (8bit):5.030914306723026
                                                                    Encrypted:false
                                                                    SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONlxci8Q4tk/vXbAa3xT:2dL9hK6E46YPRxDkqvH
                                                                    MD5:E665E1E0B063E72CFF87E74E6AD21994
                                                                    SHA1:9915F82B782A56C1F972FFFE0BF589D29EF6C72D
                                                                    SHA-256:AE8913289DB6E86A6A4E2EB74B9DB2C9FB8C127E943C6F9B7E3DDF6F0C93DE18
                                                                    SHA-512:CFD8CC24CFA890AF97966E1FA36661AD5EDE4C5878A028F6E3559FA61BC62E18B584512CB1090CD04B4A03B26EEED7DB7F3E5D67D40103F1D6B0FCF2A8F09563
                                                                    Malicious:false
                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-c89u33-relay.screenconnect.com=147.75.63.88-25%2f11%2f2024%2010%3a22%3a58</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                    C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (909a0bac52a7095f)\nmnun0hu.newcfg

                                                                    Download File
                                                                    Process:C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exe
                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):583
                                                                    Entropy (8bit):5.031767308697251
                                                                    Encrypted:false
                                                                    SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONlxci8Q4sev/vXbAa3xT:2dL9hK6E46YPRxDO3vH
                                                                    MD5:8E70EE531BE7E26342A6801CBDD368BE
                                                                    SHA1:76DF23E3B07A472552BF5B1487B87676C4F41F90
                                                                    SHA-256:10464432E6DD4D7DF10C5B2D29F3EF9AB0488489A7E18CCA93E681DC9BFA6F1D
                                                                    SHA-512:8CE898265272C37F10C6394B43923DBB06C9D87585F6D5518C0E335022BBFE1358F80A7EB84AD2ACA9216796E1E829DC68073965D5E11EFAB656047FD1007EAD
                                                                    Malicious:false
                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-c89u33-relay.screenconnect.com=147.75.63.88-25%2f11%2f2024%2010%3a21%3a45</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                    C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (909a0bac52a7095f)\qo0hcons.newcfg

                                                                    Download File
                                                                    Process:C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exe
                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):583
                                                                    Entropy (8bit):5.029691530662951
                                                                    Encrypted:false
                                                                    SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONlxci8Q4Zm/vXbAa3xT:2dL9hK6E46YPRxDLvH
                                                                    MD5:8257E4AB22B5F38F46479BF6B5DDEAB4
                                                                    SHA1:C3C2B9C6BAB865CA73FEE5142579CA69A460DA87
                                                                    SHA-256:C6ECD3C2EB6ADCA36FE34A7A3B9E058BB05DEC7DE9405DF4DA3EB2AAFADB6AD9
                                                                    SHA-512:5B79B325CC6A1119B17405B0768220DD6BBEC748831A8930CBD3322DCD23DAF03DD71BD7CBA2BFCA567B25A724EFC5A62072AB25A08695F66E50EEC6AC2848CA
                                                                    Malicious:false
                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-c89u33-relay.screenconnect.com=147.75.63.88-25%2f11%2f2024%2010%3a21%3a08</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                    C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (909a0bac52a7095f)\r2kg0cka.newcfg

                                                                    Download File
                                                                    Process:C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exe
                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):583
                                                                    Entropy (8bit):5.032392571092792
                                                                    Encrypted:false
                                                                    SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONlxci8Q4h/vXbAa3xT:2dL9hK6E46YPRxDwvH
                                                                    MD5:57F4A5B0FA0C7D13D193E18F755211EB
                                                                    SHA1:EE589323B17A1432303048F00A774B60B30A481A
                                                                    SHA-256:943922C6F8CB7BFDFFA22C574723AE5E3EE3F10822740C64872F86A92E7134DE
                                                                    SHA-512:D1213DD92F8CEA80DDE16DCDEE965AA9A68A5D53852D14F82635120E8728ABFA7E812482654E536F136026D35001B226CDCDEE6E50A6B5542E406CA56656473B
                                                                    Malicious:false
                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-c89u33-relay.screenconnect.com=147.75.63.88-25%2f11%2f2024%2010%3a21%3a49</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                    C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (909a0bac52a7095f)\srp51sxk.newcfg

                                                                    Download File
                                                                    Process:C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exe
                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):583
                                                                    Entropy (8bit):5.031269034159596
                                                                    Encrypted:false
                                                                    SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONlxci8Q4ev/vXbAa3xT:2dL9hK6E46YPRxD93vH
                                                                    MD5:6148D19F9B13B710FAB58B6F9D96DF07
                                                                    SHA1:5BA8461769E20CE06490FB80F0FB5C292AC54B88
                                                                    SHA-256:6FC8DD14675577D1A10EBBD89D6A89D0DF97173010A75BDF3FB77EBD9F05ADF2
                                                                    SHA-512:DD24C602BD6B64F83A018F326F77F09743F879C438A24E486E4A33FA9E17B1F8DE402D0C9CA79A4D9FA984EDEA530A096BCE845A844068D2BCE814ECB0F4C0D2
                                                                    Malicious:false
                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-c89u33-relay.screenconnect.com=147.75.63.88-25%2f11%2f2024%2010%3a21%3a55</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                    C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (909a0bac52a7095f)\user.config (copy)

                                                                    Download File
                                                                    Process:C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exe
                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):583
                                                                    Entropy (8bit):5.030189805200607
                                                                    Encrypted:false
                                                                    SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONlxci8Q4hv/vXbAa3xT:2dL9hK6E46YPRxDC3vH
                                                                    MD5:24BCF43FA74478844C2C5F4CA25E4E25
                                                                    SHA1:0C578A874A4AE5A13D99E1E19B275113369639A1
                                                                    SHA-256:F5AA8B82BC45EEB542A9D87C1684E5F8D99318627BED306BF71443A0E615271A
                                                                    SHA-512:148250AFAC00B1CA390FFA08923643AE6E903989EC380B8DD651EF42A4EE4287B3044D92FD9303558587ABDE7317C74D28C395B2C30EAA6DD77B142E148BAAB7
                                                                    Malicious:false
                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-c89u33-relay.screenconnect.com=147.75.63.88-25%2f11%2f2024%2010%3a21%3a05</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                    C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (909a0bac52a7095f)\vxgokhmo.newcfg

                                                                    Download File
                                                                    Process:C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exe
                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):583
                                                                    Entropy (8bit):5.030499941508298
                                                                    Encrypted:false
                                                                    SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONlxci8Q4MQv/vXbAa3xT:2dL9hK6E46YPRxD1Q3vH
                                                                    MD5:3F872277E8362CA48C33172E6C4E55CE
                                                                    SHA1:5D4EE4E1E2DC47C7E1F8578EDFE2B2E6BBA4BB11
                                                                    SHA-256:CB7772B7DC5385A3DDDD937B1333BE966EC823A658B4C374192965E0B543470A
                                                                    SHA-512:CA4670D80636AB0936E78CDBF48AA2F879C69F15A06CD60D077BCF5B1D5E394EA8CED240337B4FBA33F62C5010AC3421B8C2D9845666F1B72656E411BA4ED964
                                                                    Malicious:false
                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-c89u33-relay.screenconnect.com=147.75.63.88-25%2f11%2f2024%2010%3a22%3a35</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                    C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (909a0bac52a7095f)\yv4abzkt.newcfg

                                                                    Download File
                                                                    Process:C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exe
                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):583
                                                                    Entropy (8bit):5.031301206361418
                                                                    Encrypted:false
                                                                    SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONlxci8Q4b/vXbAa3xT:2dL9hK6E46YPRxDivH
                                                                    MD5:05DB0F4E67A7A8ECF6CB56B034CD4320
                                                                    SHA1:FBD24B8BD121082D7382D98EB7E887D213F1FEC5
                                                                    SHA-256:D339E858D1CA719C64A4D4ADF91394C00C52AC85EA4D06208F07A82C77EEC0E6
                                                                    SHA-512:C3909DB78330428C1603B4CEA5905EB7AD3DC37B75A56C9FC536DD7639C12255DD55C6803A96359D5158C37DEF7BBB62A96BA001A6D4E73BF23BA7916855835E
                                                                    Malicious:false
                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-c89u33-relay.screenconnect.com=147.75.63.88-25%2f11%2f2024%2010%3a22%3a06</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                    C:\Windows\Temp\~DF1287FB349E316B08.TMP

                                                                    Download File
                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                    File Type:data
                                                                    Category:dropped
                                                                    Size (bytes):512
                                                                    Entropy (8bit):0.0
                                                                    Encrypted:false
                                                                    SSDEEP:3::
                                                                    MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                    SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                    SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                    SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                    Malicious:false
                                                                    Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                    C:\Windows\Temp\~DF9003C778866CA410.TMP

                                                                    Download File
                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                    File Type:data
                                                                    Category:dropped
                                                                    Size (bytes):32768
                                                                    Entropy (8bit):0.07578188694559738
                                                                    Encrypted:false
                                                                    SSDEEP:6:2/9LG7iVCnLG7iVrKOzPLHKOTNdwquXV1vPqEAVky6l+:2F0i8n0itFzDHFT+XHPD+
                                                                    MD5:1DB89D881BDF859E80F447640F312F92
                                                                    SHA1:0C8C545F54AFC119ABBC535960A94F1DDF8BE8A1
                                                                    SHA-256:55EF7209DE5653AEA8787FFB921DE3148A3E785BDECE61F8587FD4A9B82166DF
                                                                    SHA-512:95E36CDEC4CD903D1549DFC05F616EED84BDE364D2D9EEC1E1A8EA3876EE66FB287E1B261BD2FDD7C1215D167EB2515D1383B5C246B02BAA184C25CAA123259E
                                                                    Malicious:false
                                                                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                    C:\Windows\Temp\~DF9C897626114DCDCC.TMP

                                                                    Download File
                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                    File Type:data
                                                                    Category:dropped
                                                                    Size (bytes):512
                                                                    Entropy (8bit):0.0
                                                                    Encrypted:false
                                                                    SSDEEP:3::
                                                                    MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                    SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                    SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                    SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                    Malicious:false
                                                                    Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                    C:\Windows\Temp\~DF9F07C4AE9479BC02.TMP

                                                                    Download File
                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                    File Type:Composite Document File V2 Document, Cannot read section info
                                                                    Category:dropped
                                                                    Size (bytes):32768
                                                                    Entropy (8bit):1.4106725402095102
                                                                    Encrypted:false
                                                                    SSDEEP:48:vPEuqPveFXJnT50UyyOCqcq56AduNsSimh4PdBWdRvAr8LQOv/C2CttOnr2AduN9:nESPTOVyO3pysfBd69jy2CttbsiHP
                                                                    MD5:8AE1BC40DFF987A51F14849582898294
                                                                    SHA1:1E7B6053E99A977737AA3B77BA0181D4F87BBF1C
                                                                    SHA-256:24AE49352DD6FFA5F8391529E705A2F566F32E2BC0FA51737DEF11F7102DE4F7
                                                                    SHA-512:616C59BC16E22163D0A606910D8158EA73485DEDA65DBB9B5CD43BFF0EC9DE00218DD607CBA366B732B3D5EB89B5F3ED6E180AB1B2D1C8DA03CAD107D43746A9
                                                                    Malicious:false
                                                                    Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                    C:\Windows\Temp\~DFA088DC1B033C0F10.TMP

                                                                    Download File
                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                    File Type:data
                                                                    Category:dropped
                                                                    Size (bytes):512
                                                                    Entropy (8bit):0.0
                                                                    Encrypted:false
                                                                    SSDEEP:3::
                                                                    MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                    SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                    SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                    SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                    Malicious:false
                                                                    Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                    C:\Windows\Temp\~DFA7D4F494FD1B300A.TMP

                                                                    Download File
                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                    File Type:data
                                                                    Category:dropped
                                                                    Size (bytes):69632
                                                                    Entropy (8bit):0.2289388916311724
                                                                    Encrypted:false
                                                                    SSDEEP:48:P5aHEDBAduNsS3qcq56AduNsSimh4PdBWdRvAr8LQOv/C2CttOnrBly:P0H4sxpysfBd69jy2Cttyly
                                                                    MD5:2B662EC54667F3A9429CCB6580163E3E
                                                                    SHA1:E2BB7026C636F5B10317A1F472C4CD471085917A
                                                                    SHA-256:531D28237CB6069DA8F1898C05644A84D83CFD3CFE66C82EADBE835ECEC86F15
                                                                    SHA-512:35D921BCB77FBFF492F8BA4DC51779742CE3920852E70A2CBBC1CFFD3F239E8D5D756FE8FFBA06389FA065F677A1DAEBB71D6D80BCD13DB9EB6628451877C5DB
                                                                    Malicious:false
                                                                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                    C:\Windows\Temp\~DFAD7539D935F1AA5B.TMP

                                                                    Download File
                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                    File Type:Composite Document File V2 Document, Cannot read section info
                                                                    Category:dropped
                                                                    Size (bytes):32768
                                                                    Entropy (8bit):1.4106725402095102
                                                                    Encrypted:false
                                                                    SSDEEP:48:vPEuqPveFXJnT50UyyOCqcq56AduNsSimh4PdBWdRvAr8LQOv/C2CttOnr2AduN9:nESPTOVyO3pysfBd69jy2CttbsiHP
                                                                    MD5:8AE1BC40DFF987A51F14849582898294
                                                                    SHA1:1E7B6053E99A977737AA3B77BA0181D4F87BBF1C
                                                                    SHA-256:24AE49352DD6FFA5F8391529E705A2F566F32E2BC0FA51737DEF11F7102DE4F7
                                                                    SHA-512:616C59BC16E22163D0A606910D8158EA73485DEDA65DBB9B5CD43BFF0EC9DE00218DD607CBA366B732B3D5EB89B5F3ED6E180AB1B2D1C8DA03CAD107D43746A9
                                                                    Malicious:false
                                                                    Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                    C:\Windows\Temp\~DFC583695CB9981331.TMP

                                                                    Download File
                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                    File Type:data
                                                                    Category:dropped
                                                                    Size (bytes):512
                                                                    Entropy (8bit):0.0
                                                                    Encrypted:false
                                                                    SSDEEP:3::
                                                                    MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                    SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                    SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                    SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                    Malicious:false
                                                                    Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                    C:\Windows\Temp\~DFDC22F29E2BF7A44A.TMP

                                                                    Download File
                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                    File Type:data
                                                                    Category:dropped
                                                                    Size (bytes):512
                                                                    Entropy (8bit):0.0
                                                                    Encrypted:false
                                                                    SSDEEP:3::
                                                                    MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                    SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                    SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                    SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                    Malicious:false
                                                                    Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                    C:\Windows\Temp\~DFE0944E9792142A27.TMP

                                                                    Download File
                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                    File Type:Composite Document File V2 Document, Cannot read section info
                                                                    Category:dropped
                                                                    Size (bytes):20480
                                                                    Entropy (8bit):1.7871912368912732
                                                                    Encrypted:false
                                                                    SSDEEP:48:/948PhsuRc06WXJmFT5AyOCqcq56AduNsSimh4PdBWdRvAr8LQOv/C2CttOnr2AS:FHhs19FTqyO3pysfBd69jy2CttbsiHP
                                                                    MD5:17D7FEAA2FE1D42CA444A430D21006D1
                                                                    SHA1:8B0F1FB46A44BEDC146FB6741214A7308E9F6E99
                                                                    SHA-256:D0E829F441BDDE5709031D4A0FA7A875E833D04DD2AD25C73DBD1C5700768C41
                                                                    SHA-512:3092BFF0AE6A56CC195D67BE7521EB0AA025CBCB29C74EFC136FE171C9A1DB95E483323F468D0F600B6D6DDACA12F3E6ED688DBD7CA309132C4A0F5E3ED47B0C
                                                                    Malicious:false
                                                                    Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                    C:\Windows\Temp\~DFE791BE45F270EA48.TMP

                                                                    Download File
                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                    File Type:Composite Document File V2 Document, Cannot read section info
                                                                    Category:dropped
                                                                    Size (bytes):20480
                                                                    Entropy (8bit):1.7871912368912732
                                                                    Encrypted:false
                                                                    SSDEEP:48:/948PhsuRc06WXJmFT5AyOCqcq56AduNsSimh4PdBWdRvAr8LQOv/C2CttOnr2AS:FHhs19FTqyO3pysfBd69jy2CttbsiHP
                                                                    MD5:17D7FEAA2FE1D42CA444A430D21006D1
                                                                    SHA1:8B0F1FB46A44BEDC146FB6741214A7308E9F6E99
                                                                    SHA-256:D0E829F441BDDE5709031D4A0FA7A875E833D04DD2AD25C73DBD1C5700768C41
                                                                    SHA-512:3092BFF0AE6A56CC195D67BE7521EB0AA025CBCB29C74EFC136FE171C9A1DB95E483323F468D0F600B6D6DDACA12F3E6ED688DBD7CA309132C4A0F5E3ED47B0C
                                                                    Malicious:false
                                                                    Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                    C:\Windows\Temp\~DFF02838E50EB1AD23.TMP

                                                                    Download File
                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                    File Type:Composite Document File V2 Document, Cannot read section info
                                                                    Category:dropped
                                                                    Size (bytes):32768
                                                                    Entropy (8bit):1.4106725402095102
                                                                    Encrypted:false
                                                                    SSDEEP:48:vPEuqPveFXJnT50UyyOCqcq56AduNsSimh4PdBWdRvAr8LQOv/C2CttOnr2AduN9:nESPTOVyO3pysfBd69jy2CttbsiHP
                                                                    MD5:8AE1BC40DFF987A51F14849582898294
                                                                    SHA1:1E7B6053E99A977737AA3B77BA0181D4F87BBF1C
                                                                    SHA-256:24AE49352DD6FFA5F8391529E705A2F566F32E2BC0FA51737DEF11F7102DE4F7
                                                                    SHA-512:616C59BC16E22163D0A606910D8158EA73485DEDA65DBB9B5CD43BFF0EC9DE00218DD607CBA366B732B3D5EB89B5F3ED6E180AB1B2D1C8DA03CAD107D43746A9
                                                                    Malicious:false
                                                                    Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                    Static File Info

                                                                    General

                                                                    File type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Default, Author: ScreenConnect Software, Keywords: Default, Comments: Default, Template: Intel;1033, Revision Number: {FC4B6052-A51F-D41F-8C25-3D41FD6C6B5C}, Create Time/Date: Mon Oct 28 17:43:52 2024, Last Saved Time/Date: Mon Oct 28 17:43:52 2024, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.0.1701), Security: 2
                                                                    Entropy (8bit):7.960609527199316
                                                                    TrID:
                                                                    • Microsoft Windows Installer (60509/1) 57.88%
                                                                    • ClickyMouse macro set (36024/1) 34.46%
                                                                    • Generic OLE2 / Multistream Compound File (8008/1) 7.66%
                                                                    File name:MPJ_1281565D#U00ae.msi
                                                                    File size:9'920'512 bytes
                                                                    MD5:c3541cf72e6fd5b278f8cc899dae304a
                                                                    SHA1:fe9864fa355777efbe3f94a83abf51fa9272b6c6
                                                                    SHA256:49e22d098f3713fe44f1d75757904e13e758424288b81f7bb517d356f48cf88f
                                                                    SHA512:3d617a7ad2c0b45edb76bd014cec628b743146c8686754d90779d1675bba4c5800fed37890f584e41cd76fb2c8e7176bbb88e52b9869c65963585944915d8b62
                                                                    SSDEEP:98304:IwJ4t1h0cG5FGJRPxow8OBwJ4t1h0cG5HwJ4t1h0cG5VwJ4t1h0cG52wJ4t1h0cW:RWh0cGwoWh0cGeWh0cG0Wh0cG9Wh0cG
                                                                    TLSH:AFA6232523FD801AE8F75A7DED3682F45971BE64CE22C11E9328B90D2A74D4096737B3
                                                                    File Content Preview:........................>.......................................................|...s..........................................................................................................................................................................

                                                                    File Icon

                                                                    Icon Hash:2d2e3797b32b2b99

                                                                    Network Behavior

                                                                    Network Port Distribution

                                                                    TCP Packets

                                                                    TimestampSource PortDest PortSource IPDest IP
                                                                    Nov 25, 2024 11:21:06.407020092 CET49704443192.168.2.5147.75.63.88
                                                                    Nov 25, 2024 11:21:06.407068014 CET44349704147.75.63.88192.168.2.5
                                                                    Nov 25, 2024 11:21:06.407149076 CET49704443192.168.2.5147.75.63.88
                                                                    Nov 25, 2024 11:21:07.711982965 CET49704443192.168.2.5147.75.63.88
                                                                    Nov 25, 2024 11:21:07.712054968 CET44349704147.75.63.88192.168.2.5
                                                                    Nov 25, 2024 11:21:07.712146044 CET44349704147.75.63.88192.168.2.5
                                                                    Nov 25, 2024 11:21:09.819720030 CET49705443192.168.2.5147.75.63.88
                                                                    Nov 25, 2024 11:21:09.819758892 CET44349705147.75.63.88192.168.2.5
                                                                    Nov 25, 2024 11:21:09.821471930 CET49705443192.168.2.5147.75.63.88
                                                                    Nov 25, 2024 11:21:09.823245049 CET49705443192.168.2.5147.75.63.88
                                                                    Nov 25, 2024 11:21:09.823262930 CET44349705147.75.63.88192.168.2.5
                                                                    Nov 25, 2024 11:21:09.823318958 CET44349705147.75.63.88192.168.2.5
                                                                    Nov 25, 2024 11:21:12.738759995 CET49706443192.168.2.5147.75.63.88
                                                                    Nov 25, 2024 11:21:12.738795996 CET44349706147.75.63.88192.168.2.5
                                                                    Nov 25, 2024 11:21:12.738922119 CET49706443192.168.2.5147.75.63.88
                                                                    Nov 25, 2024 11:21:12.741285086 CET49706443192.168.2.5147.75.63.88
                                                                    Nov 25, 2024 11:21:12.741302967 CET44349706147.75.63.88192.168.2.5
                                                                    Nov 25, 2024 11:21:12.741354942 CET44349706147.75.63.88192.168.2.5
                                                                    Nov 25, 2024 11:21:16.423388004 CET49707443192.168.2.5147.75.63.88
                                                                    Nov 25, 2024 11:21:16.423449993 CET44349707147.75.63.88192.168.2.5
                                                                    Nov 25, 2024 11:21:16.423532009 CET49707443192.168.2.5147.75.63.88
                                                                    Nov 25, 2024 11:21:16.426829100 CET49707443192.168.2.5147.75.63.88
                                                                    Nov 25, 2024 11:21:16.426856995 CET44349707147.75.63.88192.168.2.5
                                                                    Nov 25, 2024 11:21:16.426904917 CET44349707147.75.63.88192.168.2.5
                                                                    Nov 25, 2024 11:21:20.897454023 CET49712443192.168.2.5147.75.63.88
                                                                    Nov 25, 2024 11:21:20.897526026 CET44349712147.75.63.88192.168.2.5
                                                                    Nov 25, 2024 11:21:20.897615910 CET49712443192.168.2.5147.75.63.88
                                                                    Nov 25, 2024 11:21:20.903199911 CET49712443192.168.2.5147.75.63.88
                                                                    Nov 25, 2024 11:21:20.903232098 CET44349712147.75.63.88192.168.2.5
                                                                    Nov 25, 2024 11:21:20.903294086 CET44349712147.75.63.88192.168.2.5
                                                                    Nov 25, 2024 11:21:26.960737944 CET49726443192.168.2.5147.75.63.88
                                                                    Nov 25, 2024 11:21:26.960803032 CET44349726147.75.63.88192.168.2.5
                                                                    Nov 25, 2024 11:21:26.960874081 CET49726443192.168.2.5147.75.63.88
                                                                    Nov 25, 2024 11:21:26.963155985 CET49726443192.168.2.5147.75.63.88
                                                                    Nov 25, 2024 11:21:26.963182926 CET44349726147.75.63.88192.168.2.5
                                                                    Nov 25, 2024 11:21:26.963251114 CET44349726147.75.63.88192.168.2.5
                                                                    Nov 25, 2024 11:21:37.419131994 CET49752443192.168.2.5147.75.63.88
                                                                    Nov 25, 2024 11:21:37.419251919 CET44349752147.75.63.88192.168.2.5
                                                                    Nov 25, 2024 11:21:37.419352055 CET49752443192.168.2.5147.75.63.88
                                                                    Nov 25, 2024 11:21:37.421957970 CET49752443192.168.2.5147.75.63.88
                                                                    Nov 25, 2024 11:21:37.421994925 CET44349752147.75.63.88192.168.2.5
                                                                    Nov 25, 2024 11:21:37.422048092 CET44349752147.75.63.88192.168.2.5
                                                                    Nov 25, 2024 11:21:49.350208044 CET49778443192.168.2.5147.75.63.88
                                                                    Nov 25, 2024 11:21:49.350246906 CET44349778147.75.63.88192.168.2.5
                                                                    Nov 25, 2024 11:21:49.350330114 CET49778443192.168.2.5147.75.63.88
                                                                    Nov 25, 2024 11:21:49.353136063 CET49778443192.168.2.5147.75.63.88
                                                                    Nov 25, 2024 11:21:49.353148937 CET44349778147.75.63.88192.168.2.5
                                                                    Nov 25, 2024 11:21:49.353195906 CET44349778147.75.63.88192.168.2.5
                                                                    Nov 25, 2024 11:22:06.222387075 CET49820443192.168.2.5147.75.63.88
                                                                    Nov 25, 2024 11:22:06.222431898 CET44349820147.75.63.88192.168.2.5
                                                                    Nov 25, 2024 11:22:06.222498894 CET49820443192.168.2.5147.75.63.88
                                                                    Nov 25, 2024 11:22:06.224884033 CET49820443192.168.2.5147.75.63.88
                                                                    Nov 25, 2024 11:22:06.224901915 CET44349820147.75.63.88192.168.2.5
                                                                    Nov 25, 2024 11:22:06.225033998 CET44349820147.75.63.88192.168.2.5
                                                                    Nov 25, 2024 11:22:29.904342890 CET49872443192.168.2.5147.75.63.88
                                                                    Nov 25, 2024 11:22:29.904381990 CET44349872147.75.63.88192.168.2.5
                                                                    Nov 25, 2024 11:22:29.904475927 CET49872443192.168.2.5147.75.63.88
                                                                    Nov 25, 2024 11:22:29.907002926 CET49872443192.168.2.5147.75.63.88
                                                                    Nov 25, 2024 11:22:29.907030106 CET44349872147.75.63.88192.168.2.5
                                                                    Nov 25, 2024 11:22:29.907079935 CET44349872147.75.63.88192.168.2.5
                                                                    Nov 25, 2024 11:23:02.791063070 CET49947443192.168.2.5147.75.63.88
                                                                    Nov 25, 2024 11:23:02.791089058 CET44349947147.75.63.88192.168.2.5
                                                                    Nov 25, 2024 11:23:02.791156054 CET49947443192.168.2.5147.75.63.88
                                                                    Nov 25, 2024 11:23:02.795286894 CET49947443192.168.2.5147.75.63.88
                                                                    Nov 25, 2024 11:23:02.795300961 CET44349947147.75.63.88192.168.2.5
                                                                    Nov 25, 2024 11:23:02.795356035 CET44349947147.75.63.88192.168.2.5

                                                                    UDP Packets

                                                                    TimestampSource PortDest PortSource IPDest IP
                                                                    Nov 25, 2024 11:21:05.917572021 CET4930553192.168.2.51.1.1.1
                                                                    Nov 25, 2024 11:21:06.372212887 CET53493051.1.1.1192.168.2.5
                                                                    Nov 25, 2024 11:21:36.928484917 CET6418053192.168.2.51.1.1.1
                                                                    Nov 25, 2024 11:21:37.401145935 CET53641801.1.1.1192.168.2.5
                                                                    Nov 25, 2024 11:22:29.352715969 CET5158753192.168.2.51.1.1.1
                                                                    Nov 25, 2024 11:22:29.887006998 CET53515871.1.1.1192.168.2.5
                                                                    Nov 25, 2024 11:23:02.289222002 CET6396553192.168.2.51.1.1.1
                                                                    Nov 25, 2024 11:23:02.759721994 CET53639651.1.1.1192.168.2.5

                                                                    DNS Queries

                                                                    TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                    Nov 25, 2024 11:21:05.917572021 CET192.168.2.51.1.1.10xa0c0Standard query (0)instance-c89u33-relay.screenconnect.comA (IP address)IN (0x0001)false
                                                                    Nov 25, 2024 11:21:36.928484917 CET192.168.2.51.1.1.10x701dStandard query (0)instance-c89u33-relay.screenconnect.comA (IP address)IN (0x0001)false
                                                                    Nov 25, 2024 11:22:29.352715969 CET192.168.2.51.1.1.10x9593Standard query (0)instance-c89u33-relay.screenconnect.comA (IP address)IN (0x0001)false
                                                                    Nov 25, 2024 11:23:02.289222002 CET192.168.2.51.1.1.10x8defStandard query (0)instance-c89u33-relay.screenconnect.comA (IP address)IN (0x0001)false

                                                                    DNS Answers

                                                                    TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                    Nov 25, 2024 11:21:06.372212887 CET1.1.1.1192.168.2.50xa0c0No error (0)instance-c89u33-relay.screenconnect.comserver-nix3a3cd951-relay.screenconnect.comCNAME (Canonical name)IN (0x0001)false
                                                                    Nov 25, 2024 11:21:06.372212887 CET1.1.1.1192.168.2.50xa0c0No error (0)server-nix3a3cd951-relay.screenconnect.com147.75.63.88A (IP address)IN (0x0001)false
                                                                    Nov 25, 2024 11:21:37.401145935 CET1.1.1.1192.168.2.50x701dNo error (0)instance-c89u33-relay.screenconnect.comserver-nix3a3cd951-relay.screenconnect.comCNAME (Canonical name)IN (0x0001)false
                                                                    Nov 25, 2024 11:21:37.401145935 CET1.1.1.1192.168.2.50x701dNo error (0)server-nix3a3cd951-relay.screenconnect.com147.75.63.88A (IP address)IN (0x0001)false
                                                                    Nov 25, 2024 11:22:29.887006998 CET1.1.1.1192.168.2.50x9593No error (0)instance-c89u33-relay.screenconnect.comserver-nix3a3cd951-relay.screenconnect.comCNAME (Canonical name)IN (0x0001)false
                                                                    Nov 25, 2024 11:22:29.887006998 CET1.1.1.1192.168.2.50x9593No error (0)server-nix3a3cd951-relay.screenconnect.com147.75.63.88A (IP address)IN (0x0001)false
                                                                    Nov 25, 2024 11:23:02.759721994 CET1.1.1.1192.168.2.50x8defNo error (0)instance-c89u33-relay.screenconnect.comserver-nix3a3cd951-relay.screenconnect.comCNAME (Canonical name)IN (0x0001)false
                                                                    Nov 25, 2024 11:23:02.759721994 CET1.1.1.1192.168.2.50x8defNo error (0)server-nix3a3cd951-relay.screenconnect.com147.75.63.88A (IP address)IN (0x0001)false

                                                                    Statistics

                                                                    CPU Usage

                                                                    Click to jump to process

                                                                    Memory Usage

                                                                    Click to jump to process

                                                                    High Level Behavior Distribution

                                                                    Click to dive into process behavior distribution

                                                                    Behavior

                                                                    Click to jump to process

                                                                    System Behavior

                                                                    General

                                                                    Target ID:0
                                                                    Start time:05:21:00
                                                                    Start date:25/11/2024
                                                                    Path:C:\Windows\System32\msiexec.exe
                                                                    Wow64 process (32bit):false
                                                                    Commandline:"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\MPJ_1281565D#U00ae.msi"
                                                                    Imagebase:0x7ff6e1ab0000
                                                                    File size:69'632 bytes
                                                                    MD5 hash:E5DA170027542E25EDE42FC54C929077
                                                                    Has elevated privileges:true
                                                                    Has administrator privileges:true
                                                                    Programmed in:C, C++ or other language
                                                                    Reputation:high
                                                                    Has exited:true

                                                                    General

                                                                    Target ID:1
                                                                    Start time:05:21:00
                                                                    Start date:25/11/2024
                                                                    Path:C:\Windows\System32\msiexec.exe
                                                                    Wow64 process (32bit):false
                                                                    Commandline:C:\Windows\system32\msiexec.exe /V
                                                                    Imagebase:0x7ff6e1ab0000
                                                                    File size:69'632 bytes
                                                                    MD5 hash:E5DA170027542E25EDE42FC54C929077
                                                                    Has elevated privileges:true
                                                                    Has administrator privileges:true
                                                                    Programmed in:C, C++ or other language
                                                                    Reputation:high
                                                                    Has exited:false

                                                                    General

                                                                    Target ID:2
                                                                    Start time:05:21:01
                                                                    Start date:25/11/2024
                                                                    Path:C:\Windows\SysWOW64\msiexec.exe
                                                                    Wow64 process (32bit):true
                                                                    Commandline:C:\Windows\syswow64\MsiExec.exe -Embedding 390FD6DCD7E50BFBF112F96E3A0DE021 C
                                                                    Imagebase:0x930000
                                                                    File size:59'904 bytes
                                                                    MD5 hash:9D09DC1EDA745A5F87553048E57620CF
                                                                    Has elevated privileges:true
                                                                    Has administrator privileges:true
                                                                    Programmed in:C, C++ or other language
                                                                    Reputation:high
                                                                    Has exited:true

                                                                    General

                                                                    Target ID:4
                                                                    Start time:05:21:01
                                                                    Start date:25/11/2024
                                                                    Path:C:\Windows\SysWOW64\rundll32.exe
                                                                    Wow64 process (32bit):true
                                                                    Commandline:rundll32.exe "C:\Users\user\AppData\Local\Temp\MSI31E4.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5518000 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
                                                                    Imagebase:0xa50000
                                                                    File size:61'440 bytes
                                                                    MD5 hash:889B99C52A60DD49227C5E485A016679
                                                                    Has elevated privileges:true
                                                                    Has administrator privileges:true
                                                                    Programmed in:C, C++ or other language
                                                                    Reputation:high
                                                                    Has exited:true

                                                                    General

                                                                    Target ID:5
                                                                    Start time:05:21:03
                                                                    Start date:25/11/2024
                                                                    Path:C:\Windows\SysWOW64\msiexec.exe
                                                                    Wow64 process (32bit):true
                                                                    Commandline:C:\Windows\syswow64\MsiExec.exe -Embedding 1B5721C1CE0E7EF98DD0EC09055781AD
                                                                    Imagebase:0x930000
                                                                    File size:59'904 bytes
                                                                    MD5 hash:9D09DC1EDA745A5F87553048E57620CF
                                                                    Has elevated privileges:true
                                                                    Has administrator privileges:true
                                                                    Programmed in:C, C++ or other language
                                                                    Reputation:high
                                                                    Has exited:true

                                                                    General

                                                                    Target ID:6
                                                                    Start time:05:21:04
                                                                    Start date:25/11/2024
                                                                    Path:C:\Windows\SysWOW64\msiexec.exe
                                                                    Wow64 process (32bit):true
                                                                    Commandline:C:\Windows\syswow64\MsiExec.exe -Embedding A228E7CE75C97BE8E56E19BF17938851 E Global\MSI0000
                                                                    Imagebase:0x930000
                                                                    File size:59'904 bytes
                                                                    MD5 hash:9D09DC1EDA745A5F87553048E57620CF
                                                                    Has elevated privileges:true
                                                                    Has administrator privileges:true
                                                                    Programmed in:C, C++ or other language
                                                                    Reputation:high
                                                                    Has exited:true

                                                                    General

                                                                    Target ID:7
                                                                    Start time:05:21:04
                                                                    Start date:25/11/2024
                                                                    Path:C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exe
                                                                    Wow64 process (32bit):true
                                                                    Commandline:"C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-c89u33-relay.screenconnect.com&p=443&s=8f47f859-e57f-4bd8-9f9a-e730d3b0dc96&k=BgIAAACkAABSU0ExAAgAAAEAAQDpI9qfgaQF9EqFatMP06CsRNHBTKHOK5%2bUtX0qmq8CA4QJH2XTUdjK0ggTdGE4t0YfU4unuKYheAHWWjw%2bjMFfbdlJ1G50ApzOoLoB%2b7pQWX2ZnbVh%2bLfj4JIFwgKtc6Wpc%2fHElrzDuV3d5egfIjs2stKs6RmevReV2ZtwZXMrYZKFQK5QgwhmOTs1pFbFBaiusdjG8NTEcpq2zEicxl0jNKmCw71zqxPy1Lyu3YkOHeZqzMfRsWjzH%2fYVBCAx2I5sAn2Al2rwnZGCoxiYVwlWGITSxEHyjKXWvvVVaCBwjSzlM79WD5B4aCG5QDHn9IzvPCVw%2bHuInNUKsgj2iTG7&t=pdfconvitHir"
                                                                    Imagebase:0xeb0000
                                                                    File size:95'512 bytes
                                                                    MD5 hash:75B21D04C69128A7230A0998086B61AA
                                                                    Has elevated privileges:true
                                                                    Has administrator privileges:true
                                                                    Programmed in:C, C++ or other language
                                                                    Antivirus matches:
                                                                    • Detection: 0%, ReversingLabs
                                                                    Reputation:low
                                                                    Has exited:false

                                                                    General

                                                                    Target ID:8
                                                                    Start time:05:21:05
                                                                    Start date:25/11/2024
                                                                    Path:C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exe
                                                                    Wow64 process (32bit):false
                                                                    Commandline:"C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exe" "RunRole" "d04726a4-55e2-40d7-93a5-312106824cb3" "User"
                                                                    Imagebase:0x7a0000
                                                                    File size:602'392 bytes
                                                                    MD5 hash:1778204A8C3BC2B8E5E4194EDBAF7135
                                                                    Has elevated privileges:false
                                                                    Has administrator privileges:false
                                                                    Programmed in:C, C++ or other language
                                                                    Yara matches:
                                                                    • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: 00000008.00000000.2072833360.00000000007A2000.00000002.00000001.01000000.00000010.sdmp, Author: Joe Security
                                                                    • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: 00000008.00000002.3297693904.0000000002C01000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                    • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Program Files (x86)\ScreenConnect Client (909a0bac52a7095f)\ScreenConnect.WindowsClient.exe, Author: Joe Security
                                                                    Antivirus matches:
                                                                    • Detection: 0%, ReversingLabs
                                                                    Reputation:low
                                                                    Has exited:false

                                                                    Disassembly

                                                                    Reset < >

                                                                      Executed Functions

                                                                      Function 049F1630 Relevance: 2.7, Strings: 2, Instructions: 156COMMON
                                                                      Download Yara Rule
                                                                      Strings
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID: $]q$$]q
                                                                      • API String ID: 0-127220927
                                                                      • Opcode ID: 2a24c50e33e4a9869c3abd77183803b456c96c6434cda9f1146bc17837adaa20
                                                                      • Instruction ID: 0dca36849661add601d79da4f7cad22b96d3f2d79641a4bd5f773e97a54785fa
                                                                      • Opcode Fuzzy Hash: 2a24c50e33e4a9869c3abd77183803b456c96c6434cda9f1146bc17837adaa20
                                                                      • Instruction Fuzzy Hash: AA51D035B002098FCB14DF79D8506AEBBF6BFC9350B24843AD919D7364DA30AD02CB91
                                                                      Function 049F28B4 Relevance: 2.6, Strings: 2, Instructions: 147COMMON
                                                                      Download Yara Rule
                                                                      Strings
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID: (aq$LR]q
                                                                      • API String ID: 0-67906209
                                                                      • Opcode ID: 4b5f5116e21387c60059bd751f3664bcb4fbaf0e02acabd0c649ef71ac882e98
                                                                      • Instruction ID: 5cbb72ed1213c3581e008ca9331faee841c9088401c3e29fe37243cf2be45948
                                                                      • Opcode Fuzzy Hash: 4b5f5116e21387c60059bd751f3664bcb4fbaf0e02acabd0c649ef71ac882e98
                                                                      • Instruction Fuzzy Hash: ED411431B042155FDB049B39AC5837E7BEAEFC5214F5488B9E506DB396EE35EC068390
                                                                      Function 049F50D0 Relevance: 2.6, Strings: 2, Instructions: 98COMMON
                                                                      Download Yara Rule
                                                                      Strings
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID: $]q$$]q
                                                                      • API String ID: 0-127220927
                                                                      • Opcode ID: 7e99bbbe20b6874ffc8e90d1a91a8652c97f99cd043ea054d55c8804353cce0b
                                                                      • Instruction ID: 5d6bc151653b8aae06cba5cb32cc72a0bea95e92f2ed844959142a37cbdf9a19
                                                                      • Opcode Fuzzy Hash: 7e99bbbe20b6874ffc8e90d1a91a8652c97f99cd043ea054d55c8804353cce0b
                                                                      • Instruction Fuzzy Hash: 78318030B10204EFEB199F65D854AAEBAF6BF88714F15C439D802AB356DB34B841CB90
                                                                      Function 049F6508 Relevance: 1.5, Strings: 1, Instructions: 237COMMON
                                                                      Download Yara Rule
                                                                      Strings
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID: LR]q
                                                                      • API String ID: 0-3081347316
                                                                      • Opcode ID: ad5a20738de0ceebf573c75636a36569788e22aef1e9bbdbe0cabd797748a1a0
                                                                      • Instruction ID: 4a8c12668b60aa6c660d2d639322406e7d3fda095de8fa8b1c39e4f39fa3265e
                                                                      • Opcode Fuzzy Hash: ad5a20738de0ceebf573c75636a36569788e22aef1e9bbdbe0cabd797748a1a0
                                                                      • Instruction Fuzzy Hash: CA81AD30B10315DFDB249FA4D858BAEBBB6FF84714F108579D506AB290DB34AC46CB91
                                                                      Function 049F1080 Relevance: 1.5, Strings: 1, Instructions: 212COMMON
                                                                      Download Yara Rule
                                                                      Strings
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID: (aq
                                                                      • API String ID: 0-600464949
                                                                      • Opcode ID: d9231be3dd5218445154484eb9e19bba8cc89a78e9b2b0365085da0d538bddbf
                                                                      • Instruction ID: f7366dce8dc94fd43ec51d6733e2fb0fd2bf65a89968478a1c4777f4f99531eb
                                                                      • Opcode Fuzzy Hash: d9231be3dd5218445154484eb9e19bba8cc89a78e9b2b0365085da0d538bddbf
                                                                      • Instruction Fuzzy Hash: 0F718731B00214DFDB049BB5CC55AAEB6EBAFC8314F158439DA0697365DE74EC12C791
                                                                      Function 049F0C1C Relevance: 1.4, Strings: 1, Instructions: 149COMMON
                                                                      Download Yara Rule
                                                                      Strings
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID: (aq
                                                                      • API String ID: 0-600464949
                                                                      • Opcode ID: 5b1fc92804e925e9a42d4e54580b1ef0bfa2af88916099e1b6f6d6b5f28626b5
                                                                      • Instruction ID: 1ff9c40df89b7038e07dffee1ecceee4e99055f1cb1c10a997603779e05e7d93
                                                                      • Opcode Fuzzy Hash: 5b1fc92804e925e9a42d4e54580b1ef0bfa2af88916099e1b6f6d6b5f28626b5
                                                                      • Instruction Fuzzy Hash: 3351B130B04215AFE7049B68D8657AE7FF6EFC8320F15843AD506A7386CE756C458BD1
                                                                      Function 049F2878 Relevance: 1.4, Strings: 1, Instructions: 115COMMON
                                                                      Download Yara Rule
                                                                      Strings
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID: LR]q
                                                                      • API String ID: 0-3081347316
                                                                      • Opcode ID: 6fdfb286a9bb87e24d19332f19eb8386c32416c70c30cb06e2f6488593de42ca
                                                                      • Instruction ID: 7c8c942fac118cefcf8097ba05fd42e0dc2cb06520cb2c7bbf2131359107ff3c
                                                                      • Opcode Fuzzy Hash: 6fdfb286a9bb87e24d19332f19eb8386c32416c70c30cb06e2f6488593de42ca
                                                                      • Instruction Fuzzy Hash: 23312230B092515FDB059F389C647AE7BFAEF81214F1544BAE245CB2D2EA35A8098390
                                                                      Function 049F50BF Relevance: 1.4, Strings: 1, Instructions: 112COMMON
                                                                      Download Yara Rule
                                                                      Strings
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID: $]q
                                                                      • API String ID: 0-1007455737
                                                                      • Opcode ID: a0f7175bfac0af675854a2caaf70181af8b6c0507f268a9c0c96566164c90890
                                                                      • Instruction ID: 8975f2682860f686c46daa7fbf2434cbb5a9a5366a316be47b56533d22e14106
                                                                      • Opcode Fuzzy Hash: a0f7175bfac0af675854a2caaf70181af8b6c0507f268a9c0c96566164c90890
                                                                      • Instruction Fuzzy Hash: A141B330B00205EFEB149F65D8446AA7BA6FF88314F15C439D902AB256DB74F842DB90
                                                                      Function 049F2D60 Relevance: 1.4, Strings: 1, Instructions: 109COMMON
                                                                      Download Yara Rule
                                                                      Strings
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID: LR]q
                                                                      • API String ID: 0-3081347316
                                                                      • Opcode ID: fad34ce130238f9aba7dbe3023b78823a688e28f39e036d83c1e1646dcacecd1
                                                                      • Instruction ID: d2d8c721e5ce0c2d873eb903e35e46b1f6faa509c2c8e4f0222ca4cd71a9ea22
                                                                      • Opcode Fuzzy Hash: fad34ce130238f9aba7dbe3023b78823a688e28f39e036d83c1e1646dcacecd1
                                                                      • Instruction Fuzzy Hash: 1031C035B002059BDB089B649C547BE77ABAFC4214F2484B9D606DB294EB36ED068740
                                                                      Function 049F8A31 Relevance: 1.3, Strings: 1, Instructions: 78COMMON
                                                                      Download Yara Rule
                                                                      Strings
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID: LR]q
                                                                      • API String ID: 0-3081347316
                                                                      • Opcode ID: 5f618aec7b53ed04e3710ec15511b7e9a32e497026e9b9318fb8607e1ffdf436
                                                                      • Instruction ID: 094c5cbede5fd9d9909aa369e84007639fb584fe6fa92276f8364932029926a8
                                                                      • Opcode Fuzzy Hash: 5f618aec7b53ed04e3710ec15511b7e9a32e497026e9b9318fb8607e1ffdf436
                                                                      • Instruction Fuzzy Hash: 35219170B15205DFDB54DBA0D8997AEBBB7EF88705F208439D902A7280DF74AD06CB51
                                                                      Function 049F8A40 Relevance: 1.3, Strings: 1, Instructions: 78COMMON
                                                                      Download Yara Rule
                                                                      Strings
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID: LR]q
                                                                      • API String ID: 0-3081347316
                                                                      • Opcode ID: b65eb7a1c91ecb8d798b15741fdd54ae077d0ccc2366a39e4120da2174c5c638
                                                                      • Instruction ID: db3ae01ce05872c835fda0f57a3b01531b05243a49ce11883d69c55ada1bc121
                                                                      • Opcode Fuzzy Hash: b65eb7a1c91ecb8d798b15741fdd54ae077d0ccc2366a39e4120da2174c5c638
                                                                      • Instruction Fuzzy Hash: EF216F70B10209DFDB44DBA1D8596AEBBB7EF88705F108439E902A7380DF746D06CB95
                                                                      Function 049F28C4 Relevance: 1.3, Strings: 1, Instructions: 70COMMON
                                                                      Download Yara Rule
                                                                      Strings
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID: (aq
                                                                      • API String ID: 0-600464949
                                                                      • Opcode ID: 2c9660c666dff952ab7ca01278162cac8b0e6137c9d6db87ed10fa5ad5b86f99
                                                                      • Instruction ID: 2a6533d789fcccd7548ccb6ddfeeada5cbabab65099500d4ad10d418c0483895
                                                                      • Opcode Fuzzy Hash: 2c9660c666dff952ab7ca01278162cac8b0e6137c9d6db87ed10fa5ad5b86f99
                                                                      • Instruction Fuzzy Hash: DF115965B0C3805FE7159A35989472E7FAB9FC2214F0684BED5029B2E3ED78AC05C396
                                                                      Function 049F29C8 Relevance: .2, Instructions: 228COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 175af7154842983bd2845bcf0481034a37e6fb4f6cd869a59a53dad0b714fd5d
                                                                      • Instruction ID: 52a29b70122ab0a1eee5a9fd44ffb45e40d4c9e2cefd1725a4bc801a238bf850
                                                                      • Opcode Fuzzy Hash: 175af7154842983bd2845bcf0481034a37e6fb4f6cd869a59a53dad0b714fd5d
                                                                      • Instruction Fuzzy Hash: 37916A35A10605CFCB04DF69D89069AB7B6FF88314B148669E90AAB314EB35FD85CB90
                                                                      Function 049F6EA0 Relevance: .2, Instructions: 178COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 7eade5e6bc23166b92370713c5c84d25c783a78930be7d598dff2f720988c389
                                                                      • Instruction ID: a68cc08ca55806294c93a5d1c895c12dc1698d2361feb2b2d1bae17eb1bf506d
                                                                      • Opcode Fuzzy Hash: 7eade5e6bc23166b92370713c5c84d25c783a78930be7d598dff2f720988c389
                                                                      • Instruction Fuzzy Hash: A3610770D143459FD701DFB8D854BC9BFB5FF89304F1085AAE004AB292DB78A94ACB95
                                                                      Function 049F6F18 Relevance: .2, Instructions: 159COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 652dfe779a2f7cf6347f931e229c229d1fa52ca3fa1fa85e3dac71f95d4c6b76
                                                                      • Instruction ID: e9432e228afdee19e6cf6a4fedb82ae9db76ea69b8d8c8dd4ae84b268f290428
                                                                      • Opcode Fuzzy Hash: 652dfe779a2f7cf6347f931e229c229d1fa52ca3fa1fa85e3dac71f95d4c6b76
                                                                      • Instruction Fuzzy Hash: B951C370E103458FDB01DFB8E854BC9BFB5FF89300F10856AE104AB292DB78A949CB95
                                                                      Function 049F29A3 Relevance: .2, Instructions: 159COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: a17662db5b2f1cceb369d7b8b9cb06ab76ebea6b8c2deba20370d97a17873cad
                                                                      • Instruction ID: 095d7e334f0fcbf27871ef8cf6a0865e9ead7fea22572d026f6469abc4341e27
                                                                      • Opcode Fuzzy Hash: a17662db5b2f1cceb369d7b8b9cb06ab76ebea6b8c2deba20370d97a17873cad
                                                                      • Instruction Fuzzy Hash: BB519C35A002018FDB05DF39D990A5ABBF6EF8921471985A9E806DF369DF34FC46CB90
                                                                      Function 049F6F78 Relevance: .1, Instructions: 142COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 5f10806f4d8de88435c4c3ea47a509e8bd4f15af106d8df292fe55b7fef2bc09
                                                                      • Instruction ID: 61ee690666c7d3f5bdcff96917e55cd0a9bcc366b30d62f420f8d783d305eebc
                                                                      • Opcode Fuzzy Hash: 5f10806f4d8de88435c4c3ea47a509e8bd4f15af106d8df292fe55b7fef2bc09
                                                                      • Instruction Fuzzy Hash: A4518F30E103099FDB04DFB8E954BDDBBB6FF88300F108569E505AB295DB78A949CB94
                                                                      Function 049F2268 Relevance: .1, Instructions: 106COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 0fc487684ba4aee75f31d3c9b91b655eb81d00fd01066ba8ca1b33b862f789d4
                                                                      • Instruction ID: dcd0c451dd142549f72fd867cb113737c59e16ddfd287fa8d3704828aac244c4
                                                                      • Opcode Fuzzy Hash: 0fc487684ba4aee75f31d3c9b91b655eb81d00fd01066ba8ca1b33b862f789d4
                                                                      • Instruction Fuzzy Hash: 3A411A75B002149FCB54DF69D88099EBBB6FF88714B108169EA05EB360EB31ED42CB90
                                                                      Function 049F6390 Relevance: .1, Instructions: 94COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 459a69540f8d27cb26a3e3506941ccb624472eb15773ea299fb792cac3842a78
                                                                      • Instruction ID: 36485d8c7a6aca903001d45ad4e0c63678e1dc4e1c919ca9baf43c588cefe012
                                                                      • Opcode Fuzzy Hash: 459a69540f8d27cb26a3e3506941ccb624472eb15773ea299fb792cac3842a78
                                                                      • Instruction Fuzzy Hash: EC41C378A10208DFDB44DFA9D98499DBBF6FF98310B148069E905E7365DB34EC42CB90
                                                                      Function 049F63A0 Relevance: .1, Instructions: 91COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: ea30f0d48c0210ba8031a31924a799a66dfefcdb1c50004df542fe09e8f629c8
                                                                      • Instruction ID: 5eaf891dfbae4726904a0654e3d561d507d3e14762fe3fe7418d3da8598f03f8
                                                                      • Opcode Fuzzy Hash: ea30f0d48c0210ba8031a31924a799a66dfefcdb1c50004df542fe09e8f629c8
                                                                      • Instruction Fuzzy Hash: A231B278A102189FCB44DFA9D98499DBBFAFF88310B258069E905E7325DB30EC41CF90
                                                                      Function 049F1062 Relevance: .1, Instructions: 79COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 51905fd6596053a7cb79bf3016e3ce3b568bd1a49554da3c8c6ae5828b77679b
                                                                      • Instruction ID: d640b5124a4ebc4fd8618686e902c297925c6807d5573c1930032b121540237a
                                                                      • Opcode Fuzzy Hash: 51905fd6596053a7cb79bf3016e3ce3b568bd1a49554da3c8c6ae5828b77679b
                                                                      • Instruction Fuzzy Hash: F3212631F04314DBEB108AA58C55AAABBEEDFC8254F04803ADA06D7245EE74ED1687D1
                                                                      Function 049F306F Relevance: .1, Instructions: 78COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: a7605dea77432fe5aad24030dbdc7c7e167b6921e2ad051481eac5b3961be414
                                                                      • Instruction ID: 2a0666b28fa26712e353f28c72d31e60ea3e527b48e5dafbdbe9bab77bdab85c
                                                                      • Opcode Fuzzy Hash: a7605dea77432fe5aad24030dbdc7c7e167b6921e2ad051481eac5b3961be414
                                                                      • Instruction Fuzzy Hash: 3021D475B44204EFDB04EBA4DC50AAE7BB2EFC8321F05802AD905A7291DE796C458B90
                                                                      Function 049F2CC3 Relevance: .1, Instructions: 73COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 4095d0e80f7c78abcad867a5541dd941ca0af760bbd0851c9d243efb17d95d74
                                                                      • Instruction ID: 1009fae3bfe394ce4d3957f0a39c4a9b6280b4587d28709a07b4a75f140173bf
                                                                      • Opcode Fuzzy Hash: 4095d0e80f7c78abcad867a5541dd941ca0af760bbd0851c9d243efb17d95d74
                                                                      • Instruction Fuzzy Hash: 8521A436E0061ACBDF14DBA5D8502DDF3B2FF88314B10857AC509B7254DB35A986CB90
                                                                      Function 049F28D4 Relevance: .1, Instructions: 67COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 69c5cb750c005c2585f760a94856a9c619995e617d30789d26a7277013b70b0e
                                                                      • Instruction ID: 68ffc56b8e577fc64289f4e01f88f03e4d6addce2401dc2539dbcb1de3ea5fe2
                                                                      • Opcode Fuzzy Hash: 69c5cb750c005c2585f760a94856a9c619995e617d30789d26a7277013b70b0e
                                                                      • Instruction Fuzzy Hash: C4115920B643551BFB1527B48C6037E2BDEDFC2224F5044FADA02DB683DC69AC064392
                                                                      Function 049F9460 Relevance: .1, Instructions: 63COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 352a781f239809807edf7ecbe1a3cacef33f58a92ac4dc0e0eeb410e356bfbc4
                                                                      • Instruction ID: bdcb5d2242461468208a7be41233c1c244e8e7d517e1d592f62481bda4b84175
                                                                      • Opcode Fuzzy Hash: 352a781f239809807edf7ecbe1a3cacef33f58a92ac4dc0e0eeb410e356bfbc4
                                                                      • Instruction Fuzzy Hash: 92216F34A54114EFD704EB65C851AAA7BB2EFCC320F154039DA09A7790CF35AC468BD0
                                                                      Function 049F2FC8 Relevance: .1, Instructions: 60COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 88ab919ea02f2046156211afc696d91e6c5f81ee6dcfb412027ac06bbd492e1a
                                                                      • Instruction ID: 5c85c9b3374274200ed3281948d09800dd6f0e68192f5e04e39de1e8a1754206
                                                                      • Opcode Fuzzy Hash: 88ab919ea02f2046156211afc696d91e6c5f81ee6dcfb412027ac06bbd492e1a
                                                                      • Instruction Fuzzy Hash: 78118CA25553948FE31237B07C107AA7F588F82315F0A40FBDA405B4D3EE296845C3A6
                                                                      Function 049F2258 Relevance: .1, Instructions: 59COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 6a529499ae31e1baa430302e5dc54d02cd57e779f61ef4e59629b21d6fd6e609
                                                                      • Instruction ID: 4bdef31031ac4dfdb86e2eef412d9f46e0009403d6aa4c2219eb4452b33145a8
                                                                      • Opcode Fuzzy Hash: 6a529499ae31e1baa430302e5dc54d02cd57e779f61ef4e59629b21d6fd6e609
                                                                      • Instruction Fuzzy Hash: 4921E775E102049FCB44DFB9D98099EBBB2EF8C714B10816AE915AB360DB31A942CF91
                                                                      Function 049F3080 Relevance: .1, Instructions: 59COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 1fd2bacf4cb7d3a31f7068cea971e78a15fd74fc41be8dc05892d04be8148d6f
                                                                      • Instruction ID: 354b5a30da89b895b2e2b0d4f29cfbedc2fcc68379c7340d49c750596a2b1159
                                                                      • Opcode Fuzzy Hash: 1fd2bacf4cb7d3a31f7068cea971e78a15fd74fc41be8dc05892d04be8148d6f
                                                                      • Instruction Fuzzy Hash: 2A115C30B04215AFDB08EF65C851AAE7BB6EFCC324F158039D909A7394DE79AC458BD0
                                                                      Function 049F9470 Relevance: .1, Instructions: 57COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 441d08a73adef16dd0bafc008b6704412b1b645096e446a1fa3ab8fd759456b9
                                                                      • Instruction ID: 5dfe6d4470aac5a83dd52887ac9cc7840b36b5f7dd2cb7385a2aca0ef57da707
                                                                      • Opcode Fuzzy Hash: 441d08a73adef16dd0bafc008b6704412b1b645096e446a1fa3ab8fd759456b9
                                                                      • Instruction Fuzzy Hash: EC115C30B54114AFDB04EF65D851AAA7BB6EFC8324F114039D609A7390CE79AC458BD0
                                                                      Function 049F7798 Relevance: .1, Instructions: 56COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 944518c7fb5b2d843d1f27170cee7e3824e5696349a1fdc9528b417f455583fd
                                                                      • Instruction ID: 98b99441db92d227dcf3b4bae0e8a30dec25fd3143c701fbec5dbb06b3e1af6f
                                                                      • Opcode Fuzzy Hash: 944518c7fb5b2d843d1f27170cee7e3824e5696349a1fdc9528b417f455583fd
                                                                      • Instruction Fuzzy Hash: 0901C472F106159BDB20DAAD98406ABFBE9EF88711F014476D609D7340EA349910C7E1
                                                                      Function 049F2CD0 Relevance: .1, Instructions: 55COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: d06e081943d6508024e1291583c348e76a81ae85951c8e87e60dd136a10c5109
                                                                      • Instruction ID: 19ef6d627692c1cb54bcb9df7be67a2f4ae0dcf22502c8e1a6f4c6cc9a9272c3
                                                                      • Opcode Fuzzy Hash: d06e081943d6508024e1291583c348e76a81ae85951c8e87e60dd136a10c5109
                                                                      • Instruction Fuzzy Hash: C401A536B001188BDF148BA8DC103EEB7F6EBC8315F1440B9C505B7254DB3AA945C7A5
                                                                      Function 049F1378 Relevance: .1, Instructions: 55COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 069a30fbdfee21c221d8e1da66982c417f716132e5b5a51dbb72b3b4cc67f587
                                                                      • Instruction ID: 8b4b13c7d7955e43b3781ab5a79cfbe10268cb354beec52f1636145c7a927772
                                                                      • Opcode Fuzzy Hash: 069a30fbdfee21c221d8e1da66982c417f716132e5b5a51dbb72b3b4cc67f587
                                                                      • Instruction Fuzzy Hash: 8B21E5B5D002499FDB10DFAAC885AEEFBF4FF48324F108429D55967240C7796945CFA1
                                                                      Function 049F1958 Relevance: .1, Instructions: 55COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 71944df792c40e8de7049945dd15c8b7d97e95bae7b62649bdf1fc60af491e0d
                                                                      • Instruction ID: 2b5cdadab5563b8cf538e0856b40335f7b687d6fb30e1c86e84445249cc4f4aa
                                                                      • Opcode Fuzzy Hash: 71944df792c40e8de7049945dd15c8b7d97e95bae7b62649bdf1fc60af491e0d
                                                                      • Instruction Fuzzy Hash: 2C116D31A04215BFC704DF64D495AAABFB2EF8C320F114429D50AA7380CB356C55CBD0
                                                                      Function 049F7FB3 Relevance: .1, Instructions: 54COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: f862efdb48a89eb25e2a0f6aa2fd4105281278dd206f0cc27b73185ff3f90cee
                                                                      • Instruction ID: 3293ac09ffb1fad6cc0fd13d17b224e677d2130464a6ef61d4aa0b030ff05d64
                                                                      • Opcode Fuzzy Hash: f862efdb48a89eb25e2a0f6aa2fd4105281278dd206f0cc27b73185ff3f90cee
                                                                      • Instruction Fuzzy Hash: B20126353093404FD302D638ECD248ABFA5EF85218349C4BBD544CB662DE60E80B8791
                                                                      Function 049F8058 Relevance: .1, Instructions: 53COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 56b1fc586458c824ad7c86a816d22bbcb871ba3906c064b4fbf41782f90ead99
                                                                      • Instruction ID: 3cd6fc5d20efd82127df68eed8dbdf2afcb27c5a0168617bd608e591fa8a0cc2
                                                                      • Opcode Fuzzy Hash: 56b1fc586458c824ad7c86a816d22bbcb871ba3906c064b4fbf41782f90ead99
                                                                      • Instruction Fuzzy Hash: 920121363101109F9B84DA6EF49496EF7AAFBD8275355803AE905C7310CE72EC128799
                                                                      Function 049F7658 Relevance: .1, Instructions: 53COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 6fffa03a72396305cc1aa280b3abfc4bc9279041a25ef2655491ec32dbe1e765
                                                                      • Instruction ID: bed25cc9f2ab83e429a9ee54ecbfbb2c7cde10ec07f710948c1fea56b296f8a4
                                                                      • Opcode Fuzzy Hash: 6fffa03a72396305cc1aa280b3abfc4bc9279041a25ef2655491ec32dbe1e765
                                                                      • Instruction Fuzzy Hash: 1301D270B082595FD304D6ACD81059EBFB2DF86210B0580FAC548DB292CD31AD13C396
                                                                      Function 049F1380 Relevance: .1, Instructions: 53COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: f2568bc807710274a1c0b23300130145aeebfef22c0b68cb9b609fab6bc8584b
                                                                      • Instruction ID: 803ff0d01336f83a204b39958b4827a052f7468c9982a048bc9739579bc2b82b
                                                                      • Opcode Fuzzy Hash: f2568bc807710274a1c0b23300130145aeebfef22c0b68cb9b609fab6bc8584b
                                                                      • Instruction Fuzzy Hash: 5511F4B5D002499EDB10DFAAC885AEEFBF4FF48314F108429D51967240CB79A945CFA1
                                                                      Function 049F1968 Relevance: .1, Instructions: 51COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 4d02832e43f6a55e40d6bd1797c912a60a37c6e35dc8525b18dbca6ed357e1f9
                                                                      • Instruction ID: 911ae8941d5b9d88d9a673621770673328957d10a5447fc2708d1b250bd2010f
                                                                      • Opcode Fuzzy Hash: 4d02832e43f6a55e40d6bd1797c912a60a37c6e35dc8525b18dbca6ed357e1f9
                                                                      • Instruction Fuzzy Hash: C7111931B04215BFCB08DF64D855AAA7FB6EF8C320F154029E50AA7390DE79AC55CBD0
                                                                      Function 049F2EFB Relevance: .0, Instructions: 49COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: f5c4f4cd926aa5d7762624e9e94c292f1258a0212436f177470a240ab31decef
                                                                      • Instruction ID: 2c6ed0aa4d339ef7b929b30b04292e3a103fd77c131385528bda1cdfa5a05e36
                                                                      • Opcode Fuzzy Hash: f5c4f4cd926aa5d7762624e9e94c292f1258a0212436f177470a240ab31decef
                                                                      • Instruction Fuzzy Hash: A2014E243203154FFF1917B6BE503691B8ECBC1708F5044BAE9068BB97DD66AC435385
                                                                      Function 049F6A1F Relevance: .0, Instructions: 47COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 5a9c21e5c4bed1e4d3331c62d8b2562afde739a14af5966bcfdaa219b572b1d1
                                                                      • Instruction ID: 9b63b3c201f8f8514ba184c3e59596171a7b5b9f86fc1656945b39f294f36037
                                                                      • Opcode Fuzzy Hash: 5a9c21e5c4bed1e4d3331c62d8b2562afde739a14af5966bcfdaa219b572b1d1
                                                                      • Instruction Fuzzy Hash: 5E019E31B002058BEB18AFA9C9593DEB6E7AFC8214F248479C506BB394CE759D068BC5
                                                                      Function 049F6B0C Relevance: .0, Instructions: 46COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: da9efa2ca2f3431233f18c77c47f5e0950f2e9e4405d0e2bd56277f942850f8b
                                                                      • Instruction ID: f7ce1d769fe9d084fa9c3375d0fbcd04c56c0aceb31cafed34ca87f0e7bc0949
                                                                      • Opcode Fuzzy Hash: da9efa2ca2f3431233f18c77c47f5e0950f2e9e4405d0e2bd56277f942850f8b
                                                                      • Instruction Fuzzy Hash: A3F07832B083209FFB1516A46C157BD6752DBC130AF04807AC318AB3E5DA26FC438380
                                                                      Function 049F1440 Relevance: .0, Instructions: 46COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 2641e065e9f8e0ff92b4f07e0f43a22e914590e277f0ff2dc3e3e94d639849a1
                                                                      • Instruction ID: d0974943f4c9a7f6bc110921a517b53bb7c12dce32296a67a1d503331de57aa6
                                                                      • Opcode Fuzzy Hash: 2641e065e9f8e0ff92b4f07e0f43a22e914590e277f0ff2dc3e3e94d639849a1
                                                                      • Instruction Fuzzy Hash: C601B130B0A3055FC709AF7868A66267F9DDFC122470509BAC74DCB291F9289C0587D1
                                                                      Function 0456D006 Relevance: .0, Instructions: 45COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000002.2041647547.000000000456D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0456D000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_2_456d000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: adbdc04b4bfad686dd0f424ac4d83b3b3d39cfc2825400fd078969bc8c034827
                                                                      • Instruction ID: 9af652c564e4dc00a248dd5a4f2fcd168755bf96fd9d61d88d76b3f80bb8bf0c
                                                                      • Opcode Fuzzy Hash: adbdc04b4bfad686dd0f424ac4d83b3b3d39cfc2825400fd078969bc8c034827
                                                                      • Instruction Fuzzy Hash: C001927110E3C09ED7128B259C94B52BFB4EF53224F0C84CBD8888F293D2695849C772
                                                                      Function 0456D01D Relevance: .0, Instructions: 45COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000002.2041647547.000000000456D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0456D000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_2_456d000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: f0e2c206c0a1c8fd810dad753ed4784aafcf180d60c48a097046886b1c3c749d
                                                                      • Instruction ID: 81839b127f115dd637e220a326453143a437a62b9e8c0ed85fb0d77d9f237a82
                                                                      • Opcode Fuzzy Hash: f0e2c206c0a1c8fd810dad753ed4784aafcf180d60c48a097046886b1c3c749d
                                                                      • Instruction Fuzzy Hash: 3D012031304340D9D7208E15ED84B67BFACFF45330F18CD1ADD4A0B246E279A449D6B1
                                                                      Function 049F6A30 Relevance: .0, Instructions: 45COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 7491c0387350fc29709eff9b9adb935f0ada38d3320345ca00c08896c9fad28e
                                                                      • Instruction ID: b20f17027d615cd83345003f1328ce057377a2932bb5390282b9f62e03b80d31
                                                                      • Opcode Fuzzy Hash: 7491c0387350fc29709eff9b9adb935f0ada38d3320345ca00c08896c9fad28e
                                                                      • Instruction Fuzzy Hash: D0018431B0020597EB18AE69C81979F7AEAAFC8614F10847DD506E7390CE75AD068BD1
                                                                      Function 049F182A Relevance: .0, Instructions: 42COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 9120cb4c9a6e449c2496ee712dd58a15e43e52662f75349ce49d5ac9bdb8348f
                                                                      • Instruction ID: 28850a71de45935f592e1b921f45bcc4fea740f087acf1726f445c9e1d5aedb3
                                                                      • Opcode Fuzzy Hash: 9120cb4c9a6e449c2496ee712dd58a15e43e52662f75349ce49d5ac9bdb8348f
                                                                      • Instruction Fuzzy Hash: 0B01D131A40205C7EB18EAA88A963AE77F79BC8704F54843EC202B7390CE756C068BD1
                                                                      Function 049F9360 Relevance: .0, Instructions: 38COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: dc20c3b782b4b7911274d33bb8c2ea1ff9571e955691ecbb1bb23c6923fa30e3
                                                                      • Instruction ID: 389ead582459e7e1503d90cb19ccf94054a54c097b53eb382cd252790bad364a
                                                                      • Opcode Fuzzy Hash: dc20c3b782b4b7911274d33bb8c2ea1ff9571e955691ecbb1bb23c6923fa30e3
                                                                      • Instruction Fuzzy Hash: 8AF059BA7087004BD7149A2A9CC037D979AAFC4228708817ADA04872F2DBA4A8028741
                                                                      Function 049F28E4 Relevance: .0, Instructions: 36COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: fcad6eb0cec05d7cb16a52ee02179e0a0cf122681a2db871d05aa3b39ec33536
                                                                      • Instruction ID: 50cd8d69747b6fd3cd43458d6b736c2d94f42dda1136cc6c2290b4c26935acc3
                                                                      • Opcode Fuzzy Hash: fcad6eb0cec05d7cb16a52ee02179e0a0cf122681a2db871d05aa3b39ec33536
                                                                      • Instruction Fuzzy Hash: 72F02B25A5E3805FE70223741D24359BF68CF83214F0584FFD6059B053D9249805C3C5
                                                                      Function 049F7FE0 Relevance: .0, Instructions: 34COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: a837adb227f3af99761dae9f4f2f49dbe7a7979148b510a7bfc4036911e52daa
                                                                      • Instruction ID: 91d95472de2b7d34c277f851c52fa9393fad4396a5f29cd41ec1cc58973c2169
                                                                      • Opcode Fuzzy Hash: a837adb227f3af99761dae9f4f2f49dbe7a7979148b510a7bfc4036911e52daa
                                                                      • Instruction Fuzzy Hash: ECF058313403105B9365EA5EEC9089BBBDEEBC5664384803AEA0987250DFA1F80587E4
                                                                      Function 049F5278 Relevance: .0, Instructions: 33COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: a54ad6f28de573c06da65f96fba74b5af7399cf963f8663f8d4d237a5559adfe
                                                                      • Instruction ID: 97f35b86f06e2c40dad28c4deac3d73db52f77a7588fa494711eb53d96b3eb4b
                                                                      • Opcode Fuzzy Hash: a54ad6f28de573c06da65f96fba74b5af7399cf963f8663f8d4d237a5559adfe
                                                                      • Instruction Fuzzy Hash: C2F055367093401FE3014A29E850A86FF75EBCA224F1440BADA0CCB252CC719807C751
                                                                      Function 049F1431 Relevance: .0, Instructions: 31COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: a449b3b01c5796c073367f009e6037ece722a87ce82831e4f9eee011c2497d3f
                                                                      • Instruction ID: fca9a21e44119b4311d1f7ad37bb446c660359cd371deed1a251692693ea5b8d
                                                                      • Opcode Fuzzy Hash: a449b3b01c5796c073367f009e6037ece722a87ce82831e4f9eee011c2497d3f
                                                                      • Instruction Fuzzy Hash: 05F09030B492155ED71CAF7C69A66267F9AEFC4224B060C7DC74E8B290F9289C11C7C1
                                                                      Function 049F773B Relevance: .0, Instructions: 27COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 1963e701692e6f12a146f702c45bbc0a6c3f12f1e0eb7dc62906bc057372eacc
                                                                      • Instruction ID: 1dafc6e6c9a880958b8f779b6704e5aacad9144e5bfbcc485979140db5906424
                                                                      • Opcode Fuzzy Hash: 1963e701692e6f12a146f702c45bbc0a6c3f12f1e0eb7dc62906bc057372eacc
                                                                      • Instruction Fuzzy Hash: 4FE06D7220C3508FD7A8DE28A840696BBD5DFA8210B04883EE4C5C3384E931A841C729
                                                                      Function 049F7F67 Relevance: .0, Instructions: 27COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: ab9ff0519bff0d809d1bc3b22b418477755b66319043b4cb0bc189fcce157e8d
                                                                      • Instruction ID: dccf03bcf89a0f0ab602b11db64299ceda698e9c36b0c1d6705f1750aaa9bdb4
                                                                      • Opcode Fuzzy Hash: ab9ff0519bff0d809d1bc3b22b418477755b66319043b4cb0bc189fcce157e8d
                                                                      • Instruction Fuzzy Hash: 65E08670906209AFDB80DFB8E98359DBFF4EB4920C71185A9D819D7211EE30EF0B9781
                                                                      Function 049F5288 Relevance: .0, Instructions: 25COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: fbea77a00b92435a4358a3073ded253c5d844d7bd8fbf2c3da2d21e96a08bc2a
                                                                      • Instruction ID: 54f15073ea16fb313269410cdc508c38086769bbb137c6588438fdf61be159ea
                                                                      • Opcode Fuzzy Hash: fbea77a00b92435a4358a3073ded253c5d844d7bd8fbf2c3da2d21e96a08bc2a
                                                                      • Instruction Fuzzy Hash: B7E02C367002005BD314AA2EEC40A17F7AEEBCA228BA04439E90CC3346CD72AC028A90
                                                                      Function 049F9418 Relevance: .0, Instructions: 23COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: b2ad37ea6ccb3fc6525ca00a43a0b25ad3eca047d1bc440472affa8b753a1284
                                                                      • Instruction ID: 1e899c76561e10bf08eeaafedc717721ca5c9de3e13ed1f2e2efa70587f90be9
                                                                      • Opcode Fuzzy Hash: b2ad37ea6ccb3fc6525ca00a43a0b25ad3eca047d1bc440472affa8b753a1284
                                                                      • Instruction Fuzzy Hash: B9E08672644228ABD7012A56A804BEB7F5AEB90270F408032EB0C45550CA355850D7D4
                                                                      Function 049F2958 Relevance: .0, Instructions: 20COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: a43c857ff1022374e1b83d2922fec238496abd281dfc23a1960a4768d07329d1
                                                                      • Instruction ID: 174d60f2554131860624dda75e1a808c520360e92d98a7aa07c44637ed784f61
                                                                      • Opcode Fuzzy Hash: a43c857ff1022374e1b83d2922fec238496abd281dfc23a1960a4768d07329d1
                                                                      • Instruction Fuzzy Hash: 6CE0DFB1D09208DFCB44DFA0E90545CBFB4DB82200B0044E9DC09D7212EA385F09C782
                                                                      Function 049F76C0 Relevance: .0, Instructions: 19COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 67c5d2db6139d07c8f6b2e6d15f158be907b2d3e73b3caa13db531f02bb11d83
                                                                      • Instruction ID: 521ac0776a77cea1c3216d0b467934cdae245d50a9362b4a82614d7b8f1bae26
                                                                      • Opcode Fuzzy Hash: 67c5d2db6139d07c8f6b2e6d15f158be907b2d3e73b3caa13db531f02bb11d83
                                                                      • Instruction Fuzzy Hash: EBD0A9B63095502FE318822CF892180EBA1DB8A32430EC0ABE949CB263C822DC53C381
                                                                      Function 049F2F80 Relevance: .0, Instructions: 18COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 5b9b0dbf38283061ba513fe78d46de1a5bab5e80a55f8cfbf5c99bb65349a007
                                                                      • Instruction ID: 16b7f25776083dc76e3403f7422d8308ad7c625b3d6b16e12bf6a774f7b907af
                                                                      • Opcode Fuzzy Hash: 5b9b0dbf38283061ba513fe78d46de1a5bab5e80a55f8cfbf5c99bb65349a007
                                                                      • Instruction Fuzzy Hash: C3D0A79EFA0212ABDF0227F02A453A96759CFD2024F119CF7DB059E2479935580243C9
                                                                      Function 049F17F0 Relevance: .0, Instructions: 18COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: fc18f680243654634f616ca3c50a4d3d4df7248eacf5e0ad39013a661db96830
                                                                      • Instruction ID: 507fdc33572791cc70feafdcc3c65f06868f68b2be75c40264df7aa8b4c3463b
                                                                      • Opcode Fuzzy Hash: fc18f680243654634f616ca3c50a4d3d4df7248eacf5e0ad39013a661db96830
                                                                      • Instruction Fuzzy Hash: 38D0977A3983408FC309EBB0B9420483F72ABC1210318C027E8008B6B7CE310882C380
                                                                      Function 049F0C0C Relevance: .0, Instructions: 17COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: de3f7ddec59a6ba6b5aa4e8e3df9e54ed706b7e9dd9f79e60074fa9d2aa4d11b
                                                                      • Instruction ID: b123129f20976a408bcc2c52bf408c4a914dd7535504fd4563e986016524f939
                                                                      • Opcode Fuzzy Hash: de3f7ddec59a6ba6b5aa4e8e3df9e54ed706b7e9dd9f79e60074fa9d2aa4d11b
                                                                      • Instruction Fuzzy Hash: 73D0A73236011C6B52046A18DC4686A7B9EEBC42603914433FB0183224DD71BC1587D9
                                                                      Function 049F2968 Relevance: .0, Instructions: 16COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 1c50222e45b84f5f62829df433b1e3e02fe9486b7a073b23cf718be28595e3f2
                                                                      • Instruction ID: bae6e958a63b55650e68cd8f3bc820515f3fb4cad34489cdd80d3107d6360394
                                                                      • Opcode Fuzzy Hash: 1c50222e45b84f5f62829df433b1e3e02fe9486b7a073b23cf718be28595e3f2
                                                                      • Instruction Fuzzy Hash: F5D05E70A0520DEFCB40DFA8EA0595EBBF9EF44204B1049A9EC09E3211EF31BF049B80
                                                                      Function 049F7F78 Relevance: .0, Instructions: 16COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: bf9b40804e05688a4a105104e08a6d0b4e52042771b4542ed1b4b613b51d7952
                                                                      • Instruction ID: 5c4d8a81268eaca1ecf4a0e5a7352c8d51303f3c6a26dba43c7d5a82d0dbc6b7
                                                                      • Opcode Fuzzy Hash: bf9b40804e05688a4a105104e08a6d0b4e52042771b4542ed1b4b613b51d7952
                                                                      • Instruction Fuzzy Hash: 19D05E30A0520CEFCB84DFACE94196DBBF9EB84214B1041A8D809E3210EF31BF049B80
                                                                      Function 049F0440 Relevance: .0, Instructions: 10COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 058120af8dca81bf5bb99408555cd04ccf71001ddc3bfbe72fb708169e639071
                                                                      • Instruction ID: c3e2d8fbaa54af1c5180f2e172aae800daf0fae48fe703f3bfb0499b0373457d
                                                                      • Opcode Fuzzy Hash: 058120af8dca81bf5bb99408555cd04ccf71001ddc3bfbe72fb708169e639071
                                                                      • Instruction Fuzzy Hash: 6FC08CB2A907108BD2204A040480AE5F3A8EB30336B80853ECE9502000A23D302BEA28
                                                                      Function 049F3051 Relevance: .0, Instructions: 10COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000003.2040878220.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_3_49f0000_rundll32.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 0fa8cdd0a84954125ca113a9009fe8dfa19fe8f1fa1410fdc4076fa940c02cd1
                                                                      • Instruction ID: 5441ea72df79c98379b31c8741b7025c5e5cc945212ed9118bd91e33da5ee5f8
                                                                      • Opcode Fuzzy Hash: 0fa8cdd0a84954125ca113a9009fe8dfa19fe8f1fa1410fdc4076fa940c02cd1
                                                                      • Instruction Fuzzy Hash: 3AC04C36600018BBDF052A91A8049EA7F66EF95371B508035FA5985160DA354930BB90

                                                                      Execution Graph

                                                                      Execution Coverage:9.6%
                                                                      Dynamic/Decrypted Code Coverage:100%
                                                                      Signature Coverage:3.3%
                                                                      Total number of Nodes:239
                                                                      Total number of Limit Nodes:16
                                                                      execution_graph 38962 b81238 38963 b81249 38962->38963 38969 b80e69 38963->38969 38975 b80e65 38963->38975 38981 b80e24 38963->38981 38987 b80e61 38963->38987 38964 b81282 38971 b80e4e 38969->38971 38970 b80e9e 38971->38970 38993 b836b0 38971->38993 39000 b836a0 38971->39000 38972 b8133b 38972->38964 38977 b80e4e 38975->38977 38976 b80e9e 38977->38976 38979 b836b0 2 API calls 38977->38979 38980 b836a0 2 API calls 38977->38980 38978 b8133b 38978->38964 38979->38978 38980->38978 38982 b80e2d 38981->38982 38983 b80de6 38982->38983 38985 b836b0 2 API calls 38982->38985 38986 b836a0 2 API calls 38982->38986 38984 b8133b 38984->38964 38985->38984 38986->38984 38989 b80e4e 38987->38989 38988 b80e9e 38989->38988 38991 b836b0 2 API calls 38989->38991 38992 b836a0 2 API calls 38989->38992 38990 b8133b 38990->38964 38991->38990 38992->38990 38994 b836c6 38993->38994 39007 b84c62 38994->39007 38995 b836cc 38996 b83764 38995->38996 39012 b8e5d8 38995->39012 38996->38972 38997 b83739 38997->38972 39001 b836a3 39000->39001 39002 b836cc 39000->39002 39006 b84c62 RtlGetVersion 39001->39006 39003 b83764 39002->39003 39005 b8e5d8 CreateNamedPipeW 39002->39005 39003->38972 39004 b83739 39004->38972 39005->39004 39006->39002 39009 b84c90 39007->39009 39008 b84cc6 39008->38995 39009->39008 39010 b84d1d RtlGetVersion 39009->39010 39011 b84dda 39010->39011 39011->38995 39013 b8e614 39012->39013 39014 b8e62e 39012->39014 39013->39014 39017 b8eaa8 39013->39017 39021 b8ea99 39013->39021 39014->38997 39018 b8eace 39017->39018 39019 b8eb06 39018->39019 39025 b8eb50 39018->39025 39019->39014 39022 b8eaa1 39021->39022 39023 b8eb06 39022->39023 39024 b8eb50 CreateNamedPipeW 39022->39024 39023->39014 39024->39023 39026 b8eb8e 39025->39026 39033 b8f788 39026->39033 39038 b8f778 39026->39038 39027 b8edb7 39028 b8ee2f 39027->39028 39044 3970a08 39027->39044 39048 39709f8 39027->39048 39034 b8f7b3 39033->39034 39035 b8f7ac 39033->39035 39034->39027 39035->39034 39052 b8f930 39035->39052 39066 b8f920 39035->39066 39039 b8f787 39038->39039 39041 b8f6a3 39038->39041 39040 b8f7b3 39039->39040 39042 b8f930 CreateNamedPipeW 39039->39042 39043 b8f920 CreateNamedPipeW 39039->39043 39040->39027 39041->39027 39042->39040 39043->39040 39045 3970a2d 39044->39045 39046 3970510 CreateNamedPipeW 39045->39046 39047 3970a45 39046->39047 39047->39027 39049 3970a08 39048->39049 39050 3970510 CreateNamedPipeW 39049->39050 39051 3970a45 39050->39051 39051->39027 39053 b8f963 39052->39053 39055 b8f953 39052->39055 39053->39055 39059 b8f930 CreateNamedPipeW 39053->39059 39063 b8f920 CreateNamedPipeW 39053->39063 39080 b8a4b8 39053->39080 39085 b8fab8 39053->39085 39095 39748a0 39053->39095 39102 b8faab 39053->39102 39112 b8a4c8 39053->39112 39117 39748b0 39053->39117 39054 b8f95c 39054->39034 39055->39054 39064 39748b0 CreateNamedPipeW 39055->39064 39065 39748a0 CreateNamedPipeW 39055->39065 39059->39055 39063->39055 39064->39055 39065->39055 39067 b8f930 39066->39067 39069 b8a4b8 CreateNamedPipeW 39067->39069 39070 b8fab8 CreateNamedPipeW 39067->39070 39071 39748b0 CreateNamedPipeW 39067->39071 39072 b8f930 CreateNamedPipeW 39067->39072 39073 b8a4c8 CreateNamedPipeW 39067->39073 39074 b8faab CreateNamedPipeW 39067->39074 39075 39748a0 CreateNamedPipeW 39067->39075 39076 b8f920 CreateNamedPipeW 39067->39076 39079 b8f953 39067->39079 39068 b8f95c 39068->39034 39069->39079 39070->39079 39071->39079 39072->39079 39073->39079 39074->39079 39075->39079 39076->39079 39077 39748b0 CreateNamedPipeW 39077->39079 39078 39748a0 CreateNamedPipeW 39078->39079 39079->39068 39079->39077 39079->39078 39081 b8a4f9 39080->39081 39082 b8a4ed 39080->39082 39081->39082 39083 39748b0 CreateNamedPipeW 39081->39083 39084 39748a0 CreateNamedPipeW 39081->39084 39082->39055 39083->39082 39084->39082 39086 b8fadb 39085->39086 39087 b8faeb 39085->39087 39089 b8fae4 39086->39089 39124 3970040 39086->39124 39130 3970006 39086->39130 39091 b8fab8 CreateNamedPipeW 39087->39091 39092 b8faab CreateNamedPipeW 39087->39092 39093 b8f930 CreateNamedPipeW 39087->39093 39094 b8f920 CreateNamedPipeW 39087->39094 39089->39055 39091->39086 39092->39086 39093->39086 39094->39086 39097 39748e4 39095->39097 39098 39748d4 39095->39098 39096 39748dd 39096->39055 39099 b8f930 CreateNamedPipeW 39097->39099 39100 b8f920 CreateNamedPipeW 39097->39100 39098->39096 39150 39766f0 39098->39150 39099->39098 39100->39098 39103 b8fadb 39102->39103 39104 b8faeb 39102->39104 39105 b8fae4 39103->39105 39110 3970006 CreateNamedPipeW 39103->39110 39111 3970040 CreateNamedPipeW 39103->39111 39106 b8fab8 CreateNamedPipeW 39104->39106 39107 b8faab CreateNamedPipeW 39104->39107 39108 b8f930 CreateNamedPipeW 39104->39108 39109 b8f920 CreateNamedPipeW 39104->39109 39105->39055 39106->39103 39107->39103 39108->39103 39109->39103 39110->39105 39111->39105 39113 b8a4f9 39112->39113 39114 b8a4ed 39112->39114 39113->39114 39115 39748b0 CreateNamedPipeW 39113->39115 39116 39748a0 CreateNamedPipeW 39113->39116 39114->39055 39115->39114 39116->39114 39119 39748e4 39117->39119 39120 39748d4 39117->39120 39118 39748dd 39118->39055 39122 b8f930 CreateNamedPipeW 39119->39122 39123 b8f920 CreateNamedPipeW 39119->39123 39120->39118 39121 39766f0 CreateNamedPipeW 39120->39121 39121->39118 39122->39120 39123->39120 39125 397005f 39124->39125 39136 3970494 39125->39136 39141 3970510 39125->39141 39145 3970502 39125->39145 39126 39700d1 39126->39089 39131 3970040 39130->39131 39133 3970494 CreateNamedPipeW 39131->39133 39134 3970502 CreateNamedPipeW 39131->39134 39135 3970510 CreateNamedPipeW 39131->39135 39132 39700d1 39132->39089 39133->39132 39134->39132 39135->39132 39137 3970502 39136->39137 39137->39136 39138 3970536 39137->39138 39139 5131570 CreateNamedPipeW 39137->39139 39140 5131578 CreateNamedPipeW 39137->39140 39138->39126 39139->39138 39140->39138 39142 3970536 39141->39142 39143 5131570 CreateNamedPipeW 39141->39143 39144 5131578 CreateNamedPipeW 39141->39144 39142->39126 39143->39142 39144->39142 39146 3970494 39145->39146 39146->39145 39147 3970536 39146->39147 39148 5131570 CreateNamedPipeW 39146->39148 39149 5131578 CreateNamedPipeW 39146->39149 39147->39126 39148->39147 39149->39147 39151 3976705 39150->39151 39152 3970510 CreateNamedPipeW 39151->39152 39153 397674b 39152->39153 39153->39096 39154 5130110 39156 5130163 CreateProcessAsUserW 39154->39156 39157 51301f4 39156->39157 39166 5131fb0 39167 5132004 ConnectNamedPipe 39166->39167 39168 5132040 39167->39168 39168->39168 39193 51321d0 39194 51321ee 39193->39194 39196 5132207 39194->39196 39199 513232c 39194->39199 39197 513232c 2 API calls 39197->39196 39200 513233d 39199->39200 39204 54f01f0 39200->39204 39209 54f0200 39200->39209 39205 54f0200 39204->39205 39214 54f0245 39205->39214 39218 54f0250 39205->39218 39210 54f0213 39209->39210 39212 54f0245 CreateFileA 39210->39212 39213 54f0250 CreateFileA 39210->39213 39211 5132230 39211->39197 39212->39211 39213->39211 39215 54f024f CreateFileA 39214->39215 39217 54f0385 39215->39217 39221 54f02ae 39218->39221 39219 54f0323 CreateFileA 39220 54f0385 39219->39220 39221->39219 39221->39221 39226 5132e60 39227 5132e72 39226->39227 39228 5132eb6 39227->39228 39230 5132ec7 39227->39230 39232 5132efb 39230->39232 39231 5133340 39232->39231 39235 b87490 39232->39235 39240 b87481 39232->39240 39236 b874ba 39235->39236 39237 b874d5 39236->39237 39238 b8f930 CreateNamedPipeW 39236->39238 39239 b8f920 CreateNamedPipeW 39236->39239 39237->39232 39238->39237 39239->39237 39241 b874ba 39240->39241 39242 b874d5 39241->39242 39243 b8f930 CreateNamedPipeW 39241->39243 39244 b8f920 CreateNamedPipeW 39241->39244 39242->39232 39243->39242 39244->39242 39222 5130dc4 39223 5130958 39222->39223 39224 51309e5 39223->39224 39225 39766f0 CreateNamedPipeW 39223->39225 39225->39224 39158 5132398 39159 51323e0 WaitNamedPipeW 39158->39159 39160 51323da 39158->39160 39161 5132414 39159->39161 39160->39159 39162 54f29c0 39164 54f2a1a 39162->39164 39163 54f2a5c 39164->39163 39165 54f2a79 RegDisablePredefinedCache 39164->39165 39165->39163 39169 3975f28 39170 3975f5c 39169->39170 39171 3975f4c 39169->39171 39177 39764ed 39170->39177 39185 3976558 39170->39185 39172 3975f55 39171->39172 39175 39764ed CreateNamedPipeW 39171->39175 39176 3976558 CreateNamedPipeW 39171->39176 39175->39171 39176->39171 39178 39764fd 39177->39178 39180 397657b 39178->39180 39181 b8f930 CreateNamedPipeW 39178->39181 39182 b8f920 CreateNamedPipeW 39178->39182 39179 3976584 39179->39171 39180->39179 39183 b8f930 CreateNamedPipeW 39180->39183 39184 b8f920 CreateNamedPipeW 39180->39184 39181->39180 39182->39180 39183->39180 39184->39180 39186 397658b 39185->39186 39188 397657b 39185->39188 39189 b8f930 CreateNamedPipeW 39186->39189 39190 b8f920 CreateNamedPipeW 39186->39190 39187 3976584 39187->39171 39188->39187 39191 b8f930 CreateNamedPipeW 39188->39191 39192 b8f920 CreateNamedPipeW 39188->39192 39189->39188 39190->39188 39191->39188 39192->39188

                                                                      Executed Functions

                                                                      Function 00B84C62 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 109COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 135 b84c62-b84cb3 140 b84d02-b84d08 135->140 141 b84cb5-b84cc4 call b84848 135->141 144 b84d09-b84dd8 RtlGetVersion 141->144 145 b84cc6-b84ccb 141->145 150 b84dda-b84de0 144->150 151 b84de1-b84e24 144->151 157 b84cce call b852f8 145->157 158 b84cce call b852e8 145->158 146 b84cd4 146->140 150->151 155 b84e2b-b84e32 151->155 156 b84e26 151->156 156->155 157->146 158->146
                                                                      APIs
                                                                      • RtlGetVersion.NTDLL(0000009C), ref: 00B84DBE
                                                                      Strings
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3297544820.0000000000B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B80000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_b80000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID: Version
                                                                      • String ID: `Q]q$`Q]q
                                                                      • API String ID: 1889659487-3952371890
                                                                      • Opcode ID: 3894224a1fc740df599587b33d9ebb7de12354c357c6b51f81cd39b30521c126
                                                                      • Instruction ID: f54ad13357c9d880a596c71fe1ca9d2aeb451b38d55a45168727fad1edfdebb2
                                                                      • Opcode Fuzzy Hash: 3894224a1fc740df599587b33d9ebb7de12354c357c6b51f81cd39b30521c126
                                                                      • Instruction Fuzzy Hash: 5E41AF71A003199FDB60EFA8C8187AEBBF5FB45310F1044E9D508A7291DB795E88CF92
                                                                      Function 0513119C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 72pipeCOMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 380 513119c-5131952 382 5131954-5131957 380->382 383 513195a-51319bf CreateNamedPipeW 380->383 382->383 385 51319c1-51319c7 383->385 386 51319c8-51319e9 383->386 385->386
                                                                      APIs
                                                                      • CreateNamedPipeW.KERNEL32(00000000,00000001,00000008,?,?,?,00000001,00000004), ref: 051319AC
                                                                      Strings
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3306346523.0000000005130000.00000040.00000800.00020000.00000000.sdmp, Offset: 05130000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_5130000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID: CreateNamedPipe
                                                                      • String ID: 4L]q
                                                                      • API String ID: 2489174969-261793533
                                                                      • Opcode ID: 11f9a99069f52211cd08e7d0029c0d80fdcdf2fa8a5f9efcb761b727b2a7ca51
                                                                      • Instruction ID: 7292b18b6d0aedca8a14bee5d893a31fb2ab20d40b7d63b2d11d9538cabc008f
                                                                      • Opcode Fuzzy Hash: 11f9a99069f52211cd08e7d0029c0d80fdcdf2fa8a5f9efcb761b727b2a7ca51
                                                                      • Instruction Fuzzy Hash: 463105B5900248EFCB10CF9AD588A8EBFF5FF48314F14C069E959AB221D379A855CF51
                                                                      Function 05130110 Relevance: 1.6, APIs: 1, Instructions: 93processCOMMON
                                                                      Download Yara Rule
                                                                      APIs
                                                                      • CreateProcessAsUserW.KERNEL32(?,00000000,00000000,?,?,?,?,?,00000000,?,?), ref: 051301DF
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3306346523.0000000005130000.00000040.00000800.00020000.00000000.sdmp, Offset: 05130000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_5130000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID: CreateProcessUser
                                                                      • String ID:
                                                                      • API String ID: 2217836671-0
                                                                      • Opcode ID: fd43177745322beb5c1c29dcf2296ea1144672ca1f2c14709d23fd8e6f9a1d6d
                                                                      • Instruction ID: f615dbb2b5c9d0c48c7f43f75c54611d0aee59b2c84aba40a1f158df5d8fa919
                                                                      • Opcode Fuzzy Hash: fd43177745322beb5c1c29dcf2296ea1144672ca1f2c14709d23fd8e6f9a1d6d
                                                                      • Instruction Fuzzy Hash: FB41027690020ADFCB10CFA9C884ADEBBF6FF48310F14852AE918A7250D779A955CF90
                                                                      Function 039732A0 Relevance: 6.5, Strings: 5, Instructions: 246COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 0 39732a0 1 39732a2-39732b9 0->1 4 397328e-3973294 1->4 5 39732bb-39732ed 1->5 4->0 5->1 9 39732ef-397333b 5->9 15 3973343-3973356 call 3973609 9->15 17 397335e-3973395 15->17 21 3973397-39733ad 17->21 22 39733d8 17->22 25 39733b6-39733d6 21->25 26 39733af 21->26 23 39733e0-3973533 22->23 55 397353b-397353e 23->55 25->22 26->25 56 3973547-3973605 55->56
                                                                      Strings
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID: 4']q$4']q$4']q$4']q$4']q
                                                                      • API String ID: 0-4248691736
                                                                      • Opcode ID: 28c60dedbf86e1286db384b886feee8fc662843d32ed2e2df3feea9d0fcf5200
                                                                      • Instruction ID: 8c7d1105db09d20711ffd3c644fc72fe8f9effd9885b6a927da9e9b5ed58993b
                                                                      • Opcode Fuzzy Hash: 28c60dedbf86e1286db384b886feee8fc662843d32ed2e2df3feea9d0fcf5200
                                                                      • Instruction Fuzzy Hash: 70A1C0306007459FC715EF7CE5A0A8EBBE6FF84300F008A68D445DB255EB75A908CBE5
                                                                      Function 039732F0 Relevance: 6.5, Strings: 5, Instructions: 211COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 72 39732f0-3973395 call 3973609 84 3973397-39733ad 72->84 85 39733d8-397353e 72->85 88 39733b6-39733d6 84->88 89 39733af 84->89 119 3973547-3973605 85->119 88->85 89->88
                                                                      Strings
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID: 4']q$4']q$4']q$4']q$4']q
                                                                      • API String ID: 0-4248691736
                                                                      • Opcode ID: c679a36aac36a1ab639c4ebbda861cfd90de0c91252cd7ec4d17c20a3142f598
                                                                      • Instruction ID: 5381e34e479beb4d3a79f4ed13de9f27c6c7e5c38c3693eee0c09ca203f23ccd
                                                                      • Opcode Fuzzy Hash: c679a36aac36a1ab639c4ebbda861cfd90de0c91252cd7ec4d17c20a3142f598
                                                                      • Instruction Fuzzy Hash: 4F819E306007059FC719EF78E590A9EBBEAFF84300B008A6CD449DB755DB75E9088BE5
                                                                      Function 054F0245 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 119fileCOMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 304 54f0245-54f024d 305 54f024f-54f0285 304->305 306 54f0288-54f02ac 304->306 305->306 307 54f02ae-54f02d3 306->307 308 54f0300-54f0383 CreateFileA 306->308 307->308 311 54f02d5-54f02d7 307->311 315 54f038c-54f03ca 308->315 316 54f0385-54f038b 308->316 313 54f02fa-54f02fd 311->313 314 54f02d9-54f02e3 311->314 313->308 317 54f02e7-54f02f6 314->317 318 54f02e5 314->318 323 54f03cc-54f03d0 315->323 324 54f03da 315->324 316->315 317->317 319 54f02f8 317->319 318->317 319->313 323->324 325 54f03d2 323->325 326 54f03db 324->326 325->324 326->326
                                                                      APIs
                                                                      • CreateFileA.KERNEL32(?,?,?,?,?,00000001,00000004), ref: 054F036D
                                                                      Strings
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3306735851.00000000054F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_54f0000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID: CreateFile
                                                                      • String ID: 4L]q
                                                                      • API String ID: 823142352-261793533
                                                                      • Opcode ID: 2ec796d16d42f5cf3f7b3314ce665f80951ca55fc7fbc361a7c9ed478bb352b1
                                                                      • Instruction ID: b3220dbc86ff843c2275e2b22a39dc985e3980f0dcc107df85daa2ce5642aaf3
                                                                      • Opcode Fuzzy Hash: 2ec796d16d42f5cf3f7b3314ce665f80951ca55fc7fbc361a7c9ed478bb352b1
                                                                      • Instruction Fuzzy Hash: D95157B1D002488FDB14CFA9C949BDEBBF1BF48304F14816AE919AB352D7799845CF91
                                                                      Function 054F0250 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 116fileCOMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 327 54f0250-54f02ac 328 54f02ae-54f02d3 327->328 329 54f0300-54f0383 CreateFileA 327->329 328->329 332 54f02d5-54f02d7 328->332 336 54f038c-54f03ca 329->336 337 54f0385-54f038b 329->337 334 54f02fa-54f02fd 332->334 335 54f02d9-54f02e3 332->335 334->329 338 54f02e7-54f02f6 335->338 339 54f02e5 335->339 344 54f03cc-54f03d0 336->344 345 54f03da 336->345 337->336 338->338 340 54f02f8 338->340 339->338 340->334 344->345 346 54f03d2 344->346 347 54f03db 345->347 346->345 347->347
                                                                      APIs
                                                                      • CreateFileA.KERNEL32(?,?,?,?,?,00000001,00000004), ref: 054F036D
                                                                      Strings
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3306735851.00000000054F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_54f0000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID: CreateFile
                                                                      • String ID: 4L]q
                                                                      • API String ID: 823142352-261793533
                                                                      • Opcode ID: b7ab31bb03ec2ea87beef69c3ffe092d23f6b321f322b1ac495d9177311d4bd8
                                                                      • Instruction ID: 82a67e4f48e7969a370a61c0e76a11cd83a3f5c43de302171ff8bd957e52ded9
                                                                      • Opcode Fuzzy Hash: b7ab31bb03ec2ea87beef69c3ffe092d23f6b321f322b1ac495d9177311d4bd8
                                                                      • Instruction Fuzzy Hash: 134148B1D002489FDB14CFA9C948BDEBBF1FB48304F24816AE919AB352D7799845CF91
                                                                      Function 054F29C0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 91registryCOMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 348 54f29c0-54f2a4b 354 54f2a4d-54f2a5a 348->354 355 54f2a5c-54f2a74 348->355 354->355 358 54f2a79-54f2aa8 RegDisablePredefinedCache 354->358 356 54f2b36-54f2b3e 355->356 362 54f2b3f 356->362 360 54f2aaa-54f2ab0 358->360 361 54f2ab1-54f2acc call 54f2888 358->361 360->361 366 54f2ad1-54f2aed 361->366 362->362 369 54f2aef 366->369 370 54f2af8 366->370 369->370 370->356
                                                                      APIs
                                                                      • RegDisablePredefinedCache.ADVAPI32 ref: 054F2A91
                                                                      Strings
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3306735851.00000000054F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_54f0000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID: CacheDisablePredefined
                                                                      • String ID: `Q]q
                                                                      • API String ID: 1885667121-1594560043
                                                                      • Opcode ID: 09799128b005bed4ed6e76efe695136eccb8bf8fdcfba7b9165213fc0468eb07
                                                                      • Instruction ID: 85f350427b08c4ac833ffe6a37877445fd4519e25c8713197792e8f92cab65b8
                                                                      • Opcode Fuzzy Hash: 09799128b005bed4ed6e76efe695136eccb8bf8fdcfba7b9165213fc0468eb07
                                                                      • Instruction Fuzzy Hash: FD315774E002099FDB14DFA9D858BDEBBF2BF48314F14842AE805AB350DBB86845CF61
                                                                      Function 0513118F Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 81pipeCOMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 371 513118f-5131952 373 5131954-5131957 371->373 374 513195a-51319bf CreateNamedPipeW 371->374 373->374 376 51319c1-51319c7 374->376 377 51319c8-51319e9 374->377 376->377
                                                                      APIs
                                                                      • CreateNamedPipeW.KERNEL32(00000000,00000001,00000008,?,?,?,00000001,00000004), ref: 051319AC
                                                                      Strings
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3306346523.0000000005130000.00000040.00000800.00020000.00000000.sdmp, Offset: 05130000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_5130000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID: CreateNamedPipe
                                                                      • String ID: 4L]q
                                                                      • API String ID: 2489174969-261793533
                                                                      • Opcode ID: c742d766da1128587a55dbb463b8ab3b66aa814b13a8ef83f60405c392fd074d
                                                                      • Instruction ID: 4e7b26dd1f09707da463389c83a6a278c053a7278ef3e0927a710bebcf342a76
                                                                      • Opcode Fuzzy Hash: c742d766da1128587a55dbb463b8ab3b66aa814b13a8ef83f60405c392fd074d
                                                                      • Instruction Fuzzy Hash: A93136B5801249EFCB10CF9AC488ACEBFF5FF48310F14805AE958AB261D776A555CF51
                                                                      Function 0513190D Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 70pipeCOMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 389 513190d-5131952 390 5131954-5131957 389->390 391 513195a-51319bf CreateNamedPipeW 389->391 390->391 393 51319c1-51319c7 391->393 394 51319c8-51319e9 391->394 393->394
                                                                      APIs
                                                                      • CreateNamedPipeW.KERNEL32(00000000,00000001,00000008,?,?,?,00000001,00000004), ref: 051319AC
                                                                      Strings
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3306346523.0000000005130000.00000040.00000800.00020000.00000000.sdmp, Offset: 05130000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_5130000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID: CreateNamedPipe
                                                                      • String ID: 4L]q
                                                                      • API String ID: 2489174969-261793533
                                                                      • Opcode ID: 13c9f65bd4b73dfe676692f377570f568d17c8f55e3447d4b2a93f67ba806c2f
                                                                      • Instruction ID: 68a791844baa235b61f1fea3435b2f57d41716e77c52cce8d48a2bec2c503225
                                                                      • Opcode Fuzzy Hash: 13c9f65bd4b73dfe676692f377570f568d17c8f55e3447d4b2a93f67ba806c2f
                                                                      • Instruction Fuzzy Hash: 393100B6800248EFCB10CF9AD588A8EBFF5FF48314F14C069E958AB221D379A955CF51
                                                                      Function 039711F8 Relevance: 2.7, Strings: 2, Instructions: 203COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 547 39711f8-3971217 548 397121d-3971226 547->548 549 3971448-397146d 547->549 552 3971474-39714b1 548->552 553 397122c-3971290 548->553 549->552 572 3971440-3971441 call 3971446 552->572 564 3971292-39712b7 553->564 565 39712ba-39712c3 553->565 564->565 567 39712c5 565->567 568 39712c8-39712de call 39714b3 565->568 567->568 571 39712e4-39712e6 568->571 573 3971343-3971350 571->573 574 39712e8-39712ed 571->574 572->549 580 3971352-397135b 573->580 581 397135d 573->581 576 39712ef-3971324 574->576 577 3971329-397133c 574->577 589 39713e8-39713fc 576->589 577->573 584 3971362-3971364 580->584 581->584 585 3971366-3971392 584->585 586 3971399-39713e1 584->586 585->586 586->589 595 3971406-397140b 589->595 596 39713fe 589->596 597 3971415-397141a 595->597 598 397140d 595->598 596->595 599 397142f-3971430 597->599 600 397141c-397142a call 3970d7c call 3970d94 597->600 598->597 599->572 600->599
                                                                      Strings
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID: (&]q$(aq
                                                                      • API String ID: 0-1602648543
                                                                      • Opcode ID: df095ae63904184d732b95ab3f70cc38b2d594c3f2213e81ad9fcbd8dd2c0a99
                                                                      • Instruction ID: cef931456bdf7175239e3558062b27f50d9010817d6d953dc02e98bcd6cdbd43
                                                                      • Opcode Fuzzy Hash: df095ae63904184d732b95ab3f70cc38b2d594c3f2213e81ad9fcbd8dd2c0a99
                                                                      • Instruction Fuzzy Hash: 73619231F006198BDB14EBB9D4906AEBAB6EFC4740F148569D806BB3C4DF34AD42C795
                                                                      Function 05130108 Relevance: 1.6, APIs: 1, Instructions: 95processCOMMON
                                                                      Download Yara Rule
                                                                      APIs
                                                                      • CreateProcessAsUserW.KERNEL32(?,00000000,00000000,?,?,?,?,?,00000000,?,?), ref: 051301DF
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3306346523.0000000005130000.00000040.00000800.00020000.00000000.sdmp, Offset: 05130000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_5130000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID: CreateProcessUser
                                                                      • String ID:
                                                                      • API String ID: 2217836671-0
                                                                      • Opcode ID: 705eb9abe98c627353275e796b64cf442c42419cf3d417bcea6102d6b91d3670
                                                                      • Instruction ID: c01e5002e0852e2f45c15f13b0de76a59b609976f52a59f9763ed65033131e7b
                                                                      • Opcode Fuzzy Hash: 705eb9abe98c627353275e796b64cf442c42419cf3d417bcea6102d6b91d3670
                                                                      • Instruction Fuzzy Hash: B5410476900209DFCB10CFA9C984ADEBBF1FF48310F14852AE918A7250D779E955CF90
                                                                      Function 05131FA5 Relevance: 1.6, APIs: 1, Instructions: 70pipeCOMMON
                                                                      Download Yara Rule
                                                                      APIs
                                                                      • ConnectNamedPipe.KERNEL32(00000000), ref: 05132028
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3306346523.0000000005130000.00000040.00000800.00020000.00000000.sdmp, Offset: 05130000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_5130000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID: ConnectNamedPipe
                                                                      • String ID:
                                                                      • API String ID: 2191148154-0
                                                                      • Opcode ID: 97bafb7b6ad8ffa9901ae433f06f14a46ea61d9ab7e1bcd39a38e3d66bfccc6b
                                                                      • Instruction ID: b997d6510df7bc75f223e375ae665634419b40ff2bca7e138ea22715380ba89f
                                                                      • Opcode Fuzzy Hash: 97bafb7b6ad8ffa9901ae433f06f14a46ea61d9ab7e1bcd39a38e3d66bfccc6b
                                                                      • Instruction Fuzzy Hash: 2A2145B1D002589FCB24DFAAC494BDEBBF1AF08300F108069E819B7350CB799949CFA0
                                                                      Function 039719C0 Relevance: 1.6, Strings: 1, Instructions: 315COMMON
                                                                      Download Yara Rule
                                                                      Strings
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID: d
                                                                      • API String ID: 0-2564639436
                                                                      • Opcode ID: 4b1efc95679002977778fbf5c2f0563005039884b49acf3cc2935cabb52c2b99
                                                                      • Instruction ID: f092f60147da7bc35d061f50a1dd9e2ea12df6a3f82ce90a74e66157e75f9705
                                                                      • Opcode Fuzzy Hash: 4b1efc95679002977778fbf5c2f0563005039884b49acf3cc2935cabb52c2b99
                                                                      • Instruction Fuzzy Hash: E1D17174A00715CFCB04DF68D894A9AB7B9FF89310F158699E909AB365DB30EC85CF90
                                                                      Function 05131FB0 Relevance: 1.6, APIs: 1, Instructions: 65pipeCOMMON
                                                                      Download Yara Rule
                                                                      APIs
                                                                      • ConnectNamedPipe.KERNEL32(00000000), ref: 05132028
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3306346523.0000000005130000.00000040.00000800.00020000.00000000.sdmp, Offset: 05130000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_5130000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID: ConnectNamedPipe
                                                                      • String ID:
                                                                      • API String ID: 2191148154-0
                                                                      • Opcode ID: 2f6b47b84eefaf73939fdc5a546d0e733a369ed7c0816097422652b3a0f728fe
                                                                      • Instruction ID: f106ea035d39dad3a44bf0e2514a9abcf0df40a57daba6ff900a3e10c6483ae7
                                                                      • Opcode Fuzzy Hash: 2f6b47b84eefaf73939fdc5a546d0e733a369ed7c0816097422652b3a0f728fe
                                                                      • Instruction Fuzzy Hash: 9D2146B4D002189FCB24DFAAC595B9EBBF5BF08300F108069E819B7350CB799845CFA0
                                                                      Function 05132391 Relevance: 1.6, APIs: 1, Instructions: 59pipeCOMMON
                                                                      Download Yara Rule
                                                                      APIs
                                                                      • WaitNamedPipeW.KERNEL32(00000000), ref: 051323FF
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3306346523.0000000005130000.00000040.00000800.00020000.00000000.sdmp, Offset: 05130000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_5130000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID: NamedPipeWait
                                                                      • String ID:
                                                                      • API String ID: 3146367894-0
                                                                      • Opcode ID: 7c547d3fd555ac8cf21ee7163502b51533e64c087a30aaf80af2e87207df0f61
                                                                      • Instruction ID: c140264adcc962e025a943726f9088250eed4122f2b5462e09455bf82f8fee1b
                                                                      • Opcode Fuzzy Hash: 7c547d3fd555ac8cf21ee7163502b51533e64c087a30aaf80af2e87207df0f61
                                                                      • Instruction Fuzzy Hash: 2D2127B68002098FCB10DF9AC485ADEFBF4FF48314F10842DD869A7241D779A546CFA1
                                                                      Function 05132398 Relevance: 1.6, APIs: 1, Instructions: 56pipeCOMMON
                                                                      Download Yara Rule
                                                                      APIs
                                                                      • WaitNamedPipeW.KERNEL32(00000000), ref: 051323FF
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3306346523.0000000005130000.00000040.00000800.00020000.00000000.sdmp, Offset: 05130000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_5130000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID: NamedPipeWait
                                                                      • String ID:
                                                                      • API String ID: 3146367894-0
                                                                      • Opcode ID: 69e31253fb1e8a9586348293ec92f08df32c811fb7d366ca8ddfcad88ef86272
                                                                      • Instruction ID: 9588144df350a7c0778f40f1dda4f784ece1808ca4a67c5cc8f0b6c0e5f19f57
                                                                      • Opcode Fuzzy Hash: 69e31253fb1e8a9586348293ec92f08df32c811fb7d366ca8ddfcad88ef86272
                                                                      • Instruction Fuzzy Hash: 212103B68002098FCB14DF9AC545AEEFBF4FB48324F14842ED869B7241C779A945CFA5
                                                                      Function 039755C9 Relevance: 1.5, Strings: 1, Instructions: 264COMMON
                                                                      Download Yara Rule
                                                                      Strings
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID: c!
                                                                      • API String ID: 0-3867720870
                                                                      • Opcode ID: 6f9dec03e99cdfd1d2d4f0f60d036eb724bfe985405b55cc3a0f72fbd1fcbb18
                                                                      • Instruction ID: f8fd50a51efbb112df3a0a32239e76a08942dea4d1577b463c0f2fe73247d5ef
                                                                      • Opcode Fuzzy Hash: 6f9dec03e99cdfd1d2d4f0f60d036eb724bfe985405b55cc3a0f72fbd1fcbb18
                                                                      • Instruction Fuzzy Hash: 96B18C70A006059FCB15EF6CE59095EBBFAEF85300B158969E409DB365EF35EC0ACB81
                                                                      Function 03973F0A Relevance: .2, Instructions: 211COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 284055a5c85c83dffdc4a7f45569d5e1a349536d478489cc761361bb3bf0f19f
                                                                      • Instruction ID: cd65d218737d3431680409b87eac4ff0cfc8b302d4f3f6a08267ea14cbf43384
                                                                      • Opcode Fuzzy Hash: 284055a5c85c83dffdc4a7f45569d5e1a349536d478489cc761361bb3bf0f19f
                                                                      • Instruction Fuzzy Hash: B871A134B402068BCB05EBA9C85056EF7FAEFC9350B14856AD506DF3A9DB75EC028BD1
                                                                      Function 03976999 Relevance: .2, Instructions: 210COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 1f3f732629e94a92fc7e002df60afd222059943c26337e560258d389a4a2ffc6
                                                                      • Instruction ID: 7699ccd239509db5c5809d6c69c1ba0cb95de3f2e12fe1f5ae56ebde79c73b89
                                                                      • Opcode Fuzzy Hash: 1f3f732629e94a92fc7e002df60afd222059943c26337e560258d389a4a2ffc6
                                                                      • Instruction Fuzzy Hash: 3F71AF71B006158FCB14EF6CD894A6EBBEAFF88350B148569E505EB361DB34EC05CB91
                                                                      Function 03975A68 Relevance: .2, Instructions: 156COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: aff1f11dba437618dbbad394e31a834134da167bbe940bc18008e8b0d751a7f9
                                                                      • Instruction ID: 21ec644d6bc70566ce4528364344abd5875a7a37b6e48e99ce335ad3077a56f8
                                                                      • Opcode Fuzzy Hash: aff1f11dba437618dbbad394e31a834134da167bbe940bc18008e8b0d751a7f9
                                                                      • Instruction Fuzzy Hash: 5851BC307006069FCB14EB68A854A2E77EAFFC6340B198A69D015DB385EF74AC4AC7D1
                                                                      Function 039711F0 Relevance: .2, Instructions: 154COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 72e07563cda9dc736a40dd958b0903b639ffa350201fffd5dce07fc3c234c29d
                                                                      • Instruction ID: 335d35dd3a7b93b704f03209059df782b959a6ab03bad04110232398e3f889e0
                                                                      • Opcode Fuzzy Hash: 72e07563cda9dc736a40dd958b0903b639ffa350201fffd5dce07fc3c234c29d
                                                                      • Instruction Fuzzy Hash: CC518031E003198BDB14DFA5D880BDEFBF9EF88740F248129E405BB280DB74A946CB91
                                                                      Function 039748B0 Relevance: .1, Instructions: 147COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 6c3bccd24ddf3614bd1e1a80470227b716d509823eeac4b386cc470bd1b3c0bc
                                                                      • Instruction ID: c22e95a5fb263e6160ce2261c0533d82811d35187db609d00ceae292b030d53f
                                                                      • Opcode Fuzzy Hash: 6c3bccd24ddf3614bd1e1a80470227b716d509823eeac4b386cc470bd1b3c0bc
                                                                      • Instruction Fuzzy Hash: 0D511A347007058FCB24DF3AD88495AB7FAFF89350B148A69D496DB7A5EB30E805CB94
                                                                      Function 03975A41 Relevance: .1, Instructions: 147COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: bbae85feb7bbbdc4195b99d3ceddc4d4a553d8f554c424d14b032b78b2b8c2cd
                                                                      • Instruction ID: c0505a49f9dc868dfa4e4971aa79fa84138d74e28269c2d2293fc54eecf2f3e0
                                                                      • Opcode Fuzzy Hash: bbae85feb7bbbdc4195b99d3ceddc4d4a553d8f554c424d14b032b78b2b8c2cd
                                                                      • Instruction Fuzzy Hash: 7451AD307407028FCB15EB689864A2A7BEAFFC6340B198A69D015CF395EF749C49C7D1
                                                                      Function 03976558 Relevance: .1, Instructions: 130COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: bceb23b96f36fa8456bb3255a5dedbdbd24ca9557f9aebfddaa4f342b69e4270
                                                                      • Instruction ID: 8796dc91df3b60f1b79dc070f7cfeeccaffdc6e2da802386a646ce7b1db39a69
                                                                      • Opcode Fuzzy Hash: bceb23b96f36fa8456bb3255a5dedbdbd24ca9557f9aebfddaa4f342b69e4270
                                                                      • Instruction Fuzzy Hash: A141E834600B018FCB34EF29D858626B7F5BF89354B544A6DD496DB7E4DB30E906CB80
                                                                      Function 03975F28 Relevance: .1, Instructions: 117COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 07fa2c08c9874e73e7bcb4875e2e6f5542c4aa8387a9ad724dd1b128f89679e2
                                                                      • Instruction ID: 26a2bd9650834bc62abfad0f7ef2b99c0f2284317a1b021f8bd7aeb997850524
                                                                      • Opcode Fuzzy Hash: 07fa2c08c9874e73e7bcb4875e2e6f5542c4aa8387a9ad724dd1b128f89679e2
                                                                      • Instruction Fuzzy Hash: 4D4150747007018FC720DF29D884A2ABBF6FF89350B148A59D486DB3E5EB31E946CB90
                                                                      Function 0397681C Relevance: .1, Instructions: 113COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 61484ee796e280c672dc3f14abc6a4018d050f3e95b9d935131a6e7a90d3097a
                                                                      • Instruction ID: 0f72f054fe0875fbbea9ce580c731094248f0a88800f419c98ccfc1ef0f32365
                                                                      • Opcode Fuzzy Hash: 61484ee796e280c672dc3f14abc6a4018d050f3e95b9d935131a6e7a90d3097a
                                                                      • Instruction Fuzzy Hash: 2D312431A44208CFCB15CF68C961AACBBF1BF49300F194499C509EB3B2DB78AC04CB50
                                                                      Function 039746E0 Relevance: .1, Instructions: 106COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: b121d69bc6dd1868e7db92ac3c9fbcfb2d6a1625a93fb447bb4f52a1ffc500c6
                                                                      • Instruction ID: 2e5d07d94be6a2c564dbe33cfd4328a0ccacc52a84e95fe7145ba8ec8fb89022
                                                                      • Opcode Fuzzy Hash: b121d69bc6dd1868e7db92ac3c9fbcfb2d6a1625a93fb447bb4f52a1ffc500c6
                                                                      • Instruction Fuzzy Hash: 42319234F102158FCB04EBADD5519AEF7FAEFC9250B10846AD40ADB359DB34ED018BA1
                                                                      Function 03977358 Relevance: .1, Instructions: 95COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 6b9e287201777760c4e05bc15d149531c3812bc5b629328a74d2d1210c8c0fdf
                                                                      • Instruction ID: 7d0111cd46fbebb10e15c7cecbc524f254e2412bc20935fd4798fffa8687b59c
                                                                      • Opcode Fuzzy Hash: 6b9e287201777760c4e05bc15d149531c3812bc5b629328a74d2d1210c8c0fdf
                                                                      • Instruction Fuzzy Hash: F14127347006068FCB14DBA8D994D2ABBF6FF8935071885A9E45ACB3A5DB30EC05CB81
                                                                      Function 03977368 Relevance: .1, Instructions: 95COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 81cef855b860dd8cb78c9f7a413d8b7bef408aaedc108b826b0ce09201265f2b
                                                                      • Instruction ID: 74a4951fc441b9e7ef189faea6c3591477c198041210f7cc72b6cc002a8ffeac
                                                                      • Opcode Fuzzy Hash: 81cef855b860dd8cb78c9f7a413d8b7bef408aaedc108b826b0ce09201265f2b
                                                                      • Instruction Fuzzy Hash: 1B3118347006069FCB14DF69D994D2ABBFAFF8935471885A8E51ACB3A5DB30EC05CB90
                                                                      Function 03974AF8 Relevance: .1, Instructions: 92COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: edb489dd34e2c6a4aebb9e8801d1541e63dc2d0ad5c6b02729d4e6c6057c6e3f
                                                                      • Instruction ID: 817b6cae36dee8a6721f633f455567222b41a41b29b9320fa9b7376c1a8232db
                                                                      • Opcode Fuzzy Hash: edb489dd34e2c6a4aebb9e8801d1541e63dc2d0ad5c6b02729d4e6c6057c6e3f
                                                                      • Instruction Fuzzy Hash: 4131F534610B018BC734EF3AE84866ABBF5FF85751B144B2CD566876E1DB70EA48CB90
                                                                      Function 03970006 Relevance: .1, Instructions: 82COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 73cb324268ca391e037cb74f21ca7eef51aa2f3c9e15c95b6e4cdfcb4efd38f7
                                                                      • Instruction ID: c50660e1235f8be75d634ca02287182ed1a607f98bf6165ee4cd28c1e38459fc
                                                                      • Opcode Fuzzy Hash: 73cb324268ca391e037cb74f21ca7eef51aa2f3c9e15c95b6e4cdfcb4efd38f7
                                                                      • Instruction Fuzzy Hash: 4731B4316083959FCB02DB78D89195EBFB5EF8620074845EAD445DF366D734E809CBA2
                                                                      Function 0082D670 Relevance: .1, Instructions: 75COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3297037288.000000000082D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0082D000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_82d000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 74497eb653b34c9a099baf586bc1f98b25256f8734d1aa5524c473950c245117
                                                                      • Instruction ID: ab0faca361df585305f5ad1d7749dc5438e69c212e7c34a4ab43743bd056ba40
                                                                      • Opcode Fuzzy Hash: 74497eb653b34c9a099baf586bc1f98b25256f8734d1aa5524c473950c245117
                                                                      • Instruction Fuzzy Hash: E9212571504344DFCB05DF14E9C4F26BFA5FBA8314F20C569E9098B256C33AD896DBA1
                                                                      Function 03976860 Relevance: .1, Instructions: 70COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 84db820b7192e0718210d647878e866335eed20f43efd784845f53c96b5a6f63
                                                                      • Instruction ID: 137ad2f00848adeba732f1f2f80a371e37ccf78cf35ad09ab7e4e62b2a9d7a8b
                                                                      • Opcode Fuzzy Hash: 84db820b7192e0718210d647878e866335eed20f43efd784845f53c96b5a6f63
                                                                      • Instruction Fuzzy Hash: 9C213931A402198FCF18DBA8D955AEDFBF5BF88310F144469D106AB3B0CB74AC04CB90
                                                                      Function 03973609 Relevance: .1, Instructions: 66COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 549a95354258c12c893040bb2d938847a44fbc0f80a3590e6f13711664109948
                                                                      • Instruction ID: 3c8bf294c133f223d8bd9bd67a2260a0c666a344675d03ccf5744128697e4bdd
                                                                      • Opcode Fuzzy Hash: 549a95354258c12c893040bb2d938847a44fbc0f80a3590e6f13711664109948
                                                                      • Instruction Fuzzy Hash: 9421A4302406019FC718EB28E851E59BBAAFF80300F008A78E5058B6A9CB75ED19C7D5
                                                                      Function 03970BE0 Relevance: .1, Instructions: 65COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: ecbdf9b9e529b588a91b348f0871759bcd4c29786adaa6f008dceae52ed582e6
                                                                      • Instruction ID: 0748c4e3f9b51b9f3a8d8e8d32f0dd47505737062c806825e47854639328f305
                                                                      • Opcode Fuzzy Hash: ecbdf9b9e529b588a91b348f0871759bcd4c29786adaa6f008dceae52ed582e6
                                                                      • Instruction Fuzzy Hash: 07214932D10B0A9ECB01EFB9D8401EAF7B4EF99350B14C66AD598B7141FB70A2958B81
                                                                      Function 039716F1 Relevance: .1, Instructions: 65COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: fee61f3d657fb60303a24c8e6be7e6c064bfce50c58631a9c9f32c8a8133a982
                                                                      • Instruction ID: a49bc4bc50fdce977c24715e7ff91544009b0796bf732f3e794796b494ae8149
                                                                      • Opcode Fuzzy Hash: fee61f3d657fb60303a24c8e6be7e6c064bfce50c58631a9c9f32c8a8133a982
                                                                      • Instruction Fuzzy Hash: CA2114B68002499FCB11CF9AC884ADEBBF5FF88310F14852AE919A7250D339A555CFA5
                                                                      Function 03973E22 Relevance: .1, Instructions: 63COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: c2743a1bbb460787d4843ab5b25aa8ba5bb7cb6fc0b7727eadfe3048cc5298e5
                                                                      • Instruction ID: c77bc4017ba9a7eb1692ca3957fd68582419dd039f613bb842511fb36666b450
                                                                      • Opcode Fuzzy Hash: c2743a1bbb460787d4843ab5b25aa8ba5bb7cb6fc0b7727eadfe3048cc5298e5
                                                                      • Instruction Fuzzy Hash: 88218074E0060A9FCB04EFA8D8A59AEBBF5FF85300F104A64D545AB354DB306D05CBE1
                                                                      Function 039716F8 Relevance: .1, Instructions: 61COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 7027fa18242de46bd0dddea273d66fd2f94d171c6f6e9b9aa344ae77cb32cf3a
                                                                      • Instruction ID: 8adc181e51973f99f8362e7f4841c539bd73aee42f99fa0a24f0d981182c0778
                                                                      • Opcode Fuzzy Hash: 7027fa18242de46bd0dddea273d66fd2f94d171c6f6e9b9aa344ae77cb32cf3a
                                                                      • Instruction Fuzzy Hash: 5C2115B68002499FCF10CF9AC844ADEFBF5FF88350F14841AE928A7250C739A555CFA5
                                                                      Function 039718F0 Relevance: .1, Instructions: 61COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 86ec86b1dfb9ac216e4db69f532f7d66d03dbe47768b832de6a1b703420dcd5f
                                                                      • Instruction ID: 296aa23432cab8dfc3ccc121a41a0ccde6d291ede01d6ac5e0e31d29644c83f0
                                                                      • Opcode Fuzzy Hash: 86ec86b1dfb9ac216e4db69f532f7d66d03dbe47768b832de6a1b703420dcd5f
                                                                      • Instruction Fuzzy Hash: 4B1182763011108FC714D62DF8909AEB7AAFBC9324314846BE50AC7351CA32EC1BCB65
                                                                      Function 03970040 Relevance: .1, Instructions: 60COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: d13aadb9463f55c7aa5fa0c8a8278839d85b03795f34401bb3bd6a6f1bbd2d6a
                                                                      • Instruction ID: b8e2282d5ba0cecc387075bd09da6437d5710eaf714bdfcf25882af06e3f3067
                                                                      • Opcode Fuzzy Hash: d13aadb9463f55c7aa5fa0c8a8278839d85b03795f34401bb3bd6a6f1bbd2d6a
                                                                      • Instruction Fuzzy Hash: 311184317402159FCB00DFA8E8819AEBBF9FF84310B5085B9E519DB315EB34E905CBA0
                                                                      Function 039746D0 Relevance: .1, Instructions: 59COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 8b0d6053174abe24b711e1e6d2a6fe232c50c3d1e191fbefb5b70f29758659d5
                                                                      • Instruction ID: 709fdfa528f0b98b6c15e7b936a894a7928985146547000074782bd49e11c20c
                                                                      • Opcode Fuzzy Hash: 8b0d6053174abe24b711e1e6d2a6fe232c50c3d1e191fbefb5b70f29758659d5
                                                                      • Instruction Fuzzy Hash: 80116B31B102108FCB14EBBD955195DB3E9EFC5240B4588BAC019DB3BAEB34EC06C382
                                                                      Function 0082D66B Relevance: .1, Instructions: 56COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3297037288.000000000082D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0082D000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_82d000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
                                                                      • Instruction ID: 86bac8598e8f61a59a20a1a29cf69f4cb5dd82076f8e64cbcb3b04bbbfaa291e
                                                                      • Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
                                                                      • Instruction Fuzzy Hash: EE11B476504380CFCB16CF10D9C4B16BF71FB98314F24C5A9D9494B256C33AD856CBA1
                                                                      Function 03971860 Relevance: .1, Instructions: 56COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: e111bd71d6edb5965523ec21e729765c06366aa8a81a731e74af8f49db194416
                                                                      • Instruction ID: a44e09a2a532db613c296872afd08f5015640e47c6b6c12b977dec4321ad35de
                                                                      • Opcode Fuzzy Hash: e111bd71d6edb5965523ec21e729765c06366aa8a81a731e74af8f49db194416
                                                                      • Instruction Fuzzy Hash: 300124307457845FC712C769E8A09867FADEF8671030844F7D484CB366EA38E90DC7A1
                                                                      Function 03973E30 Relevance: .1, Instructions: 56COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 553e7be006d82e80a79bcfd5fd8ef9000fe344941697b2d6dc874c78368f6c7d
                                                                      • Instruction ID: 608e370ab80971649ff6d82cb1abe22d7f2af7101203ec5a423b8c584011b1f1
                                                                      • Opcode Fuzzy Hash: 553e7be006d82e80a79bcfd5fd8ef9000fe344941697b2d6dc874c78368f6c7d
                                                                      • Instruction Fuzzy Hash: A9212E74E0460A9FCB04EFA8E9A996EBBB5FF85300F104E64D545AB354DB30AD05CBE1
                                                                      Function 03976EA8 Relevance: .1, Instructions: 52COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: e373f80bdad6b2efa4afd2d58c542a98cff6c04563ceb953d8a5ecbe50eb4b69
                                                                      • Instruction ID: 5080eaabe0b21088834628dd8535ba6a4c7ff4e38c1595f46ad7811b9f78dbd2
                                                                      • Opcode Fuzzy Hash: e373f80bdad6b2efa4afd2d58c542a98cff6c04563ceb953d8a5ecbe50eb4b69
                                                                      • Instruction Fuzzy Hash: C2015235700A118F8721EF59D49491AB7EABFCC65532840A8E95ACB365DF31ED12CBD0
                                                                      Function 039766F0 Relevance: .0, Instructions: 49COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 229136f384719f5e8a78a7301b46af1a1cd10e0eaec0bae82d4a8d2c5366f275
                                                                      • Instruction ID: cdeb0859b5ffe5957413846e0eeadfbc4641980193841ea7bcf964b85aa899a8
                                                                      • Opcode Fuzzy Hash: 229136f384719f5e8a78a7301b46af1a1cd10e0eaec0bae82d4a8d2c5366f275
                                                                      • Instruction Fuzzy Hash: 5601B176A0020A9FCF00CBA8D8409EEB7F9EFC4251B048477D504E7640E730AA118BA1
                                                                      Function 03976B58 Relevance: .0, Instructions: 49COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 8529bdf4fe65c20543a02bc5fd7d2c3c2dba171149fb51e9fe8fcd1df1fd802e
                                                                      • Instruction ID: f24250c97f1c115b01cb3c2f820c6b2ee698d1b4dd8748d08430d52ee2abc92c
                                                                      • Opcode Fuzzy Hash: 8529bdf4fe65c20543a02bc5fd7d2c3c2dba171149fb51e9fe8fcd1df1fd802e
                                                                      • Instruction Fuzzy Hash: 9501B131304B145BC705F76DA45691EBADAFFC42507608A38E50ACB355DF38ED0987E6
                                                                      Function 0082D01D Relevance: .0, Instructions: 45COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3297037288.000000000082D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0082D000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_82d000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 2bf8203d11e0d49c70c719b38835a5f25c6698852c633a7379ed2d30a6a25860
                                                                      • Instruction ID: 843535b8dcedf62ff7085cfcc750807f77f90da225e26f6e619c12944e681435
                                                                      • Opcode Fuzzy Hash: 2bf8203d11e0d49c70c719b38835a5f25c6698852c633a7379ed2d30a6a25860
                                                                      • Instruction Fuzzy Hash: 02012B311047149EE7208E1ADC84B67BFDCFF45324F18C429ED488F2A6C2799C81C6B1
                                                                      Function 039741AA Relevance: .0, Instructions: 45COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: a55e25cba9156929902b589fcc2df5293b2e5ecc39a3f65f3b8f188151df2a94
                                                                      • Instruction ID: 56bf100e50780f7c56684a1061f49173ee1fd850f17a6f8423eb2cf4819a81b0
                                                                      • Opcode Fuzzy Hash: a55e25cba9156929902b589fcc2df5293b2e5ecc39a3f65f3b8f188151df2a94
                                                                      • Instruction Fuzzy Hash: A201A235B002058FCB01FBAA99500AE77F6EFE525071044ABC1069B7AAEA30D8068791
                                                                      Function 03976DB0 Relevance: .0, Instructions: 37COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: a3ba800d704848e5d9ca5fb16b07a90f2679b6281038bd81d48fec29c2004c82
                                                                      • Instruction ID: 733e2ad9d778af198150d558e66e9b4bf7d1673f01d6841caa2109a2ffbee811
                                                                      • Opcode Fuzzy Hash: a3ba800d704848e5d9ca5fb16b07a90f2679b6281038bd81d48fec29c2004c82
                                                                      • Instruction Fuzzy Hash: 33F04F326046108FC705DB69E95145DBBE6DFC5210319C8BAD009DB365EF35ED068B95
                                                                      Function 0082D01C Relevance: .0, Instructions: 36COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3297037288.000000000082D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0082D000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_82d000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: c52bfdd212bac8e02af08af7801b02059a20d5e9636c3ed3be2fcd99cd8a6344
                                                                      • Instruction ID: bd3a56338052b89deaff06cdcfd0dac42cd50b93279dbb6641307346f87e44ca
                                                                      • Opcode Fuzzy Hash: c52bfdd212bac8e02af08af7801b02059a20d5e9636c3ed3be2fcd99cd8a6344
                                                                      • Instruction Fuzzy Hash: 80F0C271104354AEE7108E1AD884B62FFD8FF56724F18C45AED488E296C2799C80CAB1
                                                                      Function 039714B3 Relevance: .0, Instructions: 36COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: d32ee72a99017618d88bb17a4a2e3b2705af6a4335a1fce988236ae5568c299f
                                                                      • Instruction ID: 02bd3fea3acaeb3ccedc2c93443d9efc68eeb0b970510f08166af5451080c07d
                                                                      • Opcode Fuzzy Hash: d32ee72a99017618d88bb17a4a2e3b2705af6a4335a1fce988236ae5568c299f
                                                                      • Instruction Fuzzy Hash: A3F09036600218AF8F05DEACEC509AE7B67EBC8360B044429FA09D7351CB3689219BA5
                                                                      Function 039778E0 Relevance: .0, Instructions: 35COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 6bdbd82c9ade95c6140cfbcb692292668707c46c41b848fc2159cdbf44ba5575
                                                                      • Instruction ID: 824607da58a420579548e13551367f14fd79883ac51dd67ecb912a21250439c3
                                                                      • Opcode Fuzzy Hash: 6bdbd82c9ade95c6140cfbcb692292668707c46c41b848fc2159cdbf44ba5575
                                                                      • Instruction Fuzzy Hash: 0BF049B19052449FC741DFB8C8115B9BBF0EF4A210B1984DAE5C9D7371E2346A19CB91
                                                                      Function 03970502 Relevance: .0, Instructions: 34COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 74e49e959c2c85d0ea0ba5ff07e04b35f1e168d39fe401479e48181cd0bdfb25
                                                                      • Instruction ID: 2125ae24f13618d052d094c5a610a91d331431f023827ab0e100d9f66f0946a1
                                                                      • Opcode Fuzzy Hash: 74e49e959c2c85d0ea0ba5ff07e04b35f1e168d39fe401479e48181cd0bdfb25
                                                                      • Instruction Fuzzy Hash: 3201C971E00219DFCB44DFADC881A9EBBF0EF49240B1484A6D919DB315E335AA56CFD0
                                                                      Function 039709F8 Relevance: .0, Instructions: 34COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 6c96d460adbe503633b4e9d69d783d5eb993a7b6f4c314d83c2c398cd45d26ed
                                                                      • Instruction ID: 37b3273ac63027db7636d4ca634524eb7c44a8dbf7d3cf3c31a83d44d7c8b8e2
                                                                      • Opcode Fuzzy Hash: 6c96d460adbe503633b4e9d69d783d5eb993a7b6f4c314d83c2c398cd45d26ed
                                                                      • Instruction Fuzzy Hash: ADF0E2796043446F8706CB5AE804C4ABFAEEFD5260718C0EBF908CB391EA30CC02C761
                                                                      Function 03971888 Relevance: .0, Instructions: 34COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 0c5d7da627bb8b2a3784edd7037b6cc840284e0ef5f485f1f5fc46ee83928dd7
                                                                      • Instruction ID: 99b21f7faabf2a0b40187464a2ce338f73ff6686e80fc3907e009bf88f3ca8e3
                                                                      • Opcode Fuzzy Hash: 0c5d7da627bb8b2a3784edd7037b6cc840284e0ef5f485f1f5fc46ee83928dd7
                                                                      • Instruction Fuzzy Hash: E5F0E2707407046BC625D65EB89085BBBCEEFC4B50704846AE189C7304EE74E809C7D0
                                                                      Function 039717B8 Relevance: .0, Instructions: 33COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: e9d87e94453b213053652749d22fe6da0992070e41848540c2d9e8393ad0e8ab
                                                                      • Instruction ID: cc2e91ae35fe1968c5ea7e14f23f3431e28ec517b5703573d694be5a70d07ee3
                                                                      • Opcode Fuzzy Hash: e9d87e94453b213053652749d22fe6da0992070e41848540c2d9e8393ad0e8ab
                                                                      • Instruction Fuzzy Hash: BBF0E5317452195FC721D629DC90A83B7AEEFCA724B5508FAD048CB356DE32AC4BCB61
                                                                      Function 03974CC0 Relevance: .0, Instructions: 32COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 56a0bae38b6b5d4b8fda24ba10c028acb58157a9787c234d0d83503547f0532b
                                                                      • Instruction ID: b05be637f1957dc31f9204157e63d2dfd84416e98847d4aa778404b3fdfe41e4
                                                                      • Opcode Fuzzy Hash: 56a0bae38b6b5d4b8fda24ba10c028acb58157a9787c234d0d83503547f0532b
                                                                      • Instruction Fuzzy Hash: 3BF0CDB1E8024ECFCF10DF69E8247AEBBB8EB40312F024866C60097295CB7465198B82
                                                                      Function 03977877 Relevance: .0, Instructions: 31COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 925da609e8d8c65f5140c047312b6d534c512f3092a84673cb33f27f9dc96ef6
                                                                      • Instruction ID: 793f4e6a2685ff88842e5bd45625d116037fbc03618135901746e33f94dfc0f5
                                                                      • Opcode Fuzzy Hash: 925da609e8d8c65f5140c047312b6d534c512f3092a84673cb33f27f9dc96ef6
                                                                      • Instruction Fuzzy Hash: AAF0903044E7859FC703DBB4D9595887FB0EF43214B1942D7C090CF1A2CA241E1ACB92
                                                                      Function 0397054A Relevance: .0, Instructions: 30COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 64fa0211aa559c843d8fdc200b9e19ca6fbd90237c50befd45d0610d4e022b1c
                                                                      • Instruction ID: f4700917b966f1b39b2415b89038933af0a5547a3e05ee63a8012f88a07f5f07
                                                                      • Opcode Fuzzy Hash: 64fa0211aa559c843d8fdc200b9e19ca6fbd90237c50befd45d0610d4e022b1c
                                                                      • Instruction Fuzzy Hash: 44F05E30740118CFC714DF69C554AAEB7E5EF88750B0580A5EC05CB3A8EB35DE01CB80
                                                                      Function 03970A08 Relevance: .0, Instructions: 30COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 456c8511b23e178587c3185ccfc9d31bb36cb0ef4cc528f05c5db60dcdee5be0
                                                                      • Instruction ID: 3a2a3240bbfcab65cae8f5d35b0f3da61eeb8dd4938af0e60b7622efff964bde
                                                                      • Opcode Fuzzy Hash: 456c8511b23e178587c3185ccfc9d31bb36cb0ef4cc528f05c5db60dcdee5be0
                                                                      • Instruction Fuzzy Hash: A5E065797042186F4744DA9ED400D5BFBAEDFC8260718C057F908C7344DA31DD128764
                                                                      Function 03977121 Relevance: .0, Instructions: 30COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 1bedd17b1f8d042cbe42fde20e094cffea70a77b6de59963bb2749f47a9cb857
                                                                      • Instruction ID: 55750012716a05a923025d85c57fa7237d8887ba12954d6b059898bcb76e9d64
                                                                      • Opcode Fuzzy Hash: 1bedd17b1f8d042cbe42fde20e094cffea70a77b6de59963bb2749f47a9cb857
                                                                      • Instruction Fuzzy Hash: D8F05E31300740CFC314CB69D984A66BBE6AFC6711B0984ADE486CB7A1CB71EC42CB50
                                                                      Function 03974CB0 Relevance: .0, Instructions: 29COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 7367a00982d0bda225f658c8f7ec8f84e2ab465cc86725e6a433fc10a7852eb0
                                                                      • Instruction ID: 4732c00901f5d4e613f931740d3a4c46bef17d89187196b754d5c9f53f9bcb09
                                                                      • Opcode Fuzzy Hash: 7367a00982d0bda225f658c8f7ec8f84e2ab465cc86725e6a433fc10a7852eb0
                                                                      • Instruction Fuzzy Hash: ECF0C87194528ACFDF15DF74D5247993F78EF41311F06499AC4619B1E6C7345408CB42
                                                                      Function 03970510 Relevance: .0, Instructions: 27COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 775f0797d92be20b51330f9044027e731cbfd8e192d0809dcd247105a0cd32da
                                                                      • Instruction ID: e8e262b41c50a357c1ef3fcedd7061e92d94721de34c8c856271d63e1eee18ab
                                                                      • Opcode Fuzzy Hash: 775f0797d92be20b51330f9044027e731cbfd8e192d0809dcd247105a0cd32da
                                                                      • Instruction Fuzzy Hash: E5F0D471E00219DF8B44DFADC84069EFBF5EF49200B24C46AD918E7210E331AA12CFC0
                                                                      Function 03976E21 Relevance: .0, Instructions: 26COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: a053c3453d2230a3a6cda184a4454a5992f2d99f9e9f65d41da175a5dfee3ac5
                                                                      • Instruction ID: f0b896a7de2795043e8c67f1f14f7549a59a28516bb36c2dc6777c674a362bf9
                                                                      • Opcode Fuzzy Hash: a053c3453d2230a3a6cda184a4454a5992f2d99f9e9f65d41da175a5dfee3ac5
                                                                      • Instruction Fuzzy Hash: 65F015B2D01119DFCB40DFACDC4669DFBF4EF48200B2480A9C918E7211E231AA128FD1
                                                                      Function 03977130 Relevance: .0, Instructions: 25COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: dbd4d3785898967d91d3ff5d6015e346208c1c7fbf5a2b8da0f71c4d2e2fece6
                                                                      • Instruction ID: 49fb541ec5e02f79b4755a753859deaa270f9e0d3bac07ef55550cb20a916c4a
                                                                      • Opcode Fuzzy Hash: dbd4d3785898967d91d3ff5d6015e346208c1c7fbf5a2b8da0f71c4d2e2fece6
                                                                      • Instruction Fuzzy Hash: 19E06D303406048FC314DB59D544D16BBEAEFC5715B1584A9E5498B7A1CB71EC41CB90
                                                                      Function 039717C8 Relevance: .0, Instructions: 25COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 7a4e4eb67ffad287642978894f8494f27cd7aeb9d6d55a9f9a6a64b530a7a8ea
                                                                      • Instruction ID: ccab24a61dea1414929df4640274ecee8d1c6c1cdcb5c2cc38070fcccc452812
                                                                      • Opcode Fuzzy Hash: 7a4e4eb67ffad287642978894f8494f27cd7aeb9d6d55a9f9a6a64b530a7a8ea
                                                                      • Instruction Fuzzy Hash: F3E026327012041BC324A52EE850957B3AEEBC8324F1008BCE10CC7312CD329C47CA90
                                                                      Function 03972E71 Relevance: .0, Instructions: 24COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: b479bc561be47b926c11befbdd785f58ed8dbfa8e09bf534b7cc695905597310
                                                                      • Instruction ID: 3902d2fded7b9767287e2e062a57cb271775eb2e0ea4c433e96d0eac88dc89d5
                                                                      • Opcode Fuzzy Hash: b479bc561be47b926c11befbdd785f58ed8dbfa8e09bf534b7cc695905597310
                                                                      • Instruction Fuzzy Hash: BEE01B30901508EFCB05DF78E981AACB7B5EF8530171086D9D504DB215D7356E15EB50
                                                                      Function 03976790 Relevance: .0, Instructions: 20COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 11053c88d8a2dd40a802d8ee08c053b886802ca8224841ac3df66e9145be7e36
                                                                      • Instruction ID: ec759e2330872c6e2cf8a9ea40198d11bc68c11625c7db1bc5542757d32a4615
                                                                      • Opcode Fuzzy Hash: 11053c88d8a2dd40a802d8ee08c053b886802ca8224841ac3df66e9145be7e36
                                                                      • Instruction Fuzzy Hash: F9E072383A02008FCB81E7B8C40481D37E2AFC922030484ABC04DDF371DA30AC028BA2
                                                                      Function 03976E30 Relevance: .0, Instructions: 20COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: fa926553dbea9c7a5430891b9108979a3f16cc4d36da4f487aa00aa9d94c7079
                                                                      • Instruction ID: 4700d3dab2d715e59f068a7f6128bd0cc374fc7bc7bcb843139fe929dc3b1599
                                                                      • Opcode Fuzzy Hash: fa926553dbea9c7a5430891b9108979a3f16cc4d36da4f487aa00aa9d94c7079
                                                                      • Instruction Fuzzy Hash: BEE0B671D002299F8B80EFADD9015AEFBF4EF48210B10846AD91CE7201E3319B128FD1
                                                                      Function 03972A32 Relevance: .0, Instructions: 19COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 451a78adbee34d077c63a06f5025193a15b3f7706b44399066c30787ea8128c9
                                                                      • Instruction ID: 05d1cbe98740efb127aa3f3cf98f621ceb9a0d5d73304afc490a72dc55718031
                                                                      • Opcode Fuzzy Hash: 451a78adbee34d077c63a06f5025193a15b3f7706b44399066c30787ea8128c9
                                                                      • Instruction Fuzzy Hash: 36E0EC3AB50505CFEB24CB58D44059A73F9EB8C255F1448A1D506D72A4D631DD15CA10
                                                                      Function 039767A0 Relevance: .0, Instructions: 18COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 534923adb21938164fb317321946e24bf654dd753ff1eb143d100d5c56ad9ab2
                                                                      • Instruction ID: 5fa4908d1112f85e1918938e73204389d9b5e4cf4f640f2d465afec5feef4fb1
                                                                      • Opcode Fuzzy Hash: 534923adb21938164fb317321946e24bf654dd753ff1eb143d100d5c56ad9ab2
                                                                      • Instruction Fuzzy Hash: D2D05E343601144FCB94E738D44486E73DAAF8862439040B4D40DCB321EE60EC0147D1
                                                                      Function 03970BA0 Relevance: .0, Instructions: 16COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 8c7bf5afcee3d591d750e22acfc65d95bddeca078731ccff4ec78b3a221944d6
                                                                      • Instruction ID: 566ad4b1e457cb3fac5d20245b5b72d7f30576e59be016cb156fc816978f9414
                                                                      • Opcode Fuzzy Hash: 8c7bf5afcee3d591d750e22acfc65d95bddeca078731ccff4ec78b3a221944d6
                                                                      • Instruction Fuzzy Hash: 51E0C230508749CECB01EBB4C554498BFB0EE87300B05CA8FD489AB172EB309584DB92
                                                                      Function 03972A44 Relevance: .0, Instructions: 16COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: a608b441fa3b20541d6b09a782b598b99e2538d0279e8bea3b77494b251f4b04
                                                                      • Instruction ID: 7dc7fdeb8278aa7ae427577f2ac45070086dddcf839bb0b13e136cef34b2042f
                                                                      • Opcode Fuzzy Hash: a608b441fa3b20541d6b09a782b598b99e2538d0279e8bea3b77494b251f4b04
                                                                      • Instruction Fuzzy Hash: A0D09E3AB40515CF9B14CB59E48049973F5EB8C25571445A1E519D7364D731DD16CA40
                                                                      Function 03972E80 Relevance: .0, Instructions: 16COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 001a6fe6399df8ab2217505f7e6741da3c285b77808c52388894267afd59a447
                                                                      • Instruction ID: e263097b690e95c3d904f5c5f97721e7744c0a25a487b067e8737476a139987f
                                                                      • Opcode Fuzzy Hash: 001a6fe6399df8ab2217505f7e6741da3c285b77808c52388894267afd59a447
                                                                      • Instruction Fuzzy Hash: 95D01770A0110CEF8B04EFA8E94195DBBB9EB45202B1045EAE808E3200EA316F18AB91
                                                                      Function 039778A0 Relevance: .0, Instructions: 16COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 1faf866033264efc5142b4fdf7c7e32ad2df3ecc3403b36a182cef1bc0caeff7
                                                                      • Instruction ID: d767d55e69ef92cdd670f945441ef7e85204313d46e78430970498486e42c02b
                                                                      • Opcode Fuzzy Hash: 1faf866033264efc5142b4fdf7c7e32ad2df3ecc3403b36a182cef1bc0caeff7
                                                                      • Instruction Fuzzy Hash: 71D01770A4020CEF8F00EFA8E90195EB7F9EB44200F1046A8D809DB200EA316F08AB91
                                                                      Function 0397676A Relevance: .0, Instructions: 13COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 0425f101f8673fcdc359708d2cc49fd8422e9969b6b41256de2f24d0308e0a7b
                                                                      • Instruction ID: 086c78d4fd16495830928e152953b3a8680f500f96d84220b2513e59b8041314
                                                                      • Opcode Fuzzy Hash: 0425f101f8673fcdc359708d2cc49fd8422e9969b6b41256de2f24d0308e0a7b
                                                                      • Instruction Fuzzy Hash: F9D09E74609180DFC305CB64D956814FBB1AF8621031EC5CAC9584F367D727ED53CB81
                                                                      Function 03970BB0 Relevance: .0, Instructions: 12COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: f5cfa2fe3bc87a63d65f47328fa7fab1114ebddb3b07f4e0b90618e5900fcfa0
                                                                      • Instruction ID: dd6e0296aa2dd3ace7b605adc560b007538275d6b904d8445caa9e011de9d717
                                                                      • Opcode Fuzzy Hash: f5cfa2fe3bc87a63d65f47328fa7fab1114ebddb3b07f4e0b90618e5900fcfa0
                                                                      • Instruction Fuzzy Hash: BAD0C73151470DC9C700BBB8D454469F778EED5200F00C75AE84967121FF70D5D0D681
                                                                      Function 0397FF99 Relevance: .0, Instructions: 12COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 320b11e6641a7ce494bb6cf4f17a892023ac689ed0b9ebf37c6f0597633caa49
                                                                      • Instruction ID: 483c9b1afe27991ffbd0c83902ed928f6bc3bc3f1ed3f4d2a9a1da735fb06b1a
                                                                      • Opcode Fuzzy Hash: 320b11e6641a7ce494bb6cf4f17a892023ac689ed0b9ebf37c6f0597633caa49
                                                                      • Instruction Fuzzy Hash: 06D0C9353116418BCA78DA29E290A56FB91AF85314718C84C94AE8BB56CB76F843CF80
                                                                      Function 03974C50 Relevance: .0, Instructions: 7COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3303872264.0000000003970000.00000040.00000800.00020000.00000000.sdmp, Offset: 03970000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_3970000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: d0e5629bb3698a4d61d361d811974b37fd9fcca706493c7aa88cf28eeba23fcd
                                                                      • Instruction ID: f22e430781786bb655a0cbdf5749385cdb65c77a25a18d6042c2d4d14d162c2c
                                                                      • Opcode Fuzzy Hash: d0e5629bb3698a4d61d361d811974b37fd9fcca706493c7aa88cf28eeba23fcd
                                                                      • Instruction Fuzzy Hash: BAB0920215E3E00DCA43D2280838B4A3E904BC3002FCF40E898E54F162C4085114E3B1

                                                                      Non-executed Functions

                                                                      Function 00B8D588 Relevance: 2.9, Strings: 2, Instructions: 372COMMON
                                                                      Download Yara Rule
                                                                      Strings
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.3297544820.0000000000B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B80000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_b80000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID: Haq$Haq
                                                                      • API String ID: 0-4016896955
                                                                      • Opcode ID: c8d512886f9fc3280090aea6e21079fdf91c5d4e8b6f585025729bbd92ff3e9d
                                                                      • Instruction ID: b1dbf40205feea0979cfe21e39f7631691b2c2f4c425d2c117436c6f725d37c4
                                                                      • Opcode Fuzzy Hash: c8d512886f9fc3280090aea6e21079fdf91c5d4e8b6f585025729bbd92ff3e9d
                                                                      • Instruction Fuzzy Hash: 0DE16F31D1065A8FCF01DFA8C8405DDFBB1FF99300F25869AE415BB251EB34AA86CB91

                                                                      Execution Graph

                                                                      Execution Coverage:13.2%
                                                                      Dynamic/Decrypted Code Coverage:100%
                                                                      Signature Coverage:0%
                                                                      Total number of Nodes:8
                                                                      Total number of Limit Nodes:1
                                                                      execution_graph 11168 7ff848a88014 11170 7ff848a8801d 11168->11170 11169 7ff848a88082 11170->11169 11171 7ff848a880f6 SetProcessMitigationPolicy 11170->11171 11172 7ff848a88152 11171->11172 11173 7ff848a83642 11174 7ff848aa5850 CreateNamedPipeW 11173->11174 11176 7ff848aa5983 11174->11176

                                                                      Executed Functions

                                                                      Function 00007FF848D95C31 Relevance: 1.1, Instructions: 1146COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 482 7ff848d95c31-7ff848d95c64 call 7ff848d943b0 call 7ff848d90c30 * 2 490 7ff848d95c6a-7ff848d95c78 482->490 491 7ff848d969fe-7ff848d96a11 482->491 493 7ff848d95c7a-7ff848d95c7c 490->493 494 7ff848d95c7e-7ff848d95c8d call 7ff848d900e0 490->494 495 7ff848d95c90-7ff848d95c92 493->495 494->495 498 7ff848d95dd2-7ff848d95dd5 495->498 499 7ff848d95c98-7ff848d95cb4 495->499 500 7ff848d95f10-7ff848d95f17 498->500 501 7ff848d95ddb-7ff848d95de6 498->501 499->498 519 7ff848d95cba-7ff848d95ccc 499->519 502 7ff848d95fa7-7ff848d95fae 500->502 503 7ff848d95f1d-7ff848d95f24 500->503 504 7ff848d95e32-7ff848d95e41 501->504 505 7ff848d95de8-7ff848d95e05 501->505 510 7ff848d95fb0-7ff848d95fb7 502->510 511 7ff848d95fb9-7ff848d95fcc 502->511 503->502 508 7ff848d95f2a-7ff848d95f34 503->508 504->500 512 7ff848d96a1b-7ff848d96a2c 505->512 513 7ff848d95e0b-7ff848d95e30 505->513 515 7ff848d95ff6-7ff848d95ffd 508->515 522 7ff848d95f3a-7ff848d95f4e 508->522 510->511 510->515 528 7ff848d95fdd-7ff848d95fe5 511->528 529 7ff848d95fce-7ff848d95fd3 511->529 555 7ff848d96a2d-7ff848d96a35 512->555 513->504 516 7ff848d96261-7ff848d96268 515->516 517 7ff848d96003-7ff848d9600a 515->517 516->491 526 7ff848d9626e-7ff848d96275 516->526 517->516 521 7ff848d96010-7ff848d96013 517->521 524 7ff848d95d1a-7ff848d95d2a 519->524 525 7ff848d95cce-7ff848d95ceb 519->525 533 7ff848d96015-7ff848d96017 521->533 534 7ff848d9601c-7ff848d9602a 521->534 541 7ff848d95cf1-7ff848d95d18 525->541 542 7ff848d96a12-7ff848d96a1a 525->542 526->491 538 7ff848d9627b-7ff848d9628d 526->538 530 7ff848d96a51-7ff848d96af1 528->530 531 7ff848d95feb-7ff848d95fef 528->531 529->528 531->515 540 7ff848d960ca-7ff848d960cd 533->540 556 7ff848d9602c 534->556 557 7ff848d9602e 534->557 543 7ff848d962d9-7ff848d962fe 538->543 544 7ff848d9628f-7ff848d9629a 538->544 549 7ff848d960d6-7ff848d960e4 540->549 550 7ff848d960cf-7ff848d960d1 540->550 541->524 542->512 569 7ff848d963a1-7ff848d963a7 543->569 570 7ff848d96304-7ff848d9631c 543->570 544->543 574 7ff848d960e6 549->574 575 7ff848d960e8 549->575 559 7ff848d96185-7ff848d9618b 550->559 579 7ff848d96a36-7ff848d96a47 555->579 564 7ff848d96030-7ff848d96033 556->564 557->564 560 7ff848d96191-7ff848d96193 559->560 561 7ff848d9623d-7ff848d9623f 559->561 560->561 566 7ff848d96199-7ff848d961ce 560->566 561->516 571 7ff848d96241-7ff848d96249 561->571 572 7ff848d96035-7ff848d9603b 564->572 573 7ff848d9603d-7ff848d96048 564->573 569->491 581 7ff848d963ad-7ff848d963b5 569->581 570->569 601 7ff848d96322-7ff848d96384 570->601 571->516 580 7ff848d9624b-7ff848d9625d 571->580 582 7ff848d960b8-7ff848d960c8 572->582 583 7ff848d96094-7ff848d960b5 573->583 584 7ff848d9604a-7ff848d96067 573->584 576 7ff848d960ea-7ff848d960ed 574->576 575->576 586 7ff848d960f7-7ff848d96102 576->586 587 7ff848d960ef-7ff848d960f5 576->587 616 7ff848d96a48-7ff848d96a50 579->616 580->516 592 7ff848d963b7-7ff848d963f6 581->592 593 7ff848d963fd-7ff848d96405 581->593 582->540 583->582 584->555 594 7ff848d9606d-7ff848d96092 584->594 596 7ff848d96104-7ff848d96121 586->596 597 7ff848d9614e-7ff848d96170 586->597 595 7ff848d96173-7ff848d96183 587->595 592->593 593->491 599 7ff848d9640b-7ff848d965cc 593->599 594->583 595->559 596->579 610 7ff848d96127-7ff848d9614c 596->610 597->595 660 7ff848d965d3-7ff848d9666a 599->660 601->569 610->597 616->530 664 7ff848d96670-7ff848d96671 660->664 665 7ff848d9666c-7ff848d9666e 660->665 666 7ff848d96678-7ff848d96685 664->666 665->666 667 7ff848d96687-7ff848d9669f 666->667 668 7ff848d966bb 666->668 673 7ff848d966a1-7ff848d966b6 667->673 674 7ff848d966bd 667->674 669 7ff848d966bf-7ff848d966c2 668->669 671 7ff848d966c4-7ff848d966d1 669->671 672 7ff848d966d5-7ff848d966d8 669->672 671->672 678 7ff848d966d3 671->678 676 7ff848d966e2-7ff848d9670b 672->676 677 7ff848d966da-7ff848d966db 672->677 673->660 674->669 683 7ff848d96712-7ff848d967a9 676->683 677->676 678->672 687 7ff848d967ab-7ff848d967ad 683->687 688 7ff848d967af-7ff848d967b0 683->688 689 7ff848d967b7-7ff848d967c4 687->689 688->689 690 7ff848d967c6-7ff848d967de 689->690 691 7ff848d967fa 689->691 699 7ff848d967e0-7ff848d967f5 690->699 700 7ff848d967fc 690->700 692 7ff848d967fe-7ff848d96801 691->692 693 7ff848d96803-7ff848d96810 692->693 694 7ff848d96814-7ff848d96817 692->694 693->694 701 7ff848d96812 693->701 697 7ff848d96821-7ff848d9687f call 7ff848d954a0 694->697 698 7ff848d96819-7ff848d9681a 694->698 708 7ff848d968f0-7ff848d96902 697->708 709 7ff848d96881-7ff848d96884 697->709 698->697 699->683 700->692 701->694 710 7ff848d96905-7ff848d9690c 708->710 709->710 711 7ff848d96886-7ff848d968c8 call 7ff848d956a0 call 7ff848d956b0 call 7ff848d954b0 709->711 710->616 713 7ff848d9690d-7ff848d9692f 710->713 721 7ff848d96933-7ff848d96937 711->721 726 7ff848d968ca-7ff848d968ed 711->726 713->721 723 7ff848d96939-7ff848d96948 721->723 723->491 726->723 727 7ff848d968ef 726->727 727->708
                                                                      Memory Dump Source
                                                                      • Source File: 00000008.00000002.3305958853.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_8_2_7ff848d90000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: ecee9f68d1d8459c03ea40db6487b9b74ec09a6dbb37b675412dd70d882ec4cd
                                                                      • Instruction ID: d1d2684834d4a02791f9976da6d13af7fcc7ee97b5cd62fe270b418e601c88db
                                                                      • Opcode Fuzzy Hash: ecee9f68d1d8459c03ea40db6487b9b74ec09a6dbb37b675412dd70d882ec4cd
                                                                      • Instruction Fuzzy Hash: BC722330A0EA4A8FEB98FB28A8557B937D1FF94784F1401B9D40DC7297DF28A8498745
                                                                      Function 00007FF848D96E8B Relevance: .5, Instructions: 516COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 956 7ff848d96e8b-7ff848d96e9c 958 7ff848d96ee6-7ff848d96ef6 956->958 959 7ff848d96e9e-7ff848d96eba 956->959 966 7ff848d96ef8-7ff848d96efa 958->966 967 7ff848d96efc-7ff848d96f0a call 7ff848d900e0 958->967 960 7ff848d96ec0-7ff848d96ede call 7ff848d90c30 * 2 959->960 961 7ff848d972c8-7ff848d972e6 call 7ff848d90c30 * 2 959->961 979 7ff848d96ee4-7ff848d96ee5 960->979 980 7ff848d9715e-7ff848d9717c call 7ff848d90c30 * 2 960->980 976 7ff848d973f2-7ff848d973fd 961->976 977 7ff848d972ec-7ff848d972f3 961->977 970 7ff848d96f0d-7ff848d96f22 966->970 967->970 983 7ff848d96f24-7ff848d96f26 970->983 984 7ff848d96f28-7ff848d96f4c call 7ff848d95770 * 2 970->984 981 7ff848d972f5-7ff848d97304 977->981 982 7ff848d97306-7ff848d97308 977->982 979->958 1000 7ff848d971a6-7ff848d971c4 call 7ff848d90c30 * 2 980->1000 1001 7ff848d9717e-7ff848d97188 980->1001 981->982 993 7ff848d9730a 981->993 988 7ff848d9730f-7ff848d97329 982->988 986 7ff848d96f4f-7ff848d96f64 983->986 984->986 1002 7ff848d96f66-7ff848d96f68 986->1002 1003 7ff848d96f6a-7ff848d96f8e call 7ff848d95770 * 2 986->1003 999 7ff848d9732d-7ff848d97333 988->999 993->988 1005 7ff848d97335-7ff848d97352 999->1005 1006 7ff848d9737f-7ff848d9738d 999->1006 1028 7ff848d971ca-7ff848d971d5 1000->1028 1029 7ff848d9727b 1000->1029 1007 7ff848d9718a-7ff848d9719a 1001->1007 1008 7ff848d9719c 1001->1008 1009 7ff848d96f91-7ff848d96fa6 1002->1009 1003->1009 1018 7ff848d97358-7ff848d9737d 1005->1018 1019 7ff848d973fe-7ff848d97463 1005->1019 1006->976 1006->999 1015 7ff848d9719e-7ff848d9719f 1007->1015 1008->1015 1023 7ff848d96fa8-7ff848d96faa 1009->1023 1024 7ff848d96fac-7ff848d96fd0 call 7ff848d95770 1009->1024 1015->1000 1018->1006 1026 7ff848d96fd3-7ff848d96fe1 1023->1026 1024->1026 1043 7ff848d96fe3-7ff848d96fe5 1026->1043 1044 7ff848d96fe7-7ff848d96ff5 call 7ff848d900e0 1026->1044 1041 7ff848d971d7-7ff848d971d9 1028->1041 1042 7ff848d971db-7ff848d971ea call 7ff848d900e0 1028->1042 1034 7ff848d9727c-7ff848d97286 1029->1034 1045 7ff848d97288-7ff848d9728a 1034->1045 1046 7ff848d9728c-7ff848d9729b call 7ff848d900e0 1034->1046 1047 7ff848d971ed-7ff848d9721d 1041->1047 1042->1047 1049 7ff848d96ff8-7ff848d97001 1043->1049 1044->1049 1051 7ff848d9729e-7ff848d972a0 1045->1051 1046->1051 1047->1034 1059 7ff848d9721f-7ff848d97221 1047->1059 1063 7ff848d97008-7ff848d9700f 1049->1063 1051->976 1058 7ff848d972a6-7ff848d972c7 1051->1058 1059->1029 1060 7ff848d97223-7ff848d97228 1059->1060 1062 7ff848d9722b-7ff848d97231 1060->1062 1065 7ff848d97233-7ff848d9723b 1062->1065 1066 7ff848d97244-7ff848d9724c 1062->1066 1063->980 1067 7ff848d97015-7ff848d9701c 1063->1067 1068 7ff848d9724d-7ff848d9724e 1065->1068 1069 7ff848d9723d-7ff848d97242 1065->1069 1066->1068 1070 7ff848d9725e-7ff848d97279 1066->1070 1067->980 1071 7ff848d97022-7ff848d97039 1067->1071 1073 7ff848d97253-7ff848d9725d call 7ff848d96b08 1068->1073 1069->1073 1070->1029 1070->1062 1078 7ff848d9703b-7ff848d9704d 1071->1078 1079 7ff848d9706e-7ff848d97079 1071->1079 1073->1070 1085 7ff848d97053-7ff848d97061 call 7ff848d900e0 1078->1085 1086 7ff848d9704f-7ff848d97051 1078->1086 1083 7ff848d9707b-7ff848d9707d 1079->1083 1084 7ff848d9707f-7ff848d9708e call 7ff848d900e0 1079->1084 1087 7ff848d97091-7ff848d97093 1083->1087 1084->1087 1089 7ff848d97064-7ff848d97067 1085->1089 1086->1089 1092 7ff848d97148-7ff848d9715a 1087->1092 1093 7ff848d97099-7ff848d970b0 1087->1093 1089->1079 1092->980 1093->1092 1097 7ff848d970b6-7ff848d970d3 1093->1097 1100 7ff848d970d5-7ff848d970dd 1097->1100 1101 7ff848d970df 1097->1101 1102 7ff848d970e1-7ff848d970e3 1100->1102 1101->1102 1102->1092 1104 7ff848d970e5-7ff848d970ef 1102->1104 1105 7ff848d970f1-7ff848d970fb call 7ff848d93d60 1104->1105 1106 7ff848d970fd-7ff848d97105 1104->1106 1105->980 1105->1106 1108 7ff848d97133-7ff848d97146 call 7ff848d95780 1106->1108 1109 7ff848d97107-7ff848d9712c call 7ff848d955c8 1106->1109 1108->980 1109->1108
                                                                      Memory Dump Source
                                                                      • Source File: 00000008.00000002.3305958853.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_8_2_7ff848d90000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 13b49129700d670e332e5b58b7bdfa93e7ceab80292d3bb3d3693cc8c55f8f8a
                                                                      • Instruction ID: e5f203eba78e39ce432229b527e0aa0fb9ae50d5bcb116167734dcf96e3c7522
                                                                      • Opcode Fuzzy Hash: 13b49129700d670e332e5b58b7bdfa93e7ceab80292d3bb3d3693cc8c55f8f8a
                                                                      • Instruction Fuzzy Hash: 3EF1B331E1EA1B8FE799FB2894557B962D2EF94388F544079D40EC32C2DF28B8498359
                                                                      Function 00007FF848A88014 Relevance: 1.7, APIs: 1, Instructions: 174COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      APIs
                                                                      Memory Dump Source
                                                                      • Source File: 00000008.00000002.3302735476.00007FF848A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848A80000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_8_2_7ff848a80000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID: MitigationPolicyProcess
                                                                      • String ID:
                                                                      • API String ID: 1088084561-0
                                                                      • Opcode ID: 0146b46a2ab330c1c2adc930de67c8dff7f8e5813537bd61edb162cdab20863d
                                                                      • Instruction ID: cb8f4a5d562f262bf1c3de2a7d28fa0a99609456b0bef4c61617adc1f94403ca
                                                                      • Opcode Fuzzy Hash: 0146b46a2ab330c1c2adc930de67c8dff7f8e5813537bd61edb162cdab20863d
                                                                      • Instruction Fuzzy Hash: 7E41283190CB588FDB15EFA8984A5E97BF0EF55350F04017EE449C3292DF68A846C7A2
                                                                      Function 00007FF848A83642 Relevance: 1.7, APIs: 1, Instructions: 172pipeCOMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      APIs
                                                                      Memory Dump Source
                                                                      • Source File: 00000008.00000002.3302735476.00007FF848A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848A80000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_8_2_7ff848a80000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID: CreateNamedPipe
                                                                      • String ID:
                                                                      • API String ID: 2489174969-0
                                                                      • Opcode ID: a63fe6a024b167d0b30d5ca8cd42234921f53e772724181dd3c89e085c0d7ac6
                                                                      • Instruction ID: 633e4b7f5fe4329849ac3576837631453f3b242b8f72f1b88572d1198bfb0181
                                                                      • Opcode Fuzzy Hash: a63fe6a024b167d0b30d5ca8cd42234921f53e772724181dd3c89e085c0d7ac6
                                                                      • Instruction Fuzzy Hash: 3F51A17191CA1C8FDB58EF5C9806BE9BBE0FB59710F0042AEE04DD3241CB70A8858BC2
                                                                      Function 00007FF848D93D80 Relevance: 1.6, Strings: 1, Instructions: 308COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      Strings
                                                                      Memory Dump Source
                                                                      • Source File: 00000008.00000002.3305958853.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_8_2_7ff848d90000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID: (jH
                                                                      • API String ID: 0-3771578368
                                                                      • Opcode ID: 2ec9d46e73dfb7f94412b9400a82fc42c2456282962663327936084820ca9ee7
                                                                      • Instruction ID: f9a54b086b1004f8a2a106a754df2ca407c7a019d36799fed43c80ce95b2245c
                                                                      • Opcode Fuzzy Hash: 2ec9d46e73dfb7f94412b9400a82fc42c2456282962663327936084820ca9ee7
                                                                      • Instruction Fuzzy Hash: 57716D32B0DB0A5FEB6D692C644927573C1EB997A5F40013ED88AC325AEF25FC474245
                                                                      Function 00007FF848D9808B Relevance: 1.5, Strings: 1, Instructions: 279COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      Strings
                                                                      Memory Dump Source
                                                                      • Source File: 00000008.00000002.3305958853.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_8_2_7ff848d90000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID: xZH
                                                                      • API String ID: 0-1298270321
                                                                      • Opcode ID: 83ceb7d5d1558771fc7fc7fe847f1abd5297171f09c1c93767b82f223d366b54
                                                                      • Instruction ID: 7fa05ac24fc904ee49959b54be408b326db64bf418adc4773a4c2df2967e971c
                                                                      • Opcode Fuzzy Hash: 83ceb7d5d1558771fc7fc7fe847f1abd5297171f09c1c93767b82f223d366b54
                                                                      • Instruction Fuzzy Hash: 4B812921E1EACA4FE789FB3894512B47BE1FF55A84F1441FAD04DC7187EF18A80A8B45
                                                                      Function 00007FF848D90450 Relevance: .6, Instructions: 571COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 728 7ff848d90450-7ff848d90458 730 7ff848d904aa-7ff848d904c6 728->730 731 7ff848d9045a-7ff848d9048e 728->731 738 7ff848d90490-7ff848d904a9 731->738 739 7ff848d904d8-7ff848d90500 731->739 738->730 744 7ff848d90502-7ff848d90521 739->744 745 7ff848d90524-7ff848d9053c 739->745 748 7ff848d90560-7ff848d9057e 745->748 749 7ff848d9053e-7ff848d9055d 745->749 752 7ff848d90580-7ff848d90590 748->752 753 7ff848d9059a 748->753 749->748 756 7ff848d90597-7ff848d90598 752->756 755 7ff848d9059f-7ff848d905a5 753->755 757 7ff848d905ab-7ff848d905b4 755->757 758 7ff848d9063e-7ff848d90641 755->758 756->753 759 7ff848d905b6-7ff848d905c3 757->759 760 7ff848d905cd-7ff848d905d8 757->760 761 7ff848d90643-7ff848d9064d 758->761 762 7ff848d90698-7ff848d906ab call 7ff848d900c0 * 2 758->762 759->760 767 7ff848d905c5-7ff848d905cb 759->767 764 7ff848d90624-7ff848d90632 760->764 765 7ff848d905da-7ff848d905f7 760->765 768 7ff848d90655-7ff848d9066e 761->768 775 7ff848d906b0-7ff848d906b6 762->775 764->758 773 7ff848d908e2-7ff848d9093f 765->773 774 7ff848d905fd-7ff848d90622 765->774 767->760 781 7ff848d90670-7ff848d90672 768->781 782 7ff848d906df-7ff848d906ea 768->782 811 7ff848d90941-7ff848d9094a 773->811 812 7ff848d9094b-7ff848d90952 773->812 774->764 779 7ff848d90800-7ff848d9081e call 7ff848d900c0 * 2 775->779 780 7ff848d906ba-7ff848d906c6 775->780 813 7ff848d90824-7ff848d9082e 779->813 814 7ff848d908bd-7ff848d908df 779->814 786 7ff848d906c8-7ff848d906ca 780->786 787 7ff848d906cc-7ff848d906da call 7ff848d900e0 780->787 788 7ff848d90674 781->788 789 7ff848d906ee-7ff848d906fa 781->789 790 7ff848d906eb-7ff848d906ec 782->790 794 7ff848d906dd-7ff848d906de 786->794 787->794 788->780 796 7ff848d90676-7ff848d9067a 788->796 797 7ff848d90700-7ff848d90701 789->797 798 7ff848d906fc-7ff848d906fe 789->798 790->789 794->782 796->790 801 7ff848d9067c-7ff848d90681 796->801 804 7ff848d90702-7ff848d9070e call 7ff848d900e0 797->804 802 7ff848d90711-7ff848d90715 798->802 801->804 809 7ff848d90683-7ff848d9068e 801->809 806 7ff848d90716-7ff848d9072e 802->806 804->802 824 7ff848d90730-7ff848d90732 806->824 825 7ff848d90734-7ff848d90742 call 7ff848d900e0 806->825 815 7ff848d90690-7ff848d90695 809->815 816 7ff848d906ff 809->816 818 7ff848d90954-7ff848d9095d 812->818 819 7ff848d9095e-7ff848d90969 812->819 820 7ff848d90830-7ff848d90832 813->820 821 7ff848d90834-7ff848d90842 call 7ff848d900e0 813->821 814->773 815->806 823 7ff848d90697 815->823 816->797 826 7ff848d90845-7ff848d90862 820->826 821->826 823->762 829 7ff848d90745-7ff848d90762 824->829 825->829 835 7ff848d90864-7ff848d90866 826->835 836 7ff848d90868-7ff848d90876 call 7ff848d900e0 826->836 838 7ff848d90764-7ff848d90766 829->838 839 7ff848d90768-7ff848d90776 call 7ff848d900e0 829->839 840 7ff848d90879-7ff848d90896 835->840 836->840 842 7ff848d90779-7ff848d9078f 838->842 839->842 847 7ff848d90898-7ff848d9089a 840->847 848 7ff848d9089c-7ff848d908aa call 7ff848d900e0 840->848 849 7ff848d90791-7ff848d907a4 call 7ff848d900e0 842->849 850 7ff848d907a6-7ff848d907ad 842->850 851 7ff848d908ad-7ff848d908b6 847->851 848->851 849->850 857 7ff848d907cd-7ff848d907d0 849->857 856 7ff848d907b4-7ff848d907c7 850->856 851->814 856->857 858 7ff848d907d2-7ff848d907e5 call 7ff848d900e0 857->858 859 7ff848d907e7-7ff848d907fa 857->859 858->779 858->859 859->779
                                                                      Memory Dump Source
                                                                      • Source File: 00000008.00000002.3305958853.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_8_2_7ff848d90000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 8bb68d30e3bc2b6f2cc6b8d6f2aef21309971c36fe08d71a01af452d9c0bf104
                                                                      • Instruction ID: 4174c0386ebd3a042f486ba337deeceb92972dc269e28e92a982da875c8afda6
                                                                      • Opcode Fuzzy Hash: 8bb68d30e3bc2b6f2cc6b8d6f2aef21309971c36fe08d71a01af452d9c0bf104
                                                                      • Instruction Fuzzy Hash: DC02E231A1EA4A4FE799FA2CA455BB537D1FF98394F1440B9D44EC7283DF28AC498344
                                                                      Function 00007FF848D94D65 Relevance: .4, Instructions: 408COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000008.00000002.3305958853.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_8_2_7ff848d90000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: ce57c73d2cff78b6381a9c3b181fc50bd9d56efc1cdca9caa78971cc62510a11
                                                                      • Instruction ID: afec8b01219a0e902cadd8039db9214c6d7890b9f2688d47f5a26c336bf43b26
                                                                      • Opcode Fuzzy Hash: ce57c73d2cff78b6381a9c3b181fc50bd9d56efc1cdca9caa78971cc62510a11
                                                                      • Instruction Fuzzy Hash: DEC14732D0E98A5FEB59FA289452AB537E1FF50794F4401BDC44E87183EF29B84E8385
                                                                      Function 00007FF848D926E7 Relevance: .3, Instructions: 305COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000008.00000002.3305958853.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_8_2_7ff848d90000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 927a61f82c27ac6986ec450385392637e36d187807898b6a3115c1bc578e2fee
                                                                      • Instruction ID: 8f1314bc12d3a97285bb15060695ec6f655c67ccb22e09f3cb1d8e949540b98d
                                                                      • Opcode Fuzzy Hash: 927a61f82c27ac6986ec450385392637e36d187807898b6a3115c1bc578e2fee
                                                                      • Instruction Fuzzy Hash: E5910272A0EA8A4FEB88EF289855BB577D1FF54754F0400B9D05EC7287DF29E8068784
                                                                      Function 00007FF848D93EF5 Relevance: .3, Instructions: 287COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000008.00000002.3305958853.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_8_2_7ff848d90000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 79cafd57afff34876665ba8087983ba4bed39c9abd8507ff703ecea478e8a675
                                                                      • Instruction ID: b737ba85182626e9a9ce9af814253cfbfb75b4dd3e298f3613932a3f4a095d6e
                                                                      • Opcode Fuzzy Hash: 79cafd57afff34876665ba8087983ba4bed39c9abd8507ff703ecea478e8a675
                                                                      • Instruction Fuzzy Hash: E391643460DA4A8FDBCDEF28C4947A177A2FF99344B2445E9C059CB69BCB25E846C740
                                                                      Function 00007FF848D90636 Relevance: .2, Instructions: 237COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000008.00000002.3305958853.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_8_2_7ff848d90000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: a366663d55140c590315cea2b74c1f84639691e2dd6e8d45b3d86d8c34ced467
                                                                      • Instruction ID: 5e2c044acba4aaf3d32e5e8fa2cc05ec37d66cf8de4ef95dcc821c15c8a9a771
                                                                      • Opcode Fuzzy Hash: a366663d55140c590315cea2b74c1f84639691e2dd6e8d45b3d86d8c34ced467
                                                                      • Instruction Fuzzy Hash: CA711C7062DA0A8FEBA8FB18D491BA533D1FF68355F5040B8E54EC7292DF68EC498744
                                                                      Function 00007FF848D95E44 Relevance: .2, Instructions: 184COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000008.00000002.3305958853.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_8_2_7ff848d90000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 22851d8c47bc63b11fe59e46b787c26fbca8d99d03bc049f2a04e2ebbb162752
                                                                      • Instruction ID: 0416a2f7458793f005e8f62d7b997bee252932bba35963ea39c4359e6000cb3f
                                                                      • Opcode Fuzzy Hash: 22851d8c47bc63b11fe59e46b787c26fbca8d99d03bc049f2a04e2ebbb162752
                                                                      • Instruction Fuzzy Hash: 3651272190F6975FE74ABB3864A12F93BA0EF427A8F0841BAD44CCB0D7DF1D580A8355
                                                                      Function 00007FF848D93919 Relevance: .2, Instructions: 170COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000008.00000002.3305958853.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_8_2_7ff848d90000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 5cdc8f06bebe7ec71a41e32ffcf09a9e307d0bcbc4776cdb188c4c71795df79d
                                                                      • Instruction ID: 2c33941c6857393ae0fe4c2f30591b6f359b81127c628fa3e67a49e06e4d624d
                                                                      • Opcode Fuzzy Hash: 5cdc8f06bebe7ec71a41e32ffcf09a9e307d0bcbc4776cdb188c4c71795df79d
                                                                      • Instruction Fuzzy Hash: F7518B6194EBC21FE31793784C65B517FA19E171A8B1D02DAC0D4CF1F7EA9E944AC322
                                                                      Function 00007FF848D98430 Relevance: .2, Instructions: 166COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000008.00000002.3305958853.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_8_2_7ff848d90000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: f72fbb194ef0ad06b4a3cf22ebc45e99f16f4bf064f10a3e728b8a4f864eba8c
                                                                      • Instruction ID: c4255b2cc8111ba8202d5f1ab8de8d182915d5c22eb130c33fa646da919479d0
                                                                      • Opcode Fuzzy Hash: f72fbb194ef0ad06b4a3cf22ebc45e99f16f4bf064f10a3e728b8a4f864eba8c
                                                                      • Instruction Fuzzy Hash: 7E412732E0EE4A8FEB95BB68E8511E977A1FF94759F04017AD04DC3292DF34980A8B45
                                                                      Function 00007FF848D93D70 Relevance: .1, Instructions: 135COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000008.00000002.3305958853.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_8_2_7ff848d90000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 0503fa40038d390dded97020a03884976addfb247381d15a34c6d2cc14b4e202
                                                                      • Instruction ID: 6488eedf75b456ec2c45c47a4c54cb135f5fce793986fc9c91984089755ac19d
                                                                      • Opcode Fuzzy Hash: 0503fa40038d390dded97020a03884976addfb247381d15a34c6d2cc14b4e202
                                                                      • Instruction Fuzzy Hash: D7413962C0F5D65FE306BB7C98665E93BB0DF12798F0912B3D0998B0A3EF18564D8349
                                                                      Function 00007FF848D909F9 Relevance: .1, Instructions: 115COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000008.00000002.3305958853.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_8_2_7ff848d90000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 034aae752d46910ad1162f32580f41a8a09689f33dc67f01eff62cc25be204ce
                                                                      • Instruction ID: c5b194c66dff3e930ab8fcbc09dcc12109b18045cf54f4c314491ce5359d0ef7
                                                                      • Opcode Fuzzy Hash: 034aae752d46910ad1162f32580f41a8a09689f33dc67f01eff62cc25be204ce
                                                                      • Instruction Fuzzy Hash: CA317330A0DA4E8FDB84FF28D450AA577A2FF59354B1005A9D01DC72C2CB35EC56CB80
                                                                      Function 00007FF848D93DD3 Relevance: .1, Instructions: 99COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000008.00000002.3305958853.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_8_2_7ff848d90000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: f25f2d5e4285a603b838f7ed7214e3e2399604d0adf437c08949565addeb273a
                                                                      • Instruction ID: f01908d336657f0f9d297049b91120c986e6c21a0956188b27ea5827a678389e
                                                                      • Opcode Fuzzy Hash: f25f2d5e4285a603b838f7ed7214e3e2399604d0adf437c08949565addeb273a
                                                                      • Instruction Fuzzy Hash: AB31386280E5D55FD305FBBCA8626E97BB0DF02368F0952B3D4DC8A093EE1856488355
                                                                      Function 00007FF848D90A10 Relevance: .1, Instructions: 94COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000008.00000002.3305958853.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_8_2_7ff848d90000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 163ff7c48f9ed43865bd533a489c0d74a9d08bb39014c829733b48a4aa418f3f
                                                                      • Instruction ID: 8f294efeb5da35fe705568f80f3c0cca4ff6cfd651f157acc6e00ab60e880625
                                                                      • Opcode Fuzzy Hash: 163ff7c48f9ed43865bd533a489c0d74a9d08bb39014c829733b48a4aa418f3f
                                                                      • Instruction Fuzzy Hash: 77312A30A0990E8FDB88FF18D451AA973E2FF58354F500669D01DC7286DB35EC52CB84
                                                                      Function 00007FF848D91379 Relevance: .1, Instructions: 86COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000008.00000002.3305958853.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_8_2_7ff848d90000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 7e13a6db6c4412ffdc98be52d9df1868a2d94d3c42ac6c0fa375ac36365eda06
                                                                      • Instruction ID: fde0bb28f45cc3c7ba076ca8fac8dd1a7d0578dd76b0e99b278e13e0f31c67d4
                                                                      • Opcode Fuzzy Hash: 7e13a6db6c4412ffdc98be52d9df1868a2d94d3c42ac6c0fa375ac36365eda06
                                                                      • Instruction Fuzzy Hash: 0B21A572C0E8D59AEB10FE38E4566F93760EF1679CF0801B6D08D8B053EF1DAA498644
                                                                      Function 00007FF848D950C0 Relevance: .1, Instructions: 77COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000008.00000002.3305958853.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_8_2_7ff848d90000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: bb33727096fefecd45cdd1c86c62ae12ff310831d65502623c8a59ea41ccf01d
                                                                      • Instruction ID: a818b15e1eac6d5e450b8d42b053367829b1073132d4a9c29c8adbffdbdb0d18
                                                                      • Opcode Fuzzy Hash: bb33727096fefecd45cdd1c86c62ae12ff310831d65502623c8a59ea41ccf01d
                                                                      • Instruction Fuzzy Hash: 57115961E1EA864FE789FB7864952B03BE1EF54298F1441B9D048C719BEE6CCC4A8391
                                                                      Function 00007FF848D9520D Relevance: .1, Instructions: 72COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000008.00000002.3305958853.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_8_2_7ff848d90000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: ad1234207c8f628f3b2bbd263e61f993d8fc2574ddb96bdeaf78d0e9e606b781
                                                                      • Instruction ID: 6e4391d23bad21cc53018ff0e87b4a2ff587484778121e193da9af3f42bb7489
                                                                      • Opcode Fuzzy Hash: ad1234207c8f628f3b2bbd263e61f993d8fc2574ddb96bdeaf78d0e9e606b781
                                                                      • Instruction Fuzzy Hash: A711B131D4EF4A8FEF94EB7458652A93FB0FF56308F0400AAD148D7292DB346809CB05
                                                                      Function 00007FF848D925C0 Relevance: .1, Instructions: 70COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000008.00000002.3305958853.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_8_2_7ff848d90000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 596a83cacd3b00863a528d927934228c91d48a136f9ccb60cc3c30fdac506b27
                                                                      • Instruction ID: eb7e8a933a726f6e8d3d678727db314903f343353cca6b52798b4154e9e50986
                                                                      • Opcode Fuzzy Hash: 596a83cacd3b00863a528d927934228c91d48a136f9ccb60cc3c30fdac506b27
                                                                      • Instruction Fuzzy Hash: 41114F71B09A8A9FD789EE18D855A7933E1FF68744F1401BDC45EC7292CF25AC06CB40
                                                                      Function 00007FF848D9280C Relevance: .1, Instructions: 63COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000008.00000002.3305958853.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_8_2_7ff848d90000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: b3b771006b169e7f5f365d4f9c8979be7fa62fab4dc0294c988806d55b8448f3
                                                                      • Instruction ID: 7b20ce25602d3a81b8eb15317249202e793f0d7d27bd73d806f9b32917db67ca
                                                                      • Opcode Fuzzy Hash: b3b771006b169e7f5f365d4f9c8979be7fa62fab4dc0294c988806d55b8448f3
                                                                      • Instruction Fuzzy Hash: 59118E30A0D94A8FEB88EF288440B6573A1FF58754F0440B8C44ECB287CF39EC498781
                                                                      Function 00007FF848D94709 Relevance: .1, Instructions: 62COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000008.00000002.3305958853.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_8_2_7ff848d90000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 8143337079901424287b407cf263d862ec8c76a0ef9bfced4f4958e3c328fe39
                                                                      • Instruction ID: 03f29140322ae0fc131dfb41404628ba1f1d8aa3af6471608bec0212e25b8ae7
                                                                      • Opcode Fuzzy Hash: 8143337079901424287b407cf263d862ec8c76a0ef9bfced4f4958e3c328fe39
                                                                      • Instruction Fuzzy Hash: FF11C624D0EB4B0FF7A9A228446137526E3DF86285F1980BAC44DC71D7DF6C9C89C396
                                                                      Function 00007FF848D92875 Relevance: .1, Instructions: 62COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000008.00000002.3305958853.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_8_2_7ff848d90000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: a8b5e03b721d0037421d92cc54b0f7b145ee8381b1d1c8209d8962dbdb37f9bc
                                                                      • Instruction ID: 7adfb50f0026c81840c665a78bee556101e8ce2673ca1b6be00f3c54a41b8a5b
                                                                      • Opcode Fuzzy Hash: a8b5e03b721d0037421d92cc54b0f7b145ee8381b1d1c8209d8962dbdb37f9bc
                                                                      • Instruction Fuzzy Hash: D5116071A199894FDB88EF288454B6577E1FF58754F0440A8C44ECB287CF39EC498781
                                                                      Function 00007FF848D911D8 Relevance: .1, Instructions: 60COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000008.00000002.3305958853.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_8_2_7ff848d90000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: dec9d376457b1b308f7f652f9bb688443802848d3d7c555521f601e11abeb175
                                                                      • Instruction ID: c15504104c82b310a048cd1b8ddf315af53162d0708ebdeedac75426d43f6efa
                                                                      • Opcode Fuzzy Hash: dec9d376457b1b308f7f652f9bb688443802848d3d7c555521f601e11abeb175
                                                                      • Instruction Fuzzy Hash: 04012851E2EC8A1FEB88BA7C64957B516E1FF94288F504075D40DC318BEF3CD94A4395
                                                                      Function 00007FF848D913FB Relevance: .1, Instructions: 52COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000008.00000002.3305958853.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_8_2_7ff848d90000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 22b473b3fddd3ba036e79d7933fe9812e7099aed3b69f895e375e0563d2dfd87
                                                                      • Instruction ID: e102ddc5ef8243742eb397bf99a4cc38f25d3f7683e8861a77f9c9e5e2501445
                                                                      • Opcode Fuzzy Hash: 22b473b3fddd3ba036e79d7933fe9812e7099aed3b69f895e375e0563d2dfd87
                                                                      • Instruction Fuzzy Hash: 4401B171C0DD89CFEB95FA38E8495B937A0EF29799F0401A5D04E87062EF2DAC09CB45
                                                                      Function 00007FF848D90B15 Relevance: .0, Instructions: 42COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000008.00000002.3305958853.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_8_2_7ff848d90000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 667fb63ebb394dd7db99677afca70fa7934832b1088900a75cc5e6da4c2483f3
                                                                      • Instruction ID: 4b37c93752fb5a01723194e5da5388a0ff3e0549280b4fe54e3eae4d823bcd82
                                                                      • Opcode Fuzzy Hash: 667fb63ebb394dd7db99677afca70fa7934832b1088900a75cc5e6da4c2483f3
                                                                      • Instruction Fuzzy Hash: 56F0AF2244F2D20FD352B7B098A56A07FE0EF47150B0E82FAD084CB4A3D64C5C8A8761
                                                                      Function 00007FF848D909B1 Relevance: .0, Instructions: 28COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000008.00000002.3305958853.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_8_2_7ff848d90000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 9289f84ff77f855ce78578dfce2c1cd2101c7bf716fced0524712e2ba498dc56
                                                                      • Instruction ID: 0ca017c46253c9db3a66d2ecc87a2968469c068089285535dd519325170da4ff
                                                                      • Opcode Fuzzy Hash: 9289f84ff77f855ce78578dfce2c1cd2101c7bf716fced0524712e2ba498dc56
                                                                      • Instruction Fuzzy Hash: F8E0DF2150F7D40FDB53AB3888A88E13FA0EE1322030D00EBD485CF0B3E6198A89CB52
                                                                      Function 00007FF848D94720 Relevance: .0, Instructions: 24COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000008.00000002.3305958853.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_8_2_7ff848d90000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 3b4f7a515d18017f2f7e15931749c332fb37f26323838c6d2c4d42190b8e83d5
                                                                      • Instruction ID: b5361b7c3c651e7ac65e2364eaac53b2d0a2e1ae5213d24b11ab96198204f606
                                                                      • Opcode Fuzzy Hash: 3b4f7a515d18017f2f7e15931749c332fb37f26323838c6d2c4d42190b8e83d5
                                                                      • Instruction Fuzzy Hash: BBE0C22594EA0B0AFB6C7175B8923B660C2CF06384F09407AD41DC24C6DF9C9C8581AA
                                                                      Function 00007FF848D982F1 Relevance: .0, Instructions: 20COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000008.00000002.3305958853.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_8_2_7ff848d90000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 2c63ef2106729d142b1516f7b4b58cddd1410ca6d6d3155dc95dc6864b5a5ac2
                                                                      • Instruction ID: f4510ba517f017ca4229f83af9b2cc413bc4eef918243f6a7540b549789f3310
                                                                      • Opcode Fuzzy Hash: 2c63ef2106729d142b1516f7b4b58cddd1410ca6d6d3155dc95dc6864b5a5ac2
                                                                      • Instruction Fuzzy Hash: 88D0A901F5EC5A0EE098B14C34022B80A81DB88AC0B4800B6C408C224ECA481C8383C6
                                                                      Function 00007FF848D92914 Relevance: .0, Instructions: 8COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000008.00000002.3305958853.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_8_2_7ff848d90000_ScreenConnect.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 41e8d802287ba38a287cb8acfe485f752e97bb3623b659f9ce1f8f47b3357dd3
                                                                      • Instruction ID: 8ce618dc94ab0b9c9489f1dea1185ec0eee6c87766686aa7714ecd9ab310cafe
                                                                      • Opcode Fuzzy Hash: 41e8d802287ba38a287cb8acfe485f752e97bb3623b659f9ce1f8f47b3357dd3
                                                                      • Instruction Fuzzy Hash: D4C09B10E1E5464EF144FF25544627D11526F88684F944435D41D86186CF7C6601566E