24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 81:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T502,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_60% Sample 5c799922f4e1… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 5c799922f4e1…. Malware family: Win/malicious_confidence_60%. Threat score 100/100. 7/27 AV engines flagged this file. 19 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e","keywords":["Malicious","Win/malicious_confidence_60%","malware analysis","sandbox report","threat intelligence","5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e"],"about":{"@type":"SoftwareApplication","name":"5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin","applicationCategory":["peexe","assembly","executable"],"identifier":"5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_60%","antivirusDetections":{"malicious":7,"total":27},"behavioralIndicators":{"malicious":19,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T71c,Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00002308.00000000.176238.03330000.00000004.mdmp, 00000000-00002308.00000001.177678.03361000.00000004.mdmp") Found string ":\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation.ni.dll" (Source: "00000000-00002308.00000000.176238.03330000.00000004.mdmp, 00000000-00002308.00000001.177678.03361000.00000004.mdmp") Found string "??\C:\Windows\System32\WindowsPowerShell\v1.0\System.Management.Automation" (Source: "00000000-00002308.00000000.176238.03330000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00002308.00000000.176238.03330000.00000004.mdmp, 00000000-00002308.00000001.177678.03361000.00000004.mdmp") Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\" (Source: "00000000-00002308.00000000.176238.1DD70000.00000004.mdmp") Found string "3,"System.Management.Automation Version=3.0.0.0 Culture=neutral PublicKeyToken=31bf3856ad364e35","C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation.ni.dll",0" (Source: "00000000-00002308.00000000.176238.1DD70000.00000004.mdmp, 00000000-00002308.00000001.177678.1DD70000.00000004.mdmp") Found string "System.Management.Automation" (Source: "00000000-00002308.00000001.177678.00DF2000.00000002.mdmp") Found string "System.Management.Automation.Host" (Source: "00000000-00002308.00000001.177678.00DF2000.00000002.mdmp") Found string "System.Management.Automation.Runspaces" (Source: "00000000-00002308.00000001.177678.00DF2000.00000002.mdmp")26:T8f4,Observed namespace "System.Runtime.InteropServices.MarshalAsAttribute" and TypeReference ".ctor" in "5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStringUni" in "5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "SecondApp.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "SecondApp.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "SecondApp.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReAllocHGlobal" in "SecondApp.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadIntPtr" in "SecondApp.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStructure" in "SecondApp.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "SecondApp.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadInt32" in "SecondApp.exe" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "SecondApp.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "SecondApp.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetLastWin32Error" in "SecondApp.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetFunctionPointerForDelegate" in "SecondApp.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetDelegateForFunctionPointer" in "SecondApp.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocCoTaskMem" in "SecondApp.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StructureToPtr" in "SecondApp.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "WriteIntPtr" in "SecondApp.exe"27:T709,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004196.00000000.177692.00CDD000.00000002.mdmp, 00000000-00004196.00000001.178288.08220000.00000004.mdmp, 00000000-00004196.00000001.178288.72DA1000.00000002.mdmp, 00000000-00004196.00000001.178288.72E05000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004196.00000000.177692.00CDD000.00000002.mdmp, 00000000-00004196.00000001.178288.08220000.00000004.mdmp, 00000000-00004196.00000001.178288.72DA1000.00000002.mdmp, 00000000-00004196.00000001.178288.72E05000.00000002.mdmp")28:T634,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004196.00000000.177692.00CDD000.00000002.mdmp, 00000000-00004196.00000001.178288.08220000.00000004.mdmp, 00000000-00004196.00000001.178288.72DA1000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004196.00000000.177692.00CDD000.00000002.mdmp, 00000000-00004196.00000001.178288.08220000.00000004.mdmp, 00000000-00004196.00000001.178288.72DA1000.00000002.mdmp, 00000000-00004196.00000001.178288.72E05000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004196.00000000.177692.00CDD000.00000002.mdmp, 00000000-00004196.00000001.178288.08220000.00000004.mdmp, 00000000-00004196.00000001.178288.72DA1000.00000002.mdmp, 00000000-00004196.00000001.178288.72E05000.00000002.mdmp")29:T525,file/memory contains long string with (Indicator: "SHA384"; File: "ScreenConnect.ClientService.exe") Found reference to "ystem.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; File: "AMSI") Found reference to "ystem.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; File: "AMSI") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00006680-00000BC0-1740254876") Found reference to "ES-GCM via Windows CNG (AuthenticatedAes)" (Indicator: "Aes"; File: "AMSI") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00002308.00000001.177678.22B90000.00000004.mdmp") Found reference to "SHA512 block transform for x86_64, CRYPTOGAMS by " (Indicator: "SHA512"; Source: "00000000-00004108.00000000.179024.40647000.00000002.mdmp, 00000000-00004108.00000000.179024.8038D000.00000002.mdmp") Found reference to "HMACSHA256" (Indicator: "HMAC"; Source: "00000000-00004196.00000000.177692.08190000.00000004.mdmp") Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; Source: "00000000-00004196.00000000.177692.08190000.00000004.mdmp")2a:Ta19,"k__BackingField" (Source: "00000000-00004196.00000000.177692.08190000.00000004.mdmp") Found string "k__BackingField" (Source: "00000000-00004196.00000000.177692.08190000.00000004.mdmp") Found string "k__BackingField" (Source: "00000000-00004196.00000000.177692.08190000.00000004.mdmp") Found string "k__BackingField" (Source: "00000000-00004196.00000000.177692.08190000.00000004.mdmp") Found string "get_MachineName" (Source: "00000000-00004196.00000000.177692.08190000.00000004.mdmp, 00000000-00004196.00000001.178288.08220000.00000004.mdmp") Found string "set_MachineName" (Source: "00000000-00004196.00000000.177692.08190000.00000004.mdmp") Found string "get_UserName" (Source: "00000000-00004196.00000000.177692.08190000.00000004.mdmp, 00000000-00004196.00000001.178288.08220000.00000004.mdmp") Found string "set_UserName" (Source: "00000000-00004196.00000000.177692.08190000.00000004.mdmp") Found string "get_StoredUserName" (Source: "00000000-00004196.00000000.177692.08190000.00000004.mdmp") Found string "set_StoredUserName" (Source: "00000000-00004196.00000000.177692.08190000.00000004.mdmp") Found string "get_OptionalUserName" (Source: "00000000-00004196.00000000.177692.08190000.00000004.mdmp")32:T5ce,file/memory contains long string with (Indicator: "GetCommandLine"; File: "ScreenConnect.ClientService.exe") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin") Found string "GetLastInputInfo" (Indicator: "GetLastInputInfo"; Source: "00000000-00003692-00000C2C-1742886374") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00004108.00000000.179024.40647000.00000002.mdmp, 00000000-00004108.00000000.179024.8038D000.00000002.mdmp, 00000000-00004108.00000000.179024.A56F0000.00000020.mdmp, 00000000-00004108.00000000.179024.A7800000.00000040.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004108.00000000.179024.40647000.00000002.mdmp, 00000000-00004108.00000000.179024.8038D000.00000002.mdmp, 00000000-00004108.00000000.179024.A56F0000.00000020.mdmp, 00000000-00004108.00000000.179024.A7800000.00000040.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00004196.00000000.177692.00CDD000.00000002.mdmp, 00000000-00004196.00000001.178288.08220000.00000004.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004196.00000000.177692.00CDD000.00000002.mdmp, 00000000-00004196.00000001.178288.08220000.00000004.mdmp")33:T65b,file/memory contains long string with (Indicator: "sendmessage"; File: "ScreenConnect.WindowsFileManager.exe") file/memory contains long string with (Indicator: "sendmessage"; File: "ScreenConnect.WindowsBackstageShell.exe") Found reference to API "SendMessage" (Indicator: "sendmessage"; Source: "00000000-00002308-00000C2C-1722979731") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00002308-00000C2C-1722979755") Found reference to API "PostMessage" (Indicator: "postmessage"; Source: "00000000-00006680-00000C2C-1741553783") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00006680-00000C2C-1741553805") Found reference to API "AttemptToNotifyRunningChrome:SendMessage" (Indicator: "sendmessage"; Source: "00000000-00004108.00000000.179024.40647000.00000002.mdmp") Found reference to API "PostMessage" (Indicator: "postmessage"; Source: "00000000-00004108.00000000.179024.40647000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00004108.00000000.179024.40647000.00000002.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00004108.00000000.179024.40647000.00000002.mdmp") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; Source: "00000000-00004108.00000000.179024.40647000.00000002.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00004196.00000000.177692.005C0000.00000004.mdmp, 00000000-00004196.00000001.178288.005C0000.00000004.mdmp")34:T2551,"b__2_0" (Indicator: "LoadResource"; Source: "00000000-00004196.00000000.177692.08190000.00000004.mdmp") Found reference to API "b__3_0" (Indicator: "LoadResource"; Source: "00000000-00004196.00000000.177692.08190000.00000004.mdmp") Found reference to API "b__1" (Indicator: "LoadResource"; Source: "00000000-00004196.00000000.177692.08190000.00000004.mdmp")40:T10e1,"o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002308.00000000.176238.03330000.00000004.mdmp 00000000-00002308.00000001.177678.03361000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002308.00000000.176238.03330000.00000004.mdmp 00000000-00002308.00000001.177678.03361000.00000004.mdmp "Registry\Machine\Software\Classes\DelegateFolders" in Source: 00000000-00002308.00000001.177678.1DD70000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00002308.00000001.177678.1DD70000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\Instance" in Source: 00000000-00002308.00000001.177678.1DD70000.00000004.mdmp "Registry\Machine\Software\Classes\ExplorerCLSIDFlags\{66742402-F9B9-11D1-A202-0000F81FEDEE}" in Source: 00000000-00002308.00000001.177678.1DD70000.00000004.mdmp "Registry\Machine\Software\Classes\Drive\shellex\FolderExtensions" in Source: 00000000-00002308.00000001.177678.1DDFD000.00000004.mdmp "Registry\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00002308.00000001.177678.1DDFD000.00000004.mdmp "Registry\Machine\Software\Classes\Applications\SecondApp.exe" in Source: 00000000-00002308.00000001.177678.1DDFD000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\" in Source: 00000000-00002308.00000001.177678.1DDFD000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4" in Source: 00000000-00002308.00000001.177678.1DDFD000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002308.00000001.177678.1DDFD000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\" in Source: 00000000-00002308.00000001.177678.1DDFD000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}" in Source: 00000000-00002308.00000001.177678.22B90000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00002308.00000001.177678.22B90000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}" in Source: 00000000-00002308.00000001.177678.22B90000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002308.00000001.177678.22B90000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}" in Source: 00000000-00002308.00000001.177678.22B90000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-735145574-3570218355-1207367261-1001\fdeploy" in Source: 00000000-00002308.00000001.177678.22B90000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002308.00000001.177678.22B90000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA9" in Source: 00000000-00002308.00000001.177678.22C89000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00$" in Source: 00000000-00002308.00000001.177678.22C89000.00000004.mdmp "y\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00002308.00000001.177678.22C89000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004196.00000000.177692.005C0000.00000004.mdmp 00000000-00004196.00000001.178288.005C0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004196.00000000.177692.005C0000.00000004.mdmp 00000000-00004196.00000001.178288.005C0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00004196.00000000.177692.05B50000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00004196.00000000.177692.05B50000.00000004.mdmp41:T908,Process HTTP/1.1 302 Found Date: Mon 04 May 2026 17:48:49 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Vary: X-PJAX X-PJAX-Container Turbo-Visit Turbo-Frame X-Requested-With Sec-Fetch-Site Accept-Encoding Accept X-Requested-With Location: https://release-assets.githubusercontent.com/github-production-release-asset/1155614937/771d1298-bf00-4bc2-b43a-cc4d15c8778d?sp=r&sv=2018-11-09&sr=b&spr=https&se=2026-05-04T18%3A24%3A33Z&rscd=attachment%3B+filename%3DScreenConnect.ClientSetup.exe&rsct=application%2Foctet-stream&skoid=96c2d410-5711-43a1-aedd-ab1947aa7ab0&sktid=398a6654-997b-47e9-b12b-9515b896b4de&skt=2026-05-04T17%3A23%3A49Z&ske=2026-05-04T18%3A24%3A33Z&sks=b&skv=2018-11-09&sig=fHN4%2B9AVo4fXL3WcI%2Bwa9kQ7J8hDqB2nD%2BnuflguZiI%3D&jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmVsZWFzZS1hc3NldHMuZ2l0aHVidXNlcmNvbnRlbnQuY29tIiwia2V5Ijoia2V5MSIsImV4cCI6MTc3NzkxODcyOSwibmJmIjoxNzc3OTE2OTI5LCJwYXRoIjoicmVsZWFzZWFzc2V0cHJvZHVjdGlvbi5ibG9iLmNvcmUud2luZG93cy5uZXQifQ.xfGxNQUw4MuDXpL310gRpHegYJuPZTRYHCskUmcFh-M&response-content-disposition=attachment%3B%20filename%3DScreenConnect.ClientSetup.exe&response-content-type=application%2Foctet-stream Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: no-referrer-when-downgrade Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com github.githubassets.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net productionresultssa1.blob.core.windows.net productionresultssa2.blob.core.windows.net productionresultssa3.blob.core.windows.net productionresultssa4.blob.core.windows.net productionresultssa5.blob.core.windows.net productionresultssa6.blob.core.windows.net productionresultssa7.blob.core.windows.net productionresultssa8.blob.core.windows.net productionresultssa9.blob.core.windows.net productionresultssa10.blob.core.windows.net productionresultssa11.blob.core.windows.net productionresultssa12.blob.core.windows.net productionresultssa13.blob.core.windows.net productionresultssa14.blob.core.windows.net productionresultssa15.blob.core.windows.net productionresultssa16.blob.core.windows.net productionresultssa17.blob.core.windows.net productionresultssa18.blob.core.windows.net productionresultssa19.blob.core.windows.net github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com wss://alive-staging.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com release-assets.githubusercontent.com secured-user-images.githubusercontent.com user-images.githubusercontent.com private-user-images.githubusercontent.com opengraph.githubassets.com marketplace-screenshots.githubusercontent.com copilotprodattachments.blob.core.windows.net/github-production-copilot-attachments/ github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com secured-user-images.githubusercontent.com private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com github.githubassets.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/ Server: github.com X-GitHub-Request-Id: E18C:58289:81EC06:AD3F5C:69F8DC01 with no response body "GET /darkislivenow-cloud/DarkDevPC/releases/download/Config/Smartscreen.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 6.2; en-US) WindowsPowerShell/5.1.16299.248 Host: github.com" Response ==> HTTP/1.1 302 Found Date: Mon 04 May 2026 17:48:56 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Vary: X-PJAX X-PJAX-Container Turbo-Visit Turbo-Frame X-Requested-With Sec-Fetch-Site Accept-Encoding Accept X-Requested-With Location: https://release-assets.githubusercontent.com/github-production-release-asset/1155614937/d458ca4a-72e2-4459-9bcf-a6010b954592?sp=r&sv=2018-11-09&sr=b&spr=https&se=2026-05-04T18%3A23%3A40Z&rscd=attachment%3B+filename%3DSmartscreen.exe&rsct=application%2Foctet-stream&skoid=96c2d410-5711-43a1-aedd-ab1947aa7ab0&sktid=398a6654-997b-47e9-b12b-9515b896b4de&skt=2026-05-04T17%3A23%3A10Z&ske=2026-05-04T18%3A23%3A40Z&sks=b&skv=2018-11-09&sig=rxkv7G1jtqrdR8e9F0CRgyuf250DYMS1%2BmTL8O0wPdg%3D&jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmVsZWFzZS1hc3NldHMuZ2l0aHVidXNlcmNvbnRlbnQuY29tIiwia2V5Ijoia2V5MSIsImV4cCI6MTc3NzkxNzIzNiwibmJmIjoxNzc3OTE2OTM2LCJwYXRoIjoicmVsZWFzZWFzc2V0cHJvZHVjdGlvbi5ibG9iLmNvcmUud2luZG93cy5uZXQifQ.QGhRzDsVoDtZsvXMATv0Uv1UyNbYQ6t9KzGNJcFYU9w&response-content-disposition=attachment%3B%20filename%3DSmartscreen.exe&response-content-type=application%2Foctet-stream Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: no-referrer-when-downgrade Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com github.githubassets.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net productionresultssa1.blob.core.windows.net productionresultssa2.blob.core.windows.net productionresultssa3.blob.core.windows.net productionresultssa4.blob.core.windows.net productionresultssa5.blob.core.windows.net productionresultssa6.blob.core.windows.net productionresultssa7.blob.core.windows.net productionresultssa8.blob.core.windows.net productionresultssa9.blob.core.windows.net productionresultssa10.blob.core.windows.net productionresultssa11.blob.core.windows.net productionresultssa12.blob.core.windows.net productionresultssa13.blob.core.windows.net productionresultssa14.blob.core.windows.net productionresultssa15.blob.core.windows.net productionresultssa16.blob.core.windows.net productionresultssa17.blob.core.windows.net productionresultssa18.blob.core.windows.net productionresultssa19.blob.core.windows.net github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com wss://alive-staging.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com release-assets.githubusercontent.com secured-user-images.githubusercontent.com user-images.githubusercontent.com private-user-images.githubusercontent.com opengraph.githubassets.com marketplace-screenshots.githubusercontent.com copilotprodattachments.blob.core.windows.net/github-production-copilot-attachments/ github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com secured-user-images.githubusercontent.com private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com github.githubassets.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/ Server: github.com X-GitHub-Request-Id: DFDC:BCF95:8613AE:B37D07:69F8DC08 with no response body "GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0 Host: ipwho.is Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Mon 04 May 2026 17:49:07 GMT Content-Type: application/json; charset=utf-8 Content-Length: 954 Connection: keep-alive cf-cache-status: HIT Access-Control-Allow-Origin: * Accept-Ranges: bytes Server: cloudflare CF-RAY: 9f69571b7d51ebe3-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B0A20202020226970223A202236342E3132342E31322E313632222C0A202020202273756363657373223A20747275652C0A202020202274797065223A202249....... "GET / HTTP/1.1 Host: icanhazip.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Mon 04 May 2026 17:49:17 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=PhNDwBZOqp.A3vJCi0dspLJtQyXvzTMfa65ruIyrbIE-1777916957.869154-1.0.1.1-rnk7vxOIUjfzm6YWkMdUONGI4m0RhjDJ5EAAWLoTp19QYsZIGQoHbZiQ.Agsi3fLNFprChis3rKirTM3Rol83uIEviIqt1U0Z.dKinJPQno4sk1.We38KxhQCb9kRGBA; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Mon 04 May 2026 18:19:17 GMT Server: cloudflare CF-RAY: 9f69575aae96f46e-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /line/?fields=countryCode HTTP/1.1 Host: ip-api.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Mon 04 May 2026 17:49:17 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 3 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 with response body ==>55530A.......4a:T6d2b,"%ydigicert" - Source: "00000000-00002308.00000001.177678.1DDFD000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00002308.00000001.177678.1DDFD000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00002308.00000001.177678.1DDFD000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00002308.00000001.177678.1DDFD000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00002308.00000001.177678.1DDFD000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l2.5.29.142.5.29.31ldap2.5.29.17" - Source: "00000000-00002308.00000001.177678.22B90000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00002308.00000001.177678.22B90000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mn9iqmgvw,czcthawte," - Source: "00000000-00002308.00000001.177678.22B90000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?enc.1work," - Source: "00000000-00002308.00000001.177678.22B90000.00000004.mdmp") Found URL "http://crl.v" - Source: "00000000-00002308.00000001.177678.22B90000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00002308.00000001.177678.22B90000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00002308.00000001.177678.22B90000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00002308.00000001.177678.22B90000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002308.00000001.177678.22B90000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.3.6.1.4.1.311.64.1.1mpleblishing" - Source: "00000000-00002308.00000001.177678.22B90000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?0http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002308.00000001.177678.22B90000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l6&6f[1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00002308.00000001.177678.22B90000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00002308.00000001.177678.22B90000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00002308.00000001.177678.22B90000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00002308.00000001.177678.22B90000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00002308.00000001.177678.22B90000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00002308.00000001.177678.22B90000.00000004.mdmp") Found URL "https://crashpad.chromium.org/https://crashpad.chromium.org/bug/newreport" - Source: "00000000-00004108.00000000.179024.40647000.00000002.mdmp") Found URL "https://clients2.google.com/cr/report%08x%x00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899getsystemtimepreciseasfiletime__next_prime" - Source: "00000000-00004108.00000000.179024.8038D000.00000002.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004196.00000000.177692.005C0000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportmdata;are\microsoft\windows" - Source: "00000000-00004196.00000000.177692.057F0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00004196.00000000.177692.72D11000.00000020.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00004196.00000000.177692.72D11000.00000020.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllpconfigut-53e7e780-2330-40c6-94c6-be75e946e933software\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00004196.00000000.177692.72D11000.00000020.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00004196.00000000.177692.72DF1000.00000020.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004196.00000001.178288.005C0000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportmdata;ftupd" - Source: "00000000-00004196.00000001.178288.057F0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004336.00000000.178646.00A10000.00000004.mdmp") Found URL "https://watson.telemetry.microsoft.comoftware\microsoft\sqmclient\windows\commondatapoints807310433457345724575929012728system\currentcontrolset\control\systeminformationsystemmanufacturerbiosversionsystemproductnamecomputerhardwareidhardware\description\system\centralprocessor\0" - Source: "00000000-00004572.00000000.179398.9D91F000.00000002.mdmp") Found URL "https://nw-umwatson.events.data.microsoft.com/telemetry.requestapplication/xmlcontent-typecontent-lengthmsa_deviceticketapplication/x-binarywerreportmetadataprocess_idprocessinformationimagenamecmdlinesignatureuptimewow64iptenabledprocessmetadataproblemsignatureseventtypeparameter%04d-%02d-%02dt%02d:%02d:%02dzreportinformationguidsourcecreationtimememorymini..\..\third_party\crashpad\crashpad\edge_watson_uploader\secondary_data_collectors\file_collector_win.ccgetfileattributes" - Source: "00000000-00004572.00000000.179398.9D91F000.00000002.mdmp") Found URL "https://crashpad.chromium.org/https://crashpad.chromium.org/bug/newreport" - Source: "00000000-00004572.00000000.179398.9D91F000.00000002.mdmp") Found URL "http://www.w3.org/2000/xmlns/" - Source: "00000000-00004572.00000000.179398.9D91F000.00000002.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006640.00000000.179513.03080000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007876.00000000.179000.008B0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007876.00000001.179183.008B0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?emgvw,czc%wvfgreater" - Source: "00000000-00007876.00000001.179183.00963000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00007876.00000001.179183.00963000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00007876.00000001.179183.00963000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00007876.00000001.179183.00963000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00007876.00000001.179183.00963000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00007876.00000001.179183.00963000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00007876.00000001.179183.00963000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00007876.00000001.179183.00963000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00007876.00000001.179183.00963000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcnew" - Source: "00000000-00007876.00000001.179183.00963000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007876.00000001.179183.00963000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwfa" - Source: "00000000-00007876.00000001.179183.00963000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00007876.00000001.179183.00963000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00007876.00000001.179183.00963000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007876.00000001.179183.077E0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00007876.00000001.179183.077E0000.00000004.mdmp")6b:T512,YARA signature for RSA public and private key matched on file "Microsoft.Deployment.Compression.Cab.dll" YARA signature for RSA public and private key matched on file "ScreenConnect.WindowsInstaller.dll" YARA signature for RSA public and private key matched on process "00000000-00004196" YARA signature for RSA public and private key matched on file "AForge.dll" YARA signature for RSA public and private key matched on file "Microsoft.Deployment.WindowsInstaller.Package.dll" YARA signature for RSA public and private key matched on file "SharpDX.Mathematics.dll" YARA signature for RSA public and private key matched on file "NAudio.WinForms.dll" YARA signature for RSA public and private key matched on file "ScreenConnect.WindowsClient.exe" YARA signature for RSA public and private key matched on file "SharpDX.D3DCompiler.dll" YARA signature for RSA public and private key matched on file "AForge.Video.dll" YARA signature for RSA public and private key matched on file "ScreenConnect.WindowsBackstageShell.exe" YARA signature for RSA public and private key matched on file "ScreenConnect.InstallerActions.dll" YARA signature for RSA public and private key matched on file "SharpDX.Direct3D11.dll" YARA signature for RSA public and private key matched on file "NAudio.WinMM.dll"6c:T723,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004196.00000000.177692.005C0000.00000004.mdmp, 00000000-00004196.00000001.178288.005C0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004196.00000000.177692.005C0000.00000004.mdmp, 00000000-00004196.00000001.178288.005C0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00004196.00000000.177692.005C0000.00000004.mdmp, 00000000-00004196.00000001.178288.005C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004196.00000000.177692.005C0000.00000004.mdmp, 00000000-00004196.00000001.178288.005C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004196.00000000.177692.005C0000.00000004.mdmp, 00000000-00004196.00000001.178288.005C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004196.00000000.177692.005C0000.00000004.mdmp, 00000000-00004196.00000001.178288.005C0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00004196.00000000.177692.005C0000.00000004.mdmp, 00000000-00004196.00000001.178288.005C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004196.00000000.177692.005C0000.00000004.mdmp, 00000000-00004196.00000001.178288.005C0000.00000004.mdmp")6d:T898,"__ConvertFromBase64StringFlexible" (Indicator: "base64"; Source: "00000000-00004196.00000000.177692.08190000.00000004.mdmp") Found string "<1>__ConvertFromBase64StringFlexible" (Indicator: "FromBase64String"; Source: "00000000-00004196.00000000.177692.08190000.00000004.mdmp") Found string "ZipFile" (Indicator: "zipfile"; Source: "00000000-00004196.00000000.177692.08190000.00000004.mdmp")6f:Tcef,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin") Found reference to API "GetModuleHandleExA" (Indicator: "GetModuleHandle"; File: "5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin") Found reference to API "indowsNative.EnumProcesses(processIDs, processIDsSize, out var bytesCopied)" (Indicator: "EnumProcesses"; File: "AMSI") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004196.00000000.177692.00CDD000.00000002.mdmp, 00000000-00004196.00000000.177692.05B50000.00000004.mdmp, 00000000-00004196.00000000.177692.08190000.00000004.mdmp, 00000000-00004196.00000001.178288.05A70000.00000004.mdmp, 00000000-00004196.00000001.178288.08220000.00000004.mdmp, 00000000-00004196.00000001.178288.72DA1000.00000002.mdmp, 00000000-00004196.00000001.178288.72E05000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004196.00000000.177692.00CDD000.00000002.mdmp, 00000000-00004196.00000001.178288.08220000.00000004.mdmp, 00000000-00004196.00000001.178288.72DA1000.00000002.mdmp, 00000000-00004196.00000001.178288.72E05000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004196.00000000.177692.00CDD000.00000002.mdmp, 00000000-00004196.00000001.178288.08220000.00000004.mdmp, 00000000-00004196.00000001.178288.72DA1000.00000002.mdmp, 00000000-00004196.00000001.178288.72E05000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004196.00000000.177692.00CDD000.00000002.mdmp, 00000000-00004196.00000001.178288.08220000.00000004.mdmp, 00000000-00004196.00000001.178288.72DA1000.00000002.mdmp, 00000000-00004196.00000001.178288.72E05000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00004196.00000000.177692.00CDD000.00000002.mdmp, 00000000-00004196.00000001.178288.08220000.00000004.mdmp") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; Source: "00000000-00004196.00000000.177692.058A0000.00000004.mdmp, 00000000-00004196.00000000.177692.05B50000.00000004.mdmp, 00000000-00004196.00000001.178288.08220000.00000004.mdmp") Found reference to API "GetCurrentProcessMainModuleFileName" (Indicator: "GetCurrentProcess"; Source: "00000000-00004196.00000000.177692.08190000.00000004.mdmp")70:T5dd,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin") Found reference to API "GetModuleHandleExA" (Indicator: "GetModuleHandle"; File: "5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004196.00000000.177692.00CDD000.00000002.mdmp, 00000000-00004196.00000001.178288.08220000.00000004.mdmp, 00000000-00004196.00000001.178288.72DA1000.00000002.mdmp, 00000000-00004196.00000001.178288.72E05000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004196.00000000.177692.00CDD000.00000002.mdmp, 00000000-00004196.00000001.178288.08220000.00000004.mdmp, 00000000-00004196.00000001.178288.72DA1000.00000002.mdmp, 00000000-00004196.00000001.178288.72E05000.00000002.mdmp") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; Source: "00000000-00004196.00000000.177692.058A0000.00000004.mdmp, 00000000-00004196.00000000.177692.05B50000.00000004.mdmp, 00000000-00004196.00000001.178288.08220000.00000004.mdmp")71:T943,Found reference to API "GetSidIdentifierAuthority" (Indicator: "GetSidIdentifierAuthority"; File: "5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin") Found reference to API "CreateWellKnownSid" (Indicator: "CreateWellKnownSid"; File: "5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; File: "5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin") Found reference to API "SetSecurityDescriptorOwner" (Indicator: "SetSecurityDescriptorOwner"; File: "5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; File: "5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin") Found reference to API "ImpersonateLoggedOnUser" (Indicator: "ImpersonateLoggedOnUser"; File: "5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin") Found reference to API "AddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; File: "5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin") Found reference to API "AllocateLocallyUniqueId" (Indicator: "AllocateLocallyUniqueId"; File: "5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin") Found reference to API "IsWellKnownSid" (Indicator: "IsWellKnownSid"; File: "5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin") Found reference to API "ystem.Runtime.CompilerServices.IgnoresAccessChecksToAttribute" (Indicator: "AccessCheck"; File: "AMSI")72:Tb5a,Observed import api "AddAccessAllowedAce" which can "add an access-allowed access control entry (ACE) to an access control list (ACL)" [Source: ScreenConnect.WindowsCredentialProvider.dll] Observed import api "CreateWellKnownSid" which can "create a SID for predefined aliases" [Source: ScreenConnect.WindowsCredentialProvider.dll] Observed import api "GetSidIdentifierAuthority" which can "return a pointer to the SID_IDENTIFIER_AUTHORITY structure in a specified security identifier (SID)" [Source: ScreenConnect.WindowsCredentialProvider.dll] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: ScreenConnect.WindowsCredentialProvider.dll] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: ScreenConnect.WindowsCredentialProvider.dll] Observed import api "ImpersonateLoggedOnUser" which can "let the calling thread impersonate the security context of a logged-on user" [Source: ScreenConnect.WindowsCredentialProvider.dll] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: ScreenConnect.WindowsCredentialProvider.dll] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: ScreenConnect.WindowsCredentialProvider.dll] Observed import api "RevertToSelf" which can "terminate the impersonation of a client application" [Source: ScreenConnect.WindowsCredentialProvider.dll] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: ScreenConnect.WindowsCredentialProvider.dll] Observed import api "SetSecurityDescriptorOwner" which can "set the owner information of an absolute-format security descriptor" [Source: ScreenConnect.WindowsCredentialProvider.dll] Observed import api "AllocateLocallyUniqueId" which can "allocate a locally unique identifier (LUID)" [Source: ScreenConnect.WindowsAuthenticationPackage.dll] Observed import api "CreateWellKnownSid" which can "create a SID for predefined aliases" [Source: ScreenConnect.WindowsAuthenticationPackage.dll] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: ScreenConnect.WindowsAuthenticationPackage.dll] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: ScreenConnect.WindowsAuthenticationPackage.dll] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: ScreenConnect.WindowsAuthenticationPackage.dll] Observed import api "IsWellKnownSid" which can "compare a SID to a well-known SID and returns TRUE if they match" [Source: ScreenConnect.WindowsAuthenticationPackage.dll]73:Teb9,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00004196.00000000.177692.005C0000.00000004.mdmp, 00000000-00004196.00000001.178288.005C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$29","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00002308.00000001.177678.1DD70000.00000004.mdmp\n Observed string: \"\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00002308.00000001.177678.1DDFD000.00000004.mdmp\n Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00004196.00000000.177692.005C0000.00000004.mdmp\n 00000000-00004196.00000001.178288.005C0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Detected msiexec.exe process execution","description":"Process \"msiexec.exe\" with commandline \"/i \"%TEMP%\\\\ScreenConnect\\\\26.1.24.9579\\\\6ce013872f0efb83\\\\ScreenConnect.ClientSetup.msi\" SC_EXE_PATH=\"%LOCALAPPDATA%\\\\MyAppBundle\\\\FirstApp.exe\"\" (UID: 00000000-00002592)\n\n Process \"MsiExec.exe\" with commandline \"-Embedding 5DF786CE551AE19E30C1C7AFF8D71480 C\" (UID: 00000000-00007828)\n\n Process \"MsiExec.exe\" with commandline \"-Embedding 566F4EE33FECE876F7280716A64D6D5C\" (UID: 00000000-00000196)\n\n Process \"MsiExec.exe\" with commandline \"-Embedding F5299EB4584278F70BEFEF3919501237 E Global\\\\MSI0000\" (UID: 00000000-00008016)\n","origin":"Monitored Target","mitre_attack_id":"T1218.007","relevance":2,"id":"target-152","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet code contains potential unpacker","description":"Observed function \"System.Reflection.Load\" in \"SecondApp.exe\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains encryption/decryption functions","description":"Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"SecondApp.exe\"\n Observed namespace \"System.Security.Cryptography\" and MemberReference \"TransformFinalBlock\" in \"SecondApp.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-134","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"System\" and MemberReference \"GetMethod\" in \"SecondApp.exe\"\n Observed namespace \"System\" and MemberReference \"GetMethods\" in \"SecondApp.exe\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file resource with suspicious entropy","description":"SecondApp.exe has big resource with name: \"costura.messagepack.dll.compressed\" size: \"146677\" and abnormal entropy:\"7.995673663150094\"\n SecondApp.exe has big resource with name: \"costura.system.collections.immutable.dll.compressed\" size: \"105501\" and abnormal entropy:\"7.993459079455883\"\n SecondApp.exe has big resource with name: \"costura.system.memory.dll.compressed\" size: \"59807\" and abnormal entropy:\"7.995401382862062\"\n SecondApp.exe has big resource with name: \"costura.system.numerics.vectors.dll.compressed\" size: \"32868\" and abnormal entropy:\"7.984935838008249\"\n SecondApp.exe has big resource with name: \"costura.system.threading.tasks.extensions.dll.compressed\" size: \"13443\" and abnormal entropy:\"7.981863170742442\"\n SecondApp.exe has big resource with name: \"costura.pulsar.common.dll.compressed\" size: \"71454\" and abnormal entropy:\"7.992402238170917\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00004196.00000000.177692.058A0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004196.00000000.177692.05B50000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004196.00000000.177692.08190000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004196.00000001.178288.05A70000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004196.00000001.178288.05B10000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004196.00000001.178288.08220000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\.\\pipe\\; Source: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2b","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"MsiExec.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Able to detect if debugger is present","description":"Observed API \"NtQueryInformationProcess\" in \"SecondApp.exe\"\n Observed API \"IsDebuggerPresent\" in \"SecondApp.exe\"","origin":"Static Parser","mitre_attack_id":"T1622","relevance":1,"id":"static-220","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00003692-00000C2C-1755244481\")\n Found reference to API \"CryptUnprotectDataW\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00003692-00000C2C-1755244511\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00004108.00000000.179024.A56F0000.00000020.mdmp, 00000000-00004108.00000000.179024.A7800000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decode string content at runtime (.NET)","description":"Observed function \"FromBase64String\" in \"SecondApp.exe\"\n Observed function \"ToBase64String\" in \"SecondApp.exe\"\n Observed function \"ToBase64String\" in \"ScreenConnect.ClientService.dll\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"BCryptGenRandom\" (Indicator: \"BCryptGenRandom\"; File: \"5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin\")\n Found api reference \"BCryptGenRandom\" (Indicator: \"CryptGenRandom\"; File: \"5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin\")\n Found api reference \"CryptHashCertificate\" (Indicator: \"CryptHashCertificate\"; File: \"5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin\")\n Found api reference \"CertFreeCertificateContext\" (Indicator: \"CertFreeCertificateContext\"; File: \"5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin\")\n Found api reference \"CryptEncrypt failed with status code 0x{0:X8}.\" (Indicator: \"CryptEncrypt\"; File: \"AMSI\")\n Found api reference \"CryptDecrypt failed with status code 0x{0:X8}.\" (Indicator: \"CryptDecrypt\"; File: \"AMSI\")\n Found api reference \"CryptImportKey failed with status code 0x{0:X8}.\" (Indicator: \"CryptImportKey\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"<1>__ConvertFromBase64StringFlexible\" (Indicator: \"FromBase64String\"; Source: \"00000000-00004196.00000000.177692.08190000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES cryptographic operations (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.Aes\" and TypeReference \"Create\" in \"SecondApp.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-167","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptHashCertificate\" (Indicator: \"CryptHashCertificate\"; File: \"5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin\")\n Found reference to API \"CertFreeCertificateContext\" (Indicator: \"CertFreeCertificateContext\"; File: \"5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin\")\n Found reference to API \"CryptEncrypt failed with status code 0x{0:X8}.\" (Indicator: \"CryptEncrypt\"; File: \"AMSI\")\n Found reference to API \"CryptDecrypt failed with status code 0x{0:X8}.\" (Indicator: \"CryptDecrypt\"; File: \"AMSI\")\n Found reference to API \"CryptImportKey failed with status code 0x{0:X8}.\" (Indicator: \"CryptImportKey\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform CryptoStream operations (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.CryptoStream\" and TypeReference \"FlushFinalBlock\" in \"SecondApp.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-166","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform asymmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.X509Certificates.RSACertificateExtensions\" and TypeReference \"GetRSAPublicKey\" in \"SecondApp.exe\"\n Observed namespace \"System.Security.Cryptography.RSASignaturePadding\" and TypeReference \"get_Pkcs1\" in \"SecondApp.exe\"\n Observed namespace \"System.Security.Cryptography.RSA\" and TypeReference \"VerifyHash\" in \"SecondApp.exe\"","origin":"Static Parser","mitre_attack_id":"T1573.002","relevance":1,"id":"static-141","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in [Source: \"SecondApp.exe\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt failed with status code 0x{0:X8}.\" (Indicator: \"CryptDecrypt\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"EncryptRSA\" (Indicator: \"EncryptRSA\"; Source: \"00000000-00004196.00000000.177692.08190000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.Aes\" and TypeReference \"Create\" in \"SecondApp.exe\"\n Observed namespace \"System.Security.Cryptography.TripleDESCryptoServiceProvider\" and TypeReference \".ctor\" in \"SecondApp.exe\"\n Observed namespace \"System.Security.Cryptography.AesManaged\" and TypeReference \".ctor\" in \"SecondApp.exe\"","origin":"Static Parser","mitre_attack_id":"T1573.001","relevance":1,"id":"static-140","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric encryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateEncryptor\" in \"SecondApp.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-165","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"CryptEncrypt failed with status code 0x{0:X8}.\" (Indicator: \"CryptEncrypt\"; File: \"AMSI\")\n Found reference to API \"CryptDecrypt failed with status code 0x{0:X8}.\" (Indicator: \"CryptDecrypt\"; File: \"AMSI\")\n Found reference to API \"CryptImportKey failed with status code 0x{0:X8}.\" (Indicator: \"CryptImportKey\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00002308.00000001.177678.1DDFD000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains symmetric decryption functionality in .NET code","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"SecondApp.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-168","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2d","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2e","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2f","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"$30","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002308-00000C2C-1716165013\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002308-00000C2C-1716328644\")\n Found reference to API \"::NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004108.00000000.179024.40647000.00000002.mdmp\")\n Found reference to API \"NtQuerySystemInformation SystemExtendedHandleInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004108.00000000.179024.40647000.00000002.mdmp\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004108.00000000.179024.40647000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system file/directory information (.NET)","description":"Observed dotnet function \"GetDirectories\" in \"SecondApp.exe\"\n Observed dotnet function \"GetFiles\" in \"SecondApp.exe\"\n Observed dotnet function \"EnumerateDirectories\" in \"SecondApp.exe\"\n Observed dotnet function \"EnumerateFiles\" in \"SecondApp.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":3,"id":"static-200","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002308-00000C2C-1716165013\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002308-00000C2C-1716328644\")\n Found string \"::NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004108.00000000.179024.40647000.00000002.mdmp\")\n Found string \"NtQuerySystemInformation SystemExtendedHandleInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004108.00000000.179024.40647000.00000002.mdmp\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004108.00000000.179024.40647000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using web history","description":"Found string \"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\formhistory.sqlite\" (Source: \"00000000-00003692-00000C3D-32277585820\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-662","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"file/memory contains long string with (Indicator: \"ProcessIdToSessionId\"; File: \"ScreenConnect.WindowsBackstageShell.exe\")\n Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; File: \"5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin\")\n Found reference to API \"::WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00004108.00000000.179024.40647000.00000002.mdmp, 00000000-00004108.00000000.179024.8038D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to obtain MAC address in .NET file","description":"Observed retrieval of MAC address \"System.Net.NetworkInformation.GetPhysicalAddress\" in \"SecondApp.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-216","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00002308-00000C2C-1714218920\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00002308-00000C2C-1714219504\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002308-00000C2C-1716340274\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002308-00000C2C-1716340304\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004108.00000000.179024.40647000.00000002.mdmp, 00000000-00004108.00000000.179024.8038D000.00000002.mdmp\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00004108.00000000.179024.40647000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"QueryServiceStatus\" (File: \"5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"EnumSystemLocalesW\" (Indicator: \"EnumSystemLocales\"; File: \"5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve browser cookies data","description":"file/memory contains long string with (Indicator: \"moz_cookies\"; File: \"tmp9927.tmp.tmpdb\")\n Found string \"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\cookies.sqlite\" (Indicator: \"cookies.sqlite\"; Source: \"00000000-00003692-00000C3D-32302275740\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-5058","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00002308-00000C2C-1725040444\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in file \"5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin\"\n Found system information discovery API: \"RtlNtStatusToDosError\" in file \"5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00004196.00000000.177692.00CDD000.00000002.mdmp, 00000000-00004196.00000001.178288.08220000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"k__BackingField\" (Indicator: \"nthash\"; Source: \"00000000-00004196.00000000.177692.08190000.00000004.mdmp\")\n Found string \"k__BackingField\" (Indicator: \"nthash\"; Source: \"00000000-00004196.00000000.177692.08190000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1003.002","relevance":1,"id":"string-867","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access web session cookie","description":"Found string \"--user-data-dir=\" (Indicator: \"--user-data-dir\"; Source: \"00000000-00004108.00000000.179024.8038D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1550.004","relevance":1,"id":"string-794","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$6c","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: ScreenConnect.WindowsCredentialProvider.dll]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: ScreenConnect.WindowsAuthenticationPackage.dll]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: ScreenConnect.ClientService.exe]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to monitor clipboard data (API string)","description":"Found string \"AddClipboardFormatListener\" (Source: \"00000000-00003692-00000C2C-1742892150\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-925","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKeyW\" in file \"5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin\")\n Found reference to API \"LookupAccountSidW\" (Indicator: \"LookupAccountSid\"; File: \"5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin\")\n Found reference to API \"LsaGetLogonSessionData\" (Indicator: \"LsaGetLogonSessionData\"; File: \"5c799922f4e11ec30bbb60e39868b9d1892a681ff553c1da8df4bd0405e7374e.bin\")\n Found reference to API \"indowsNative.WTSQuerySessionInformation(IntPtr.Zero, sessionID, infoClass, out var outPtr, out _)\" (Indicator: \"WTSQuerySessionInformation\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\" Microsoft Corporation\"\n \"ScreenConnect.WindowsFileManager.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\" \"instanceId=j4mzml&instanceFingerprint=6ce013872f0efb83&filePath=C%3a%5cUsers%5cHAPUBWS%5cAppData%5cLocal%5cMyAppBundle%5cFirstApp.exe&sessionId=ccbfc75b-9d43-4396-9456-97e91ab8e4d6&host=&referrer=&zone=&productVersion=26.1.24.9579\" HTTP/1.1 200 OK\nDate: Mon\n 04 May 2026 17:49:27 GMT\nContent-Length: 0\nConnection: keep-alive\nCache-Control: private\nServer: Microsoft-IIS/10.0\nX-AspNet-Version: 4.0.30319\nX-Powered-By: ASP.NET with no response body","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$77","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$78","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$79","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"suspicious","category":"Network Related","name":"Employs a browser-related User Agent without launching browser","description":"Found User Agent(s): Mozilla/5.0 (Windows NT; Windows NT 6.2; en-US) WindowsPowerShell/5.1.16299.248","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 140.82.113.4 on port 443 is sent without HTTP header\n TCP traffic to 185.199.111.133 on port 443 is sent without HTTP header\n TCP traffic to 172.66.175.107 on port 443 is sent without HTTP header\n TCP traffic to 104.16.185.241 on port 80 is sent without HTTP header\n TCP traffic to 208.95.112.1 on port 80 is sent without HTTP header\n TCP traffic to 18.209.126.148 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$7a","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$7b","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$7c","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"69f8dbd70618cd00f00806a2"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"