34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 3d:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4db,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious Capa_reference_SQL_statements Sample 8198b241640f… — Score 70/100 — Hybrid Analysis","description":"Suspicious verdict for sample 8198b241640f…. Malware family: Capa_reference_SQL_statements. Threat score 70/100. 1/27 AV engines flagged this file. 0 malicious and 3 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/8198b241640f4c5690eebdd1f3e38a47c3f835a04cc455d873630df8d476abc5","keywords":["Suspicious","Capa_reference_SQL_statements","malware analysis","sandbox report","threat intelligence","8198b241640f4c5690eebdd1f3e38a47c3f835a04cc455d873630df8d476abc5"],"about":{"@type":"SoftwareApplication","name":"RNetDecom.v0.28.exe","applicationCategory":["peexe","64bits","assembly","executable"],"identifier":"8198b241640f4c5690eebdd1f3e38a47c3f835a04cc455d873630df8d476abc5","additionalType":"Suspicious sample"},"threatScore":70,"malwareFamily":"Capa_reference_SQL_statements","antivirusDetections":{"malicious":1,"total":27},"behavioralIndicators":{"malicious":0,"suspicious":3},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:Ta4b,file/memory contains long string with (Indicator: "select"; Source: "sample.bin"), Found reference to API "System.Runtime.InteropServices" (Indicator: "time"; Source: "sample.bin"), file/memory contains long string with (Indicator: "time"; Source: "sample.bin"), file/memory contains long string with (Indicator: "write"; Source: "sample.bin"), file/memory contains long string with (Indicator: "stat"; Source: "sample.bin"), file/memory contains long string with (Indicator: "sync"; Source: "sample.bin"), file/memory contains long string with (Indicator: "accept"; Source: "sample.bin"), file/memory contains long string with (Indicator: "read"; Source: "sample.bin"), file/memory contains long string with (Indicator: "security"; Source: "sample.bin"), file/memory contains long string with (Indicator: "creat"; Source: "sample.bin"), file/memory contains long string with (Indicator: "mount"; Source: "sample.bin"), file/memory contains long string with (Indicator: "exit"; Source: "sample.bin"), file/memory contains long string with (Indicator: "open"; Source: "sample.bin"), file/memory contains long string with (Indicator: "tee"; Source: "sample.bin"), file/memory contains long string with (Indicator: "rename"; Source: "sample.bin"), file/memory contains long string with (Indicator: "connect"; Source: "sample.bin"), file/memory contains long string with (Indicator: "bind"; Source: "sample.bin"), file/memory contains long string with (Indicator: "access"; Source: "sample.bin"), file/memory contains long string with (Indicator: "dup"; Source: "sample.bin"), file/memory contains long string with (Indicator: "close"; Source: "sample.bin"), Found reference to API "ControlKeyStates" (Indicator: "stat"; Source: "sample.bin"), file/memory contains long string with (Indicator: "link"; Source: "sample.bin"), Found reference to API "WriteAllText" (Indicator: "write"; Source: "sample.bin"), file/memory contains long string with (Indicator: "lstat"; Source: "sample.bin"), Found reference to API "ShouldExit" (Indicator: "exit"; Source: "sample.bin"), Found reference to API "AsyncCallback" (Indicator: "sync"; Source: "sample.bin"), file/memory contains long string with (Indicator: "times"; Source: "sample.bin"), Found reference to API "StreamReader" (Indicator: "read"; Source: "sample.bin"), Found reference to API "WriteVerboseLine" (Indicator: "write"; Source: "sample.bin"), Found reference to API "WriteVerboseLine" (Indicator: "writev"; Source: "sample.bin"), Found reference to API "get_ExitCode" (Indicator: "exit"; Source: "sample.bin"), Found reference to API "timer" (Indicator: "time"; Source: "sample.bin")37:T1480," } 'Scheduled task' { if($Path -notmatch '^\\' -or $Path -match '[*?]'){throw 'An exact discovered task path is required.'} $tasks=@(Get-ScheduledTask -ErrorAction Stop|Where-Object {$_.TaskName -ceq $Name -and $_.TaskPath -ceq $Path}) if(-not $tasks.Count){return 'Task verified already absent.'} if($tasks.Count -ne 1 -or [string]$tasks[0].State -ne 'Disabled'){throw 'Disable the exact scheduled task before deleting it.'} Unregister-ScheduledTask -InputObject $tasks[0] -Confirm:$false -ErrorAction Stop if(@(Get-ScheduledTask -ErrorAction Stop|Where-Object {$_.TaskName -ceq $Name -and $_.TaskPath -ceq $Path}).Count){throw 'Scheduled task still exists.'} } '32-bit ODBC' { $expected='HKLM:\Software\WOW6432Node\ODBC\ODBC.INI\'+$Name $actual=$Path -replace '^HKEY_LOCAL_MACHINE\\','HKLM:\' if($Name -match '[\\/]' -or $actual -ine $expected){throw 'The exact discovered 32-bit ODBC " in Source: sample.bin, "{ if($Status.Cancel){New-RNetRow 'Citrix' '' 'Scan status' 'Discovery' '' 'Partial' 'Cancelled; review completed results';return} $short=$vda.Split('.')[0] if($vda -notlike '*.cadency.host' -or -not @($vdaPatterns|Where-Object {$short -match $_.Regex}).Count){New-RNetRow 'Citrix' $vda 'Scan status' 'VDA classification' '' 'Review' 'No established RNet VDA naming match; not scanned';continue} $Status.Message="VDA client folder and ODBC: $vda" try { $path=([string]$Config.RNetDecomConfig.Discovery.VdaClientFolder).Replace('{client}',$Client) $rows=Invoke-RNetRemote $Config $vda { param($Path,$Client) if(Test-Path -LiteralPath $Path -ErrorAction Stop){[pscustomobject]@{Category='Folder';Name=$Client;Path=$Path;State='Found'}} $dsn='HKLM:\Software\WOW6432Node\ODBC\ODBC.INI\'+$Client if(Test-Path -LiteralPath $dsn -ErrorAction Stop){[pscustomobject]@{Category='32-bit ODBC';Name=$Client;Pa" in Source: sample.bin, "key is required.'} if(Test-Path -LiteralPath $expected){Remove-Item -LiteralPath $expected -Recurse -Force -ErrorAction Stop} $sources='HKLM:\Software\WOW6432Node\ODBC\ODBC.INI\ODBC Data Sources' if(Test-Path -LiteralPath $sources){$properties=Get-ItemProperty -LiteralPath $sources -ErrorAction Stop;if($properties.PSObject.Properties[$Name]){Remove-ItemProperty -LiteralPath $sources -Name $Name -ErrorAction Stop}} if(Test-Path -LiteralPath $expected){throw 'ODBC key still exists.'} if((Test-Path -LiteralPath $sources) -and (Get-ItemProperty -LiteralPath $sources -ErrorAction Stop).PSObject.Properties[$Name]){throw 'ODBC source registration still exists.'} } {$_ -in @('Folder','UAR Data')} { if($Path -notmatch '^[A-Za-z]:\\' -or $Path -match '[*?]' -or ($Path -split '[\\/]') -contains '..'){throw 'An exact local client folder path is required.'} $full=[IO.Path]::GetFullPath($Path).TrimEnd('\') $allow" in Source: sample.bin, " 'HKLM:\SOFTWARE\WOW6432Node\Ipswitch\iFtpSvc\Setup', 'HKLM:\SOFTWARE\Ipswitch\iFtpSvc\Setup', 'HKLM:\SOFTWARE\WOW6432Node\Progress\iFtpSvc\Setup', 'HKLM:\SOFTWARE\Progress\iFtpSvc\Setup' )) { try { $setup = Get-ItemProperty -Path $registryPath -Name SQLServerName -ErrorAction Stop if ($setup -and -not [string]::IsNullOrWhiteSpace([string]$setup.SQLServerName)) { return [pscustomobject]@{ ComputerName = $env:COMPUTERNAME RegistryPath = $registryPath SQLServerName = [string]$setup.SQLServerName } } } catch {} } throw 'Unable to resolve the WS_FTP SQL Server name from the iFtpSvc registry setup key.' } $invokeParameters = @{ ComputerName = [string]$Plan.SftpServer ScriptBlock = $scriptBlock ErrorAction = 'Stop' " in Source: sample.bin, "duled tasks' '' 'Error' $_.Exception.Message } try { $base='HKLM:\Software\WOW6432Node\ODBC\ODBC.INI' if(Test-Path -LiteralPath $base) { foreach($d in @(Get-ChildItem -LiteralPath $base -ErrorAction Stop)) { if($d.PSChildName -eq 'ODBC Data Sources' -or -not (hasClient $d.PSChildName)) {continue} $props=Get-ItemProperty -LiteralPath $d.PSPath -ErrorAction Stop $sql='';$db='' if($props.PSObject.Properties['Server']) {$sql=[string]$props.Server} if($props.PSObject.Properties['Database']) {$db=[string]$props.Database} emit '32-bit ODBC' $d.PSChildName $d.Name 'Found' "SQL: $sql | Database: $db" $sql $db } } emit 'Scan status' '32-bit ODBC' '' 'Complete' '' } catch { emit 'Scan status' '32-bit ODBC' '' 'Error' $_.Exception.Message } foreach($root in $Roots) { $queue=New-Object 'System.Collections.Generic.Queue[string]'; $queue.Enqueue($root); $" in Source: sample.bin38:T10ce,"lPath $ConfiguredPath).FullName } } foreach ($candidate in @( 'D:\Apps\Ipswitch\WS_FTP Server\iftpaddu.exe', 'C:\Program Files\Progress\WS_FTP Server\iftpaddu.exe', 'C:\Program Files (x86)\Progress\WS_FTP Server\iftpaddu.exe', 'C:\Program Files\Ipswitch\WS_FTP Server\iftpaddu.exe', 'C:\Program Files (x86)\Ipswitch\WS_FTP Server\iftpaddu.exe' )) { if (Test-Path -LiteralPath $candidate -PathType Leaf) { return (Get-Item -LiteralPath $candidate).FullName } } $pathCommand = Get-Command iftpaddu.exe -ErrorAction SilentlyContinue | Select-Object -First 1 if ($pathCommand) { return [string]$pathCommand.Source } if (-not [string]::IsNullOrWhiteSpace($ConfiguredPath)) { throw "iftpaddu.exe was not found at the configured path '$ConfiguredPath' " (Indicator: "\ipswitch\") in Source: sample.bin, " ([int64]$userPreflightCommand.ExecuteScalar() -ne 1) { throw "The discovered WS_FTP user '$($discoveredUser.UserLoginID)' changed or no longer matches UserID $($discoveredUser.UserID) and home folder '$($discoveredUser.HomeFolder)'. Run discovery again." } } finally { $userPreflightConnection.Dispose() } $scriptBlock = { param($UtilityPath, $UserName, $HostName) $resolvedUtilityPath = $UtilityPath if (-not (Test-Path -LiteralPath $resolvedUtilityPath -PathType Leaf)) { $shortUtilityPath = 'D:\Apps\Ipswitch\WS_FTP Server\iftpaddu.exe' if (Test-Path -LiteralPath $shortUtilityPath -PathType Leaf) { $resolvedUtilityPath = $shortUtilityPath } else { throw "iftpaddu.exe was not found at the configured path '$UtilityPath' or the shorter WS_FTP installation path '$shortUtilityPath'." } " (Indicator: "\ipswitch\") in Source: sample.bin, "or the shorter WS_FTP installation path 'D:\Apps\Ipswitch\WS_FTP Server\iftpaddu.exe'." } throw 'iftpaddu.exe was not found. Configure Prework/SftpHandoff/WsFtpUtilityPath in DecomTool.config.xml.' } function Invoke-Iftpaddu { param( [string]$Mode, [string]$ResolvedUtilityPath ) $arguments = [System.Collections.Generic.List[string]]::new() if ($Mode -eq 'Modify') { [void]$arguments.Add('-mod') } else { [void]$arguments.Add('-add') } [void]$arguments.Add('-u') [void]$arguments.Add($UserName) if (-not [string]::IsNullOrWhiteSpace($HostName)) { [void]$arguments.Add('-h') [void]$arguments.Add($HostName) } if (-not [string]::IsNullOrWhiteSpace($FullName)) { [void]$arguments.Add('-n') [void]$arguments.Add" (Indicator: "\ipswitch\") in Source: sample.bin, " 'HKLM:\SOFTWARE\WOW6432Node\Ipswitch\iFtpSvc\Setup', 'HKLM:\SOFTWARE\Ipswitch\iFtpSvc\Setup', 'HKLM:\SOFTWARE\WOW6432Node\Progress\iFtpSvc\Setup', 'HKLM:\SOFTWARE\Progress\iFtpSvc\Setup' )) { try { $setup = Get-ItemProperty -Path $registryPath -Name SQLServerName -ErrorAction Stop if ($setup -and -not [string]::IsNullOrWhiteSpace([string]$setup.SQLServerName)) { return [pscustomobject]@{ ComputerName = $env:COMPUTERNAME RegistryPath = $registryPath SQLServerName = [string]$setup.SQLServerName } } } catch {} } throw 'Unable to resolve the WS_FTP SQL Server name from the iFtpSvc registry setup key.' } $invokeParameters = @{ ComputerName = [string]$Plan.SftpServer ScriptBlock = $scriptBlock ErrorAction = 'Stop' " (Indicator: "\ipswitch\") in Source: sample.bin39:Tc6a,"lPath $ConfiguredPath).FullName } } foreach ($candidate in @( 'D:\Apps\Ipswitch\WS_FTP Server\iftpaddu.exe', 'C:\Program Files\Progress\WS_FTP Server\iftpaddu.exe', 'C:\Program Files (x86)\Progress\WS_FTP Server\iftpaddu.exe', 'C:\Program Files\Ipswitch\WS_FTP Server\iftpaddu.exe', 'C:\Program Files (x86)\Ipswitch\WS_FTP Server\iftpaddu.exe' )) { if (Test-Path -LiteralPath $candidate -PathType Leaf) { return (Get-Item -LiteralPath $candidate).FullName } } $pathCommand = Get-Command iftpaddu.exe -ErrorAction SilentlyContinue | Select-Object -First 1 if ($pathCommand) { return [string]$pathCommand.Source } if (-not [string]::IsNullOrWhiteSpace($ConfiguredPath)) { throw "iftpaddu.exe was not found at the configured path '$ConfiguredPath' " (Indicator: "\ipswitch\ws_ftp"), " ([int64]$userPreflightCommand.ExecuteScalar() -ne 1) { throw "The discovered WS_FTP user '$($discoveredUser.UserLoginID)' changed or no longer matches UserID $($discoveredUser.UserID) and home folder '$($discoveredUser.HomeFolder)'. Run discovery again." } } finally { $userPreflightConnection.Dispose() } $scriptBlock = { param($UtilityPath, $UserName, $HostName) $resolvedUtilityPath = $UtilityPath if (-not (Test-Path -LiteralPath $resolvedUtilityPath -PathType Leaf)) { $shortUtilityPath = 'D:\Apps\Ipswitch\WS_FTP Server\iftpaddu.exe' if (Test-Path -LiteralPath $shortUtilityPath -PathType Leaf) { $resolvedUtilityPath = $shortUtilityPath } else { throw "iftpaddu.exe was not found at the configured path '$UtilityPath' or the shorter WS_FTP installation path '$shortUtilityPath'." } " (Indicator: "\ipswitch\ws_ftp"), "or the shorter WS_FTP installation path 'D:\Apps\Ipswitch\WS_FTP Server\iftpaddu.exe'." } throw 'iftpaddu.exe was not found. Configure Prework/SftpHandoff/WsFtpUtilityPath in DecomTool.config.xml.' } function Invoke-Iftpaddu { param( [string]$Mode, [string]$ResolvedUtilityPath ) $arguments = [System.Collections.Generic.List[string]]::new() if ($Mode -eq 'Modify') { [void]$arguments.Add('-mod') } else { [void]$arguments.Add('-add') } [void]$arguments.Add('-u') [void]$arguments.Add($UserName) if (-not [string]::IsNullOrWhiteSpace($HostName)) { [void]$arguments.Add('-h') [void]$arguments.Add($HostName) } if (-not [string]::IsNullOrWhiteSpace($FullName)) { [void]$arguments.Add('-n') [void]$arguments.Add" (Indicator: "\ipswitch\ws_ftp")3a:T1516,"ference='Stop' function emit($Type,$Name,$Path,$State,$Details,$SqlServer='',$Database='') { [pscustomobject]@{Category=$Type;Name=$Name;Path=$Path;State=$State;Details=$Details;SqlServer=$SqlServer;Database=$Database} } function hasClient([string]$Text) { $Text.IndexOf($Client,[StringComparison]::OrdinalIgnoreCase) -ge 0 } try { foreach($s in @(Get-CimInstance Win32_Service -ErrorAction Stop)) { if((hasClient $s.Name) -or (hasClient $s.DisplayName)) { emit 'Service' $s.Name $s.PathName $s.State $s.DisplayName } } emit 'Scan status' 'Services' '' 'Complete' '' } catch { emit 'Scan status' 'Services' '' 'Error' $_.Exception.Message } try { foreach($t in @(Get-ScheduledTask -ErrorAction Stop)) { if(hasClient $t.TaskName) { emit 'Scheduled task' $t.TaskName $t.TaskPath ([string]$t.State) 'Client match in task name' } } emit 'Scan status' 'Scheduled tasks' '' 'Complete' '' } catch { emit 'Scan status' 'Sche" (Indicator: " win32_service"; Source: "sample.bin"), "{Add-PSSnapin Citrix.Broker.Admin.V2 -ErrorAction Stop} $a=Get-BrokerApplication -Uid ([int]$Id) -ErrorAction Stop if($a.Name -ne $Name){throw 'Citrix identity changed; rediscover before disabling.'} Set-BrokerApplication -InputObject $a -Enabled $false -ErrorAction Stop if((Get-BrokerApplication -Uid ([int]$Id)).Enabled){throw 'Application still enabled.'} } 'Service' { $svc=Get-Service -Name $Name -ErrorAction Stop $svc.Stop();$svc.WaitForStatus([ServiceProcess.ServiceControllerStatus]::Stopped,[TimeSpan]::FromSeconds(30)) Set-Service -Name $Name -StartupType Disabled -ErrorAction Stop $verified=Get-CimInstance Win32_Service -ErrorAction Stop|Where-Object {$_.Name -eq $Name} if($verified.State -ne 'Stopped' -or $verified.StartMode -ne 'Disabled'){throw 'Service stop/startup verification failed.'} " (Indicator: " win32_service"; Source: "sample.bin"), "ed=$false foreach($root in $Roots){$rootFull=[IO.Path]::GetFullPath([string]$root).TrimEnd('\');if($full.StartsWith($rootFull+'\',[StringComparison]::OrdinalIgnoreCase)){$allowed=$true}} if(-not $allowed -or @($full -split '\\'|Where-Object {$_ -ieq $Client}).Count -eq 0){throw 'Folder must be below a configured application root and contain the exact client directory segment.'} if(-not(Test-Path -LiteralPath $full)){return 'Folder verified already absent.'} $folder=Get-Item -LiteralPath $full -Force -ErrorAction Stop if(-not $folder.PSIsContainer -or $folder.Attributes -band [IO.FileAttributes]::ReparsePoint){throw 'Folder is not a normal directory.'} if(@(Get-ChildItem -LiteralPath $full -Directory -Recurse -Force -ErrorAction Stop|Where-Object {$_.Attributes -band [IO.FileAttributes]::ReparsePoint}).Count){throw 'Folder contains junctions/symbolic links; review them separately.'} if(@(Get-CimInstance Win32_Service -ErrorActi" (Indicator: " win32_service"; Source: "sample.bin"), "rokerApplication -InputObject $apps[0] -Force -ErrorAction Stop if(@(Get-BrokerApplication -Filter "Uid -eq $Id" -MaxRecordCount 2 -ErrorAction Stop).Count){throw 'Application still exists.'} } 'Service' { $services=@(Get-CimInstance Win32_Service -ErrorAction Stop|Where-Object {$_.Name -ceq $Name}) if(-not $services.Count){return 'Service verified already absent.'} if($services.Count -ne 1 -or [string]$services[0].PathName -cne $Path){throw 'Service executable identity changed; rediscover.'} if($services[0].State -ne 'Stopped' -or $services[0].StartMode -ne 'Disabled'){throw 'Stop and disable the service before deleting it.'} $null=& sc.exe delete $Name if($LASTEXITCODE -ne 0){throw "Service deletion returned exit code $LASTEXITCODE."} if(@(Get-CimInstance Win32_Service -ErrorAction Stop|Where-Object {$_.Name -ceq $Name}).Count){throw 'Service remains registered (possibly marked for deletion).'} " (Indicator: " win32_service"; Source: "sample.bin"), "device.displayName; MatchEvidence = ($evidence -join '; ') } } } # This block runs on the selected server. It only reads inventory. $script:RNetDiscoveryBlock = { param([string]$Client, [string[]]$Roots) $ErrorActionPreference = 'Stop' function MatchesClient([string]$Text) { $Text.IndexOf($Client,[StringComparison]::OrdinalIgnoreCase) -ge 0 } function Row($Category,$Name,$Path,$State,$Details) { [pscustomobject]@{Category=$Category;Name=$Name;Path=$Path;State=$State;Details=$Details} } try { foreach ($service in @(Get-CimInstance Win32_Service -ErrorAction Stop)) { if ((MatchesClient $service.Name) -or (MatchesClient $service.DisplayName) -or (MatchesClient $service.PathName)) { Row 'Service' $service.Name $service.PathName $service.State $service.DisplayName } } Row 'Scan status' 'Services' '' 'Complete' 'Service names, display names and executable paths checked.' } catch { Row 'Scan status' 'Serv" (Indicator: " win32_service"; Source: "sample.bin")3b:T504,Pattern match: "https://$account.logicmonitor.com/santaba/rest${path}?size=500&offset=$offset&sort=%2bid&filter=$filter", Pattern match: "http://schemas.microsoft.com/winfx/2006/xaml", Pattern match: "http://schemas.microsoft.com/winfx/2006/xaml/presentation", Heuristic match: "allownull()][string]$existingsessionid ) if ([bool]$script:decomtrackingdisabledfortesting) { return $null } $sessionid = $existingsessionid if ([string]::isnullorwhitespace($sessionid)) { $sessioninfo = resolve-spacef", Heuristic match: "ilter} $bulk.add_click({param($sender) $text=$sender.tag.filter.text.trim();if($text){remove-rnetlistrows $sender.tag.grid $text}else{$ui.status.text='enter literal text for bulk list removal.'}});[void]$bar.children.add($bulk);$spec.buttons+=,$bulk ", Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings", Heuristic match: "ut in @($roleinputs)) { if ([string]::isnullorwhitespace($roleinput)) { continue } $trimmedrole = $roleinput.trim() $aliasmatches = @($definitions | where-object { $_.psobject.properties['aliases'] -", Pattern match: "http://'+$p.server+'/wsftpsvr/ftp/folder.asp?srelativepath='+[uri]::escapedatastring('/'+$p.foldername)"3c:T7712,Observed string: "Net-cancel-'+[guid]::NewGuid().ToString('N')+'.signal');return $script:cancelPath} # Data Handoff: same SFTP options and tab order as Cadency; only RNet payloads. $dataRoot=$ui.Tabs.Items[2].Content;$dataHeader=$dataRoot.Children[0];$dataRoot.Children.Remove($dataHeader) $data=New-RNetPanel;$data.Margin='8';Add-RNetTop $data $dataHeader;$sub=[Windows.Controls.TabControl]::new();$ui.DataTabs=$sub;[void]$data.Children.Add($sub);$ui.Tabs.Items[2].Content=$data [xml]$sftpXaml=Get-RNetEmbeddedText 'RNetDecom.SftpLayout.xaml' $sftp=[Windows.Markup.XamlReader]::Load([Xml.XmlNodeReader]::new($sftpXaml)) foreach($node in $sftpXaml.SelectNodes('//*[@*[local-name()="Name"]]')){ $name=$node.GetAttribute('Name','http://schemas.microsoft.com/winfx/2006/xaml');$ui[$name]=$sftp.FindName($name) } foreach($name in @('CopyRemoteShare','CopySftpUsername','CopyWsPage')){ $ui[$name].Add_Click({param($sender) if($ui[[string]$sender.Tag].Text){[Windows.Clipboard]::SetText($ui[[string]$sender.Tag].Text);$ui.Status.Text='Copi" (Indicator: " sftp ") in Source: sample.bin, Observed string: "ost other clients. Client-name matches are candidates, not proof of ownership.', 'Warning: Disable only the correct RNet components. Results may include similarly named or retained applications. Disabling interrupts client access and batch activity. Set-SDT runs first; if it fails, application disable is blocked.', 'Warning: Discover and verify the correct database and uardata source. Do not decommission until backups are verified and handoff requirements are met. A planned SFTP target is not a provisioned account or completed backup.', 'Warning: Be mindful that you are removing the correct components. Do not delete retained or other-product resources. Verify database/uardata backups first. If the client retains ANY other applications, do not delete its OU or shared users; review existing SFTP ownership as well.', 'Warning: Do not run Handoff Cleanup until the decom case is in the correct stage, client receipt is confirmed and approved retention has expired. Remove only the temporary handoff r" (Indicator: " sftp ") in Source: sample.bin, Observed string: "ummed and RESTORE VERIFYONLY is run before transfer; source backup parts are removed only after destination sizes match. SQL rows with errors cannot be backed up.') Add-RNetTop $db (New-RNetButtonBar @(@('DataDiscover','Run Discovery - Sources','Refresh read-only batch and Citrix discovery from Setup.'),@('SqlDiscover','Run Discovery - Databases','Read the SQL catalog for each ODBC candidate and verify the exact database.'),@('DbSelect','Select All','Select all verified online database rows, excluding errors.'),@('DbClear','Clear All','Clear database selection.'),@('DataBackup','Back Up Selected','Create verified SQL backups and transfer them into Databases on the selected SFTP target. Confirmation required.'))) $opts=[Windows.Controls.WrapPanel]::new();$ui.SplitBackups=[Windows.Controls.CheckBox]::new();$ui.SplitBackups.Content='Split large backups';$ui.SplitBackups.IsChecked=$true;$ui.SplitBackups.VerticalAlignment='Center';$ui.SplitBackups.Margin='0,0,16,0';[void]$opts.Children.Add($ui.SplitBackups) [void]" (Indicator: " sftp ") in Source: sample.bin, Observed string: "lScrollBarVisibility="Auto" HorizontalScrollBarVisibility="Auto" FontFamily="Consolas" VerticalContentAlignment="Top" ToolTip="Client handoff details. A generated password is not a provisioned account; provision and verify before sending."/>