24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 8a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4db,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample e5f3bf349b59… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample e5f3bf349b59…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 2/27 AV engines flagged this file. 5 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc"],"about":{"@type":"SoftwareApplication","name":"ScreenConnect.ClientSetup.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":2,"total":27},"behavioralIndicators":{"malicious":5,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Taf9,Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "VirtualFree"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "VirtualAlloc"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "FreeMemory"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "WriteProcessMemory"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "CreateThreadRunContext" (Indicator: "CreateThread"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "WTSFreeMemory" (Indicator: "FreeMemory"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "VirtualAlloc"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") file/memory contains long string with (Indicator: "FreeMemory"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") file/memory contains long string with (Indicator: "VirtualFree"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00004284.00000000.189912.71141000.00000020.mdmp, 00000000-00004284.00000001.190028.71221000.00000020.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp, 00000000-00004284.00000001.190028.08110000.00000004.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp")26:T954,Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "ScreenConnect.WindowsFileManager.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "ScreenConnect.WindowsFileManager.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StructureToPtr" in "ScreenConnect.WindowsFileManager.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStructure" in "ScreenConnect.WindowsFileManager.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStringAnsi" in "ScreenConnect.WindowsFileManager.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "ScreenConnect.WindowsFileManager.exe" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "ScreenConnect.ClientService.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "ScreenConnect.ClientService.dll" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "Microsoft.Deployment.Compression.Cab.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "Microsoft.Deployment.Compression.Cab.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "Microsoft.Deployment.Compression.Cab.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "WriteByte" in "Microsoft.Deployment.Compression.Cab.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "Microsoft.Deployment.Compression.Cab.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStructure" in "Microsoft.Deployment.Compression.Cab.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StructureToPtr" in "Microsoft.Deployment.Compression.Cab.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadByte" in "Microsoft.Deployment.Compression.Cab.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStringAnsi" in "Microsoft.Deployment.Compression.Cab.dll" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "Microsoft.Deployment.Compression.dll"27:T595,Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "OpenThread"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "ResumeThread"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "OpenThread" (Indicator: "OpenThread"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "OpenThread"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") file/memory contains long string with (Indicator: "ResumeThread"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp")28:T121d,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "SleepEx"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "GetTickCount64"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "NtQuerySystemInformation"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "SetWaitableTimer"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "syscall.WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "NtQuerySystemInformation"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") file/memory contains long string with (Indicator: "SetWaitableTimer"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") file/memory contains long string with (Indicator: "WaitForSingleObject"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") Found reference to API "syscall.WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp, 00000000-00004284.00000001.190028.00EDD000.00000002.mdmp, 00000000-00004284.00000001.190028.06800000.00000004.mdmp, 00000000-00004284.00000001.190028.08110000.00000004.mdmp, 00000000-00004284.00000001.190028.71235000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp, 00000000-00004284.00000001.190028.00EDD000.00000002.mdmp, 00000000-00004284.00000001.190028.06800000.00000004.mdmp, 00000000-00004284.00000001.190028.08110000.00000004.mdmp, 00000000-00004284.00000001.190028.71235000.00000002.mdmp")29:Tb75,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "FreeLibrary"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "LoadLibrary"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "golang.org/x/sys/windows.LoadLibraryEx" (Indicator: "LoadLibrary"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "golang.org/x/sys/windows._LoadLibraryEx" (Indicator: "LoadLibrary"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "golang.org/x/sys/windows.LoadLibraryEx" (Indicator: "LoadLibrary"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") Found reference to API "golang.org/x/sys/windows._LoadLibraryEx" (Indicator: "LoadLibrary"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp, 00000000-00004284.00000001.190028.00EDD000.00000002.mdmp, 00000000-00004284.00000001.190028.06800000.00000004.mdmp, 00000000-00004284.00000001.190028.08110000.00000004.mdmp, 00000000-00004284.00000001.190028.71235000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp, 00000000-00004284.00000001.190028.00EDD000.00000002.mdmp, 00000000-00004284.00000001.190028.08110000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp, 00000000-00004284.00000001.190028.00EDD000.00000002.mdmp, 00000000-00004284.00000001.190028.06800000.00000004.mdmp, 00000000-00004284.00000001.190028.08110000.00000004.mdmp, 00000000-00004284.00000001.190028.71235000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp")2a:T434,file/memory contains long string with (Indicator: "ControlService"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "ChangeServiceConfig"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "ChangeServiceConfig2" (Indicator: "ChangeServiceConfig"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "ControlService" (Indicator: "ControlService"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "ChangeServiceConfig" (Indicator: "ChangeServiceConfig"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "ChangeServiceConfig2W" (Indicator: "ChangeServiceConfig"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "ChangeServiceConfigW" (Indicator: "ChangeServiceConfig"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp")2b:T11c0,Found reference to "forHKDF" (Indicator: "HKDF"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to "*hmac.HMAC" (Indicator: "HMAC"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "HMAC"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "SHA384"; File: "ScreenConnect.ClientService.exe") file/memory contains long string with (Indicator: "SHA384"; File: "ScreenConnect.WindowsFileManager.exe") file/memory contains long string with (Indicator: "CryptographicException"; File: "ScreenConnect.ClientService.dll") file/memory contains long string with (Indicator: "SHA384"; File: "ScreenConnect.WindowsBackstageShell.exe") Found reference to "crypto/internal/fips140/hmac.(*HMAC).Sum" (Indicator: "HMAC"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to "crypto/internal/fips140/hmac.(*HMAC).Write" (Indicator: "HMAC"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to "crypto/internal/fips140/hmac.(*HMAC).BlockSize" (Indicator: "HMAC"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to "crypto/internal/fips140/hmac.(*HMAC).Reset" (Indicator: "HMAC"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to "HMACSHA256" (Indicator: "HMAC"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to "CryptoConfig" (Indicator: "CryptoConfig"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to "ComputeHMACSHA256Hash" (Indicator: "HMAC"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to "ComputeHMACSHA256Hash" (Indicator: "HMACSHA256"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to "KeyedHashAlgorithm" (Indicator: "HashAlgorithm"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to "KeyedHashAlgorithm" (Indicator: "KeyedHashAlgorithm"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to "RSACryptoServiceProvider" (Indicator: "RSACryptoServiceProvider"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to "RNGCryptoServiceProvider" (Indicator: "RNGCryptoServiceProvider"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to "DeriveBytesIterations" (Indicator: "DeriveBytes"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to "EnsureSymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to "Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to "Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to "pszTimestampAlgorithmOid" (Indicator: "Oid"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin")2c:T649,Found string - elect not object objs next= jobs= goid sweep B -> % util alloc free span= prev= list= i = code= addr= m->p= p->m=SCHED curg= ctxt: min= max= bad ts(...) m=nil base SundayMondayFridayAugustUTC-11UTC-02UTC-08UTC-09UTC+12UTC+13uint16uint32uint64structCommonsendtordtscppopcntcmd/gonetdnsAES-NIsha256SHA-NIsha512headerAnswerconsolePATHEXTabortedCopySidWSARecvWSASendconnectsignal float32float64\\.\UNCforcegcallocmWcpuprofallocmRunknowngctraceIO waitrunningsyscallwaitingforevernetworkUNKNOWNcleanup:events goid= mark s=nil (scan MB in pacer: % CPU ( zombiegc bits, j0 = head = panic: GODEBUG nmsys= locks= dying= allocs m->g0= pad1= pad2= text= minpc= value= (scan)types : type TuesdayJanuaryOctoberMUI_StdMUI_DltinvaliduintptrFreeSidSleepExfips140avx512fruntimeos/exectls3destlssha1net/urlAES-CBCfile+netFullPathnil Poolno anodeCancelIoReadFileAcceptExWSAIoctlshutdownscavengepollDescsynctesttraceBufdeadlockraceFinipanicnilcgocheckrunnablerax rbx rcx rdx rdi rsi rbp rsp; Source: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found string - \.\pipe\; Source: "AMSI") Found string - m=nil base SundayMondayFridayAugustUTC-11UTC-02UTC-08UTC-09UTC+12UTC+13uint16uint32uint64structCommonsendtordtscppopcntcmd/gonetdnsAES-NIsha256SHA-NIsha512headerAnswerconsolePATHEXTabortedCopySidWSARecvWSASendconnectsignal float32float64\\.\UNCforcegcallocmWcpuprofallocmRunknowngctraceIO waitrunningsyscallwaitingforevernetworkUNKNOWNcleanup:events goid= mark s=nil; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp")2d:T9e0,"ScreenConnect.ClientSetup.exe3896969975" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INPROCSERVER32") "ScreenConnect.ClientSetup.exe3896969975" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INPROCSERVER32") "ScreenConnect.ClientSetup.exe3896969975" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INPROCHANDLER32") "ScreenConnect.ClientSetup.exe3896969975" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INPROCHANDLER32") "ScreenConnect.ClientSetup.exe3896969975" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INPROCHANDLER") "ScreenConnect.ClientSetup.exe3896969975" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INPROCHANDLER") "ScreenConnect.ClientSetup.exe3896969975" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\TREATAS") "ScreenConnect.ClientSetup.exe3896969975" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\TREATAS") "ScreenConnect.ClientSetup.exe3896969975" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INPROCSERVER32") "ScreenConnect.ClientSetup.exe3896969975" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\LOCALSERVER32") "ScreenConnect.ClientSetup.exe3896969975" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\LOCALSERVER32") "ScreenConnect.ClientSetup.exe3896969975" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}") "ScreenConnect.ClientSetup.exe3896969975" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\LOCALSERVER") "ScreenConnect.ClientSetup.exe3896969975" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\LOCALSERVER") "ScreenConnect.ClientSetup.exe3896969975" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\ELEVATION") "ScreenConnect.ClientSetup.exe3896969975" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\ELEVATION")2e:Ta1e,"m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace buffernot pollableCfgMgr32.dllsetupapi.dllwintrust.dllwtsapi32.dllReportEventWCreateMutexWGetCommStateGetProcessIdLoadResourceLockResourceReleaseMutexResumeThreadSetCommBreakSetCommStateSetErrorModeSetStdHandleThread32NextVirtualAllocCoCreateGuidgotypesaliashttpmuxgo121multipathtcprandautoseedtlsunsafeekmunknown sizeRCodeSuccessRCodeRefusedFindFirstFilelevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynameRegDeleteKeyWRegEnumValueWdalTLDpSugct?GetTempPath2WModule32NextWRtlGetVersionwakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , no" (Indicator: "CertOpenStore"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found api reference "t pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=DeleteServiceStartServiceWFindResourceWGetDriveTypeWThread32FirstWaitCommEventRtlInitStringCoTaskMemFreeEnumProcessesShellExecuteWExitWindowsExGetClassNameWtimeEndPeriodWTSFreeMemory#failfipscastcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeHMAC-SHA2-256... omitting file too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #RegSetValueExWunexpected EOFOpenSCManagerWModule32Firs" (Indicator: "CertCloseStore"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found api reference "t pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=DeleteServiceStartServiceWFindResourceWGetDriveTypeWThread32FirstWaitCommEventRtlInitStringCoTaskMemFreeEnumProcessesShellExecuteWExitWindowsExGetClassNameWtimeEndPeriodWTSFreeMemory#failfipscastcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeHMAC-SHA2-256... omitting file too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #RegSetValueExWunexpected EOFOpenSCManagerWModule32Firs" (Indicator: "CryptGenRandom"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found api reference "already; errno=runtime stack:invalid g statuscastogscanstatusbad g transitionschedule: in cgoreflect mismatch untyped locals missing stackmapbad symbol tablenon-Go functionpointerless type not in ranges:SetEntriesInAclWSetServiceStatusCryptProtectDataCryptQueryObjectConnectNamedPipeCreateJobObjectWDefineDosDeviceWFindFirstVolumeWGetLogicalDrivesGetNamedPipeInfoGetPriorityClassSetDllDirectoryWSetFileValidDataSetPriorityClassVirtualProtectExRtlGetCurrentPebEnumChildWindowsGetDesktopWindowGetGUIThreadInfoWinVerifyTrustExGODEBUG: value "allowmultiplevcshttpcookiemaxnumRCodeFormatErrorwinreadlinkvolumeexec: killing Cmdexec: not startedpermission deniedwrong medium typeno data availableexec format errorLookupAccountSidWDnsRecordListFreeGetCurrentProcessGetShortPathNameWWSAEnumProtocolsWRegLoadMUIStringWgoroutine profileAllThreadsSyscallcontainermaxprocsGC assist markingselect (no cases)sync.RWMutex.Lockwait for GC cycletrace proc statussync.(*Cond).Wait: missing method notetsleepg on g0bad TinySizeClassimmorta" (Indicator: "CryptQueryObject"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin"), Found api reference "runtime.newosprocinternal/runtime/thread exhaustionlocked m0 woke upentersyscallblock spinningthreads=gp.waiting != niltaggedPointerPackunknown caller pcstack: frame={sp:trace arena allocruntime: nameOff runtime: typeOff runtime: textOff GTB Standard TimeFLE Standard TimeGMT Standard TimeAdjustTokenGroupsIsTokenRestrictedCertFindExtensionCryptDecodeObjectReadProcessMemoryQueryWorkingSetExWTSQueryUserTokenunexpected resultmultipartmaxpartsurlmaxqueryparamsGetExitCodeProcesssegmentation faultoperation canceledno child processesconnection refusedRFS specific erroridentifier removedinput/output errormultihop attemptedfile name too longno locks availablestreams pipe errorLookupAccountNameWCreateFileMappingWGetFileAttributesWSetFileAttributesWCommandLineToArgvWcontext.BackgroundGetSidSubAuthorityQueryServiceStatusGetComputerNameExWGetModuleFileNameWadaptivestackstartdontfreezetheworldtraceadvanceperiodtracebackancestorsgarbage collectionsync.RWMutex.RLockGC worker (active)stopping the worldwait until GC endssystem" (Indicator: "CertFindExtension"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin"), Found api reference "runtime.newosprocinternal/runtime/thread exhaustionlocked m0 woke upentersyscallblock spinningthreads=gp.waiting != niltaggedPointerPackunknown caller pcstack: frame={sp:trace arena allocruntime: nameOff runtime: typeOff runtime: textOff GTB Standard TimeFLE Standard TimeGMT Standard TimeAdjustTokenGroupsIsTokenRestrictedCertFindExtensionCryptDecodeObjectReadProcessMemoryQueryWorkingSetExWTSQueryUserTokenunexpected resultmultipartmaxpartsurlmaxqueryparamsGetExitCodeProcesssegmentation faultoperation canceledno child processesconnection refusedRFS specific erroridentifier removedinput/output errormultihop attemptedfile name too longno locks availablestreams pipe errorLookupAccountNameWCreateFileMappingWGetFileAttributesWSetFileAttributesWCommandLineToArgvWcontext.BackgroundGetSidSubAuthorityQueryServiceStatusGetComputerNameExWGetModuleFileNameWadaptivestackstartdontfreezetheworldtraceadvanceperiodtracebackancestorsgarbage collectionsync.RWMutex.RLockGC worker (active)stopping the worldwait until GC endssystem" (Indicator: "CryptDecodeObject"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin"), Found api reference "page size ( but memory size /gc/pauses:seconds because dotdotdotruntime: npages = invalid skip valueruntime: range = {index out of rangeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to thread, synctest bubble runtime.semacreateruntime.semawakeupuse of closed fileCuba Standard TimeOmsk Standard TimeArab Standard TimeIran Standard TimeRussia Time Zone 3Fiji Standard TimeCM_MapCrToWin32ErrCloseServiceHandleCreateWellKnownSidMakeSelfRelativeSDCertGetNameStringWCryptUnprotectDataPFXImportCertStoreGetBestInterfaceExClosePseudoConsoleEscapeCommFunctionGetCommModemStatusGetCurrentThreadIdGetModuleHandleExWGetVolumePathNameWRemoveDllDirectoryTerminateJobObjectWriteProcessMemoryEnumProcessModulesGetModuleBaseNameWx509negativeserial/Drivers/etc/hostsRCodeServerFailureWaitForSingleObjectGetFileAttributesExexec: canceling Cmdillegal instructionbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not e" (Indicator: "CertGetNameStringW"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found api reference "page size ( but memory size /gc/pauses:seconds because dotdotdotruntime: npages = invalid skip valueruntime: range = {index out of rangeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to thread, synctest bubble runtime.semacreateruntime.semawakeupuse of closed fileCuba Standard TimeOmsk Standard TimeArab Standard TimeIran Standard TimeRussia Time Zone 3Fiji Standard TimeCM_MapCrToWin32ErrCloseServiceHandleCreateWellKnownSidMakeSelfRelativeSDCertGetNameStringWCryptUnprotectDataPFXImportCertStoreGetBestInterfaceExClosePseudoConsoleEscapeCommFunctionGetCommModemStatusGetCurrentThreadIdGetModuleHandleExWGetVolumePathNameWRemoveDllDirectoryTerminateJobObjectWriteProcessMemoryEnumProcessModulesGetModuleBaseNameWx509negativeserial/Drivers/etc/hostsRCodeServerFailureWaitForSingleObjectGetFileAttributesExexec: canceling Cmdillegal instructionbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not e" (Indicator: "CryptUnprotectData"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found api reference "page size ( but memory size /gc/pauses:seconds because dotdotdotruntime: npages = invalid skip valueruntime: range = {index out of rangeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to thread, synctest bubble runtime.semacreateruntime.semawakeupuse of closed fileCuba Standard TimeOmsk Standard TimeArab Standard TimeIran Standard TimeRussia Time Zone 3Fiji Standard TimeCM_MapCrToWin32ErrCloseServiceHandleCreateWellKnownSidMakeSelfRelativeSDCertGetNameStringWCryptUnprotectDataPFXImportCertStoreGetBestInterfaceExClosePseudoConsoleEscapeCommFunctionGetCommModemStatusGetCurrentThreadIdGetModuleHandleExWGetVolumePathNameWRemoveDllDirectoryTerminateJobObjectWriteProcessMemoryEnumProcessModulesGetModuleBaseNameWx509negativeserial/Drivers/etc/hostsRCodeServerFailureWaitForSingleObjectGetFileAttributesExexec: canceling Cmdillegal instructionbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not e" (Indicator: "PFXImportCertStore"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found api reference "mptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdRegConnectRegistryWskip this directorySetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushed/gc/scan/heap:bytes/gc/heap/goal:bytes/gc/heap/live:bytesmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panic, g->atomicstatus=unexpected g statusbad runtime" (Indicator: "CryptReleaseContext"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionEgypt Standard TimeSudan Standard TimeLibya Standard TimeBahia Standard TimeHaiti Standard TimeYukon Standard TimeAltai Standard TimeIndia Standard TimeSyria Standard TimeRussia Time Zone 11Nepal Standard TimeKorea Standard TimeChina Standard TimeRussia Time Zone 10Tokyo Standard TimeTomsk Standard TimeSamoa Standard TimeTonga Standard Timefile already existsfile does not existfile already closedQueryServiceConfigWCreatePseudoConsoleDisconnectNamedPipeGetDiskFreeSpaceExWGetLargePageMinimumGetSystemDirectoryWResizePseudoConsoleRtlAddFunctionTableGetForegroundWindowGetFileVersionInfoWWSALookupServiceEndembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersRCodeNotImplementedinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWS" (Indicator: "CertOpenSystemStoreW"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionEgypt Standard TimeSudan Standard TimeLibya Standard TimeBahia Standard TimeHaiti Standard TimeYukon Standard TimeAltai Standard TimeIndia Standard TimeSyria Standard TimeRussia Time Zone 11Nepal Standard TimeKorea Standard TimeChina Standard TimeRussia Time Zone 10Tokyo Standard TimeTomsk Standard TimeSamoa Standard TimeTonga Standard Timefile already existsfile does not existfile already closedQueryServiceConfigWCreatePseudoConsoleDisconnectNamedPipeGetDiskFreeSpaceExWGetLargePageMinimumGetSystemDirectoryWResizePseudoConsoleRtlAddFunctionTableGetForegroundWindowGetFileVersionInfoWWSALookupServiceEndembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersRCodeNotImplementedinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWS" (Indicator: "CryptAcquireContextW"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found api reference "etCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsinvalid write resultGetAdaptersAddressesNtSetInformationFileRtlIsDosDeviceName_UGetProcessMemoryInfobcryptprimitives.dllfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valueselectgo: bad wakeupsemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in goJordan Standard TimeArabic Standard TimeIsrael Standard TimeTaipei Standard TimeAzores Standard TimeTurkey Standard TimeChangeServiceConfigWCheckTokenMembershipQueryServiceConfig2WQueryServiceStatusExRegisterEventSourceWCertFindChainInStoreGetWi" (Indicator: "CertFindChainInStore"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found api reference "ForMultipleObjectsNtSetSystemInformationRtlDeleteFunctionTableRtlGetNtVersionNumbersSetupDiEnumDriverInfoWSetupDiGetClassDevsExWWSALookupServiceBeginWsimulated CAST failureexit hook invoked exitsha3: Write after Readdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWGetSidSubAuthorityCountImpersonateLoggedOnUserDestroyEnvironmentBlockindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelems/gc/heap/allocs:objectsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the" (Indicator: "CertGetCertificateChain"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found api reference "synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowgoroutine stack (system)unexpected syncgroup setdouble traceGCSweepStartbad use of trace.seqlockSA Pacific Standard TimeSA Eastern Standard TimeUS Eastern Standard TimeSA Western Standard TimeMontevideo Standard TimeMagallanes Standard TimePacific SA Standard TimeAzerbaijan Standard TimeBang" (Indicator: "CertFreeCertificateChain"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found api reference "ecurityDescriptorSetSecurityDescriptorDaclSetSecurityDescriptorSaclFindNextVolumeMountPointWFindVolumeMountPointCloseQueryInformationJobObjectNtQueryInformationProcessSetupDiCallClassInstallerSetupDiGetDevicePropertyWSetupDiGetSelectedDriverWSetupDiSetSelectedDriverWtesting simulated failureGODEBUG: can not enable "hash of unhashable type: GetFileInformationByHandleinvalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextPostQueuedCompletionStatusSetFileInformationByHandleRtlNtStatusToDosErrorNoTeball goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizernegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrink" (Indicator: "CertFreeCertificateContext"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin"), Found api reference "ing stack in libcallruntime: pcHeader: magic= traceRegion: out of memorySouth Africa Standard TimeSaint Pierre Standard TimeNewfoundland Standard TimeCentral Asia Standard TimeEkaterinburg Standard TimeE. Australia Standard TimeW. Australia Standard TimeBougainville Standard TimeLine Islands Standard TimeWest Pacific Standard TimeGetSecurityDescriptorGroupGetSecurityDescriptorOwnerNotifyServiceStatusChangeWSetSecurityDescriptorGroupSetSecurityDescriptorOwnerCertFindCertificateInStoreFindFirstVolumeMountPointWFindNextChangeNotificationGetConsoleScreenBufferInfoGetProcessWorkingSetSizeExGetSystemWindowsDirectoryWQueryFullProcessImageNameWSetProcessWorkingSetSizeExSetupDiBuildDriverInfoListinconsistent process statuschannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStorePageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses sizeclass runtime" (Indicator: "CertEnumCertificatesInStore"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin"), Found api reference "ing stack in libcallruntime: pcHeader: magic= traceRegion: out of memorySouth Africa Standard TimeSaint Pierre Standard TimeNewfoundland Standard TimeCentral Asia Standard TimeEkaterinburg Standard TimeE. Australia Standard TimeW. Australia Standard TimeBougainville Standard TimeLine Islands Standard TimeWest Pacific Standard TimeGetSecurityDescriptorGroupGetSecurityDescriptorOwnerNotifyServiceStatusChangeWSetSecurityDescriptorGroupSetSecurityDescriptorOwnerCertFindCertificateInStoreFindFirstVolumeMountPointWFindNextChangeNotificationGetConsoleScreenBufferInfoGetProcessWorkingSetSizeExGetSystemWindowsDirectoryWQueryFullProcessImageNameWSetProcessWorkingSetSizeExSetupDiBuildDriverInfoListinconsistent process statuschannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStorePageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses sizeclass runtime" (Indicator: "CertFindCertificateInStore"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin"), Found api reference "cess already finishedGetFileInformationByHandleExfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type region exceeds uintptr range/gc/heap/frees-by-size:bytes/gc/heap/tiny/allocs:objects/sched/goroutines:goroutinesgcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on gsignalruntime: casgstatus: oldval=gcstopm: negative nmspinningfindrunnable: netpoll with psave on system g not allowednewproc1: newg missing stacknewproc1: new g is not GdeadFixedStack is not power-of-2missing stack in shrinkstack args stack map entries for invalid runtime symbol tableruntime: no module data for mismatched isSending updates[originating from goroutine traceRegion: alloc too largeCanada Central Standard TimeCen. Australia Standard TimeAus Central W. Standard TimeCentral Europe Standard TimeEnglish name for time z" (Indicator: "CertCreateCertificateContext"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin"), Found api reference "ceDynamicInformationSetSecurityDescriptorRMControlCertDeleteCertificateFromStoreGetProcessPreferredUILanguagesGetSystemTimePreciseAsFileTimeSetupDiCreateDeviceInfoListExWSetupDiGetDeviceInstallParamsWSetupDiSetDeviceInstallParamsWfips: invalid self-test name: reflect: Elem of invalid type GODEBUG: unknown cpu feature "fips140: verification mismatchsubtle.XORBytes: dst too shortpattern contains path separatorcannot assign requested address.lib section in a.out corruptedslice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames eli" (Indicator: "CertDeleteCertificateFromStore"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found api reference "ded...unsafe.String: len out of rangeW. Central Africa Standard TimeCentral Brazilian Standard TimeMountain Standard Time (Mexico)CertDuplicateCertificateContextSetupDiGetDeviceInfoListDetailWcrypto/aes: len(dst) < len(src)resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointergetWeakHandle on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertAddCertificateContextToStore"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found api reference "ded...unsafe.String: len out of rangeW. Central Africa Standard TimeCentral Brazilian Standard TimeMountain Standard Time (Mexico)CertDuplicateCertificateContextSetupDiGetDeviceInfoListDetailWcrypto/aes: len(dst) < len(src)resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointergetWeakHandle on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertDuplicateCertificateContext"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found api reference "ded...unsafe.String: len out of rangeW. Central Africa Standard TimeCentral Brazilian Standard TimeMountain Standard Time (Mexico)CertDuplicateCertificateContextSetupDiGetDeviceInfoListDetailWcrypto/aes: len(dst) < len(src)resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointergetWeakHandle on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertVerifyCertificateChainPolicy"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found api reference "tal/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack spanstackalloc not on scheduler stackruntime: goroutine stack exceeds runtime: text offset out of rangetimer period must be non-negativetoo many concurrent timer firingsruntime: name offset out of rangeruntime: type offset out of rangewaiting for unsupported file typecan't wait on blocking operationsCryptAcquireCertificatePrivateKeySetupDiGetDeviceRegistryPropertyWSetupDiSetDeviceRegistryPropertyWGODEBUG: no value specified for "concurrent map read and map writetable must have positive capacityNoDefaultCurrentDirectoryInExePathtoo many references: cannot spliceSetFileCompletionNotificationModesslice bounds out of range [:%x:%y]slice bounds out of range [%x:%y:]out of memory allocating allArenas... too many potential issues .../memory/classes/heap/objects:bytesruntime.SetFinalizer: cannot pass too many" (Indicator: "CryptAcquireCertificatePrivateKey"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin"), Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace buffernot pollableCfgMgr32.dllsetupapi.dllwintrust.dllwtsapi32.dllReportEventWCreateMutexWGetCommStateGetProcessIdLoadResourceLockResourceReleaseMutexResumeThreadSetCommBreakSetCommStateSetErrorModeSetStdHandleThread32NextVirtualAllocCoCreateGuidgotypesaliashttpmuxgo121multipathtcprandautoseedtlsunsafeekmunknown sizeRCodeSuccessRCodeRefusedFindFirstFilelevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynameRegDeleteKeyWRegEnumValueWdalTLDpSugct?GetTempPath2WModule32NextWRtlGetVersionwakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil not value method heap metadata span.base()=bad flushGen created at: n" (Indicator: "CertOpenStore"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin"), Found api reference "t pointer != sweepgen MB globals work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=DeleteServiceStartServiceWFindResourceWGetDriveTypeWThread32FirstWaitCommEventRtlInitStringCoTaskMemFreeEnumProcessesShellExecuteWExitWindowsExGetClassNameWtimeEndPeriodWTSFreeMemory#failfipscastcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeHMAC-SHA2-256... omitting file too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #RegSetValueExWunexpected EOFOpenSCManagerWModule32Fir" (Indicator: "CertCloseStore"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found api reference "t pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=DeleteServiceStartServiceWFindResourceWGetDriveTypeWThread32FirstWaitCommEventRtlInitStringCoTaskMemFreeEnumProcessesShellExecuteWExitWindowsExGetClassNameWtimeEndPeriodWTSFreeMemory#failfipscastcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeHMAC-SHA2-256... omitting file too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #RegSetValueExWunexpected EOFOpenSCManagerWModule32Fir" (Indicator: "CryptGenRandom"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found api reference "already; errno=runtime stack:invalid g statuscastogscanstatusbad g transitionschedule: in cgoreflect mismatch untyped locals missing stackmapbad symbol tablenon-Go functionpointerless type not in ranges:SetEntriesInAclWSetServiceStatusCryptProtectDataCryptQueryObjectConnectNamedPipeCreateJobObjectWDefineDosDeviceWFindFirstVolumeWGetLogicalDrivesGetNamedPipeInfoGetPriorityClassSetDllDirectoryWSetFileValidDataSetPriorityClassVirtualProtectExRtlGetCurrentPebEnumChildWindowsGetDesktopWindowGetGUIThreadInfoWinVerifyTrustExGODEBUG: value "allowmultiplevcshttpcookiemaxnumRCodeFormatErrorwinreadlinkvolumeexec: killing Cmdexec: not startedpermission deniedwrong medium typeno data availableexec format errorLookupAccountSidWDnsRecordListFreeGetCurrentProcessGetShortPathNameWWSAEnumProtocolsWRegLoadMUIStringWgoroutine profileAllThreadsSyscallcontainermaxprocsGC assist markingselect (no cases)sync.RWMutex.Lockwait for GC cycletrace proc statussync.(*Cond).Wait: missing method notetsleepg on g0bad TinySizeClassimmort" (Indicator: "CryptQueryObject"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin"), Found api reference "page size ( but memory size /gc/pauses:seconds because dotdotdotruntime: npages = invalid skip valueruntime: range = {index out of rangeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to thread, synctest bubble runtime.semacreateruntime.semawakeupuse of closed fileCuba Standard TimeOmsk Standard TimeArab Standard TimeIran Standard TimeRussia Time Zone 3Fiji Standard TimeCM_MapCrToWin32ErrCloseServiceHandleCreateWellKnownSidMakeSelfRelativeSDCertGetNameStringWCryptUnprotectDataPFXImportCertStoreGetBestInterfaceExClosePseudoConsoleEscapeCommFunctionGetCommModemStatusGetCurrentThreadIdGetModuleHandleExWGetVolumePathNameWRemoveDllDirectoryTerminateJobObjectWriteProcessMemoryEnumProcessModulesGetModuleBaseNameWx509negativeserial/Drivers/etc/hostsRCodeServerFailureWaitForSingleObjectGetFileAttributesExexec: canceling Cmdillegal instructionbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not" (Indicator: "CertGetNameStringW"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found api reference "page size ( but memory size /gc/pauses:seconds because dotdotdotruntime: npages = invalid skip valueruntime: range = {index out of rangeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to thread, synctest bubble runtime.semacreateruntime.semawakeupuse of closed fileCuba Standard TimeOmsk Standard TimeArab Standard TimeIran Standard TimeRussia Time Zone 3Fiji Standard TimeCM_MapCrToWin32ErrCloseServiceHandleCreateWellKnownSidMakeSelfRelativeSDCertGetNameStringWCryptUnprotectDataPFXImportCertStoreGetBestInterfaceExClosePseudoConsoleEscapeCommFunctionGetCommModemStatusGetCurrentThreadIdGetModuleHandleExWGetVolumePathNameWRemoveDllDirectoryTerminateJobObjectWriteProcessMemoryEnumProcessModulesGetModuleBaseNameWx509negativeserial/Drivers/etc/hostsRCodeServerFailureWaitForSingleObjectGetFileAttributesExexec: canceling Cmdillegal instructionbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not" (Indicator: "CryptUnprotectData"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found api reference "page size ( but memory size /gc/pauses:seconds because dotdotdotruntime: npages = invalid skip valueruntime: range = {index out of rangeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to thread, synctest bubble runtime.semacreateruntime.semawakeupuse of closed fileCuba Standard TimeOmsk Standard TimeArab Standard TimeIran Standard TimeRussia Time Zone 3Fiji Standard TimeCM_MapCrToWin32ErrCloseServiceHandleCreateWellKnownSidMakeSelfRelativeSDCertGetNameStringWCryptUnprotectDataPFXImportCertStoreGetBestInterfaceExClosePseudoConsoleEscapeCommFunctionGetCommModemStatusGetCurrentThreadIdGetModuleHandleExWGetVolumePathNameWRemoveDllDirectoryTerminateJobObjectWriteProcessMemoryEnumProcessModulesGetModuleBaseNameWx509negativeserial/Drivers/etc/hostsRCodeServerFailureWaitForSingleObjectGetFileAttributesExexec: canceling Cmdillegal instructionbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not" (Indicator: "PFXImportCertStore"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionEgypt Standard TimeSudan Standard TimeLibya Standard TimeBahia Standard TimeHaiti Standard TimeYukon Standard TimeAltai Standard TimeIndia Standard TimeSyria Standard TimeRussia Time Zone 11Nepal Standard TimeKorea Standard TimeChina Standard TimeRussia Time Zone 10Tokyo Standard TimeTomsk Standard TimeSamoa Standard TimeTonga Standard Timefile already existsfile does not existfile already closedQueryServiceConfigWCreatePseudoConsoleDisconnectNamedPipeGetDiskFreeSpaceExWGetLargePageMinimumGetSystemDirectoryWResizePseudoConsoleRtlAddFunctionTableGetForegroundWindowGetFileVersionInfoWWSALookupServiceEndembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersRCodeNotImplementedinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExW" (Indicator: "CertOpenSystemStoreW"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionEgypt Standard TimeSudan Standard TimeLibya Standard TimeBahia Standard TimeHaiti Standard TimeYukon Standard TimeAltai Standard TimeIndia Standard TimeSyria Standard TimeRussia Time Zone 11Nepal Standard TimeKorea Standard TimeChina Standard TimeRussia Time Zone 10Tokyo Standard TimeTomsk Standard TimeSamoa Standard TimeTonga Standard Timefile already existsfile does not existfile already closedQueryServiceConfigWCreatePseudoConsoleDisconnectNamedPipeGetDiskFreeSpaceExWGetLargePageMinimumGetSystemDirectoryWResizePseudoConsoleRtlAddFunctionTableGetForegroundWindowGetFileVersionInfoWWSALookupServiceEndembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersRCodeNotImplementedinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExW" (Indicator: "CryptAcquireContextW"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found api reference "etCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsinvalid write resultGetAdaptersAddressesNtSetInformationFileRtlIsDosDeviceName_UGetProcessMemoryInfobcryptprimitives.dllfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valueselectgo: bad wakeupsemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in goJordan Standard TimeArabic Standard TimeIsrael Standard TimeTaipei Standard TimeAzores Standard TimeTurkey Standard TimeChangeServiceConfigWCheckTokenMembershipQueryServiceConfig2WQueryServiceStatusExRegisterEventSourceWCertFindChainInStoreGetW" (Indicator: "CertFindChainInStore"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found api reference "ForMultipleObjectsNtSetSystemInformationRtlDeleteFunctionTableRtlGetNtVersionNumbersSetupDiEnumDriverInfoWSetupDiGetClassDevsExWWSALookupServiceBeginWsimulated CAST failureexit hook invoked exitsha3: Write after Readdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWGetSidSubAuthorityCountImpersonateLoggedOnUserDestroyEnvironmentBlockindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelems/gc/heap/allocs:objectsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0th" (Indicator: "CertGetCertificateChain"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found api reference "synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowgoroutine stack (system)unexpected syncgroup setdouble traceGCSweepStartbad use of trace.seqlockSA Pacific Standard TimeSA Eastern Standard TimeUS Eastern Standard TimeSA Western Standard TimeMontevideo Standard TimeMagallanes Standard TimePacific SA Standard TimeAzerbaijan Standard TimeBan" (Indicator: "CertFreeCertificateChain"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found api reference "ecurityDescriptorSetSecurityDescriptorDaclSetSecurityDescriptorSaclFindNextVolumeMountPointWFindVolumeMountPointCloseQueryInformationJobObjectNtQueryInformationProcessSetupDiCallClassInstallerSetupDiGetDevicePropertyWSetupDiGetSelectedDriverWSetupDiSetSelectedDriverWtesting simulated failureGODEBUG: can not enable "hash of unhashable type: GetFileInformationByHandleinvalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextPostQueuedCompletionStatusSetFileInformationByHandleRtlNtStatusToDosErrorNoTeball goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizernegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrin" (Indicator: "CertFreeCertificateContext"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin")32:T915,file/memory contains long string with (Indicator: "CertCloseStore"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "CryptProtectData"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "CryptDecodeObject"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "CertGetNameString"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "CryptUnprotectData"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "CryptReleaseContext"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "CertOpenSystemStore"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "CryptAcquireContext"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "CertFreeCertificateContext"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "CertEnumCertificatesInStore"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "CertFindCertificateInStore"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "CertDeleteCertificateFromStore"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "CertCloseStore" (Indicator: "CertCloseStore"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "CryptHashCertificate" (Indicator: "CryptHashCertificate"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin")33:T1173,Observed string: "crypto/rand" (Indicator: "crypto/rand") in Source: e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin Observed string: "crypto/internal/impl" (Indicator: "crypto/internal/impl") in Source: e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin Observed string: "crypto/internal/fips140/aes" (Indicator: "crypto/internal/fips140/aes") in Source: e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin Observed string: "crypto/internal/fips140/drbg" (Indicator: "crypto/internal/fips140/drbg") in Source: e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin Observed string: "crypto/internal/fips140/sha3" (Indicator: "crypto/internal/fips140/sha3") in Source: e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin Observed string: "crypto/internal/fips140/hmac" (Indicator: "crypto/internal/fips140/hmac") in Source: e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin Observed string: "crypto/internal/fips140/sha256" (Indicator: "crypto/internal/fips140/sha256") in Source: e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin Observed string: "crypto/internal/fips140/sha512" (Indicator: "crypto/internal/fips140/sha512") in Source: e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin Observed string: "crypto/internal/sysrand.fatal" (Indicator: "crypto/internal/sysrand.fatal") in Source: e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin Observed string: "crypto/internal/fips140deps/cpu.init" (Indicator: "crypto/internal/fips140deps/cpu.init") in Source: e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin Observed string: "crypto/internal/impl.Register" (Indicator: "crypto/internal/impl.Register") in Source: e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin Observed string: "type:.eq.crypto/internal/impl.implementation" (Indicator: "type:.eq.crypto/internal/impl.implementation") in Source: e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin Observed string: "type:.eq.crypto/internal/fips140/sha256.Digest" (Indicator: "type:.eq.crypto/internal/fips140/sha256.Digest") in Source: e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin Observed string: "type:.eq.crypto/internal/fips140/sha3.Digest" (Indicator: "type:.eq.crypto/internal/fips140/sha3.Digest") in Source: e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin Observed string: "crypto/internal/sysrand.warnBlocked" (Indicator: "crypto/internal/sysrand.warnBlocked") in Source: e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin Observed string: "crypto/internal/sysrand.Read" (Indicator: "crypto/internal/sysrand.Read") in Source: e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin Observed string: "crypto/internal/sysrand.read" (Indicator: "crypto/internal/sysrand.read") in Source: e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin Observed string: "crypto/internal/sysrand.Read.deferwrap1" (Indicator: "crypto/internal/sysrand.Read.deferwrap1") in Source: e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin Observed string: "crypto/internal/entropy.Depleted" (Indicator: "crypto/internal/entropy.Depleted") in Source: e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin Observed string: "crypto/internal/fips140only.init" (Indicator: "crypto/internal/fips140only.init") in Source: e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin Observed string: "crypto/internal/boring/sig.StandardCrypto" (Indicator: "crypto/internal/boring/sig.StandardCrypto") in Source: e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin Observed string: "crypto/rand.init.0" (Indicator: "crypto/rand.init.0") in Source: e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin Observed string: "crypto/rand.(*reader).Read" (Indicator: "crypto/rand.(*reader).Read") in Source: e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin, Observed string: "crypto/internal/boring.Unreachable" (Indicator: "crypto/internal/boring.Unreachable") in Source: e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin, Observed string: "crypto/internal/fips140.fatal" (Indicator: "crypto/internal/fips140.fatal") in Source: e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin34:T78c,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains possible references to Golang crypto modules Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Contains ability to decrypt data using RSA (Dotnet String) Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Contains ability to decode base64 data Matched sigs: Contains ability to encrypt data using RSA (Dotnet String) Matched sigs: Contains ability to perform AES decryption (Dotnet String) Matched sigs: Reads the cryptographic machine GUID Matched sigs: Able to decode string content at runtime (.NET) Matched sigs: YARA signature match – Encryption algorithm Matched sigs: YARA signature match - AES encryption Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Able to decrypt/decode data Matched sigs: Able to perform cryptographic operations Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Drops file with high entropy indicating encryption/obfuscation Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: YARA signature match – cryptographic algorithms Matched sigs: YARA signature match - ChaCha20 encryption algorithm35:Tccf6,Found XOR loop in file "ScreenConnect.Windows.dll" at offset 51969; code bytes = 30d0 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 788350; code bytes = 30d0 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 807416; code bytes = 30d0 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 812588; code bytes = 30d0 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1545596; code bytes = 30d0 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1725775; code bytes = 30d0 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 403576; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 465733; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 478581; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 504048; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 663646; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 663651; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 786889; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 794498; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 794627; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 846261; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 858997; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 884520; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 987345; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1041092; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1041832; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1042211; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1042652; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1043037; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1107281; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1116368; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1116416; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1116472; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1336432; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1451611; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1640308; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 48997; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 466360; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 479208; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 492475; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 498971; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 499107; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 516578; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 534139; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 665978; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 717797; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 846888; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 859624; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 872947; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 879443; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 879579; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 897050; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 904940; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 917290; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 946038; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1020210; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1099794; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1134901; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1725756; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsCredentialProvider.dll" at offset 703672; code bytes = 30d0 Found XOR loop in file "ScreenConnect.WindowsCredentialProvider.dll" at offset 703696; code bytes = 30d0 Found XOR loop in file "ScreenConnect.WindowsCredentialProvider.dll" at offset 377003; code bytes = 33c1 Found XOR loop in file "ScreenConnect.WindowsCredentialProvider.dll" at offset 488400; code bytes = 33c1 Found XOR loop in file "ScreenConnect.WindowsCredentialProvider.dll" at offset 357925; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsCredentialProvider.dll" at offset 626720; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsCredentialProvider.dll" at offset 852672; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsCredentialProvider.dll" at offset 852919; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsCredentialProvider.dll" at offset 854505; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsClient.exe" at offset 284902; code bytes = 30d0 Found XOR loop in file "ScreenConnect.WindowsClient.exe" at offset 57742; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsClient.exe" at offset 240079; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsClient.exe" at offset 356356; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsClient.exe" at offset 365732; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsClient.exe" at offset 600294; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsClient.exe" at offset 603084; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsClient.exe" at offset 603331; code bytes = 8030 Found XOR loop in file "ScreenConnect.Core.dll" at offset 90071; code bytes = 30d0 Found XOR loop in file "ScreenConnect.Core.dll" at offset 93165; code bytes = 30d0 Found XOR loop in file "ScreenConnect.Core.dll" at offset 386399; code bytes = 30d0 Found XOR loop in file "ScreenConnect.Core.dll" at offset 64108; code bytes = 8030 Found XOR loop in file "ScreenConnect.Core.dll" at offset 164517; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsAuthenticationPackage.dll" at offset 178288; code bytes = 30d0 Found XOR loop in file "ScreenConnect.WindowsAuthenticationPackage.dll" at offset 34912; code bytes = 33c1 Found XOR loop in file "ScreenConnect.WindowsAuthenticationPackage.dll" at offset 161775; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsAuthenticationPackage.dll" at offset 204180; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsAuthenticationPackage.dll" at offset 245446; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsAuthenticationPackage.dll" at offset 245693; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsAuthenticationPackage.dll" at offset 247440; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsAuthenticationPackage.dll" at offset 255955; code bytes = 8030 Found XOR loop in file "ScreenConnect.Client.dll" at offset 149053; code bytes = 30d0 Found XOR loop in file "ScreenConnect.Client.dll" at offset 162645; code bytes = 30d0 Found XOR loop in file "ScreenConnect.Client.dll" at offset 179151; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Client.dll" at offset 47225; code bytes = 8030 Found XOR loop in file "ScreenConnect.Client.dll" at offset 83866; code bytes = 8030 Found XOR loop in file "ScreenConnect.Client.dll" at offset 153616; code bytes = 8030 Found XOR loop in file "ScreenConnect.Client.dll" at offset 164568; code bytes = 8030 Found XOR loop in file "ScreenConnect.Client.dll" at offset 166600; code bytes = 8030 Found XOR loop in file "ScreenConnect.Client.dll" at offset 167096; code bytes = 8030 Found XOR loop in file "ScreenConnect.Client.dll" at offset 191352; code bytes = 8030 Found XOR loop in file "Microsoft.Deployment.WindowsInstaller.dll" at offset 48094; code bytes = 8030 Found XOR loop in file "Microsoft.Deployment.WindowsInstaller.dll" at offset 50855; code bytes = 8030 Found XOR loop in file "Microsoft.Deployment.WindowsInstaller.dll" at offset 51407; code bytes = 8030 Found XOR loop in file "Microsoft.Deployment.WindowsInstaller.dll" at offset 51635; code bytes = 8030 Found XOR loop in file "Microsoft.Deployment.WindowsInstaller.dll" at offset 52919; code bytes = 8030 Found XOR loop in file "Microsoft.Deployment.WindowsInstaller.dll" at offset 53351; code bytes = 8030 Found XOR loop in file "Microsoft.Deployment.WindowsInstaller.dll" at offset 53441; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientService.exe" at offset 7051; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientService.exe" at offset 7874; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientService.exe" at offset 83352; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientService.exe" at offset 87782; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientService.exe" at offset 90571; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientService.exe" at offset 90818; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsFileManager.exe" at offset 53820; code bytes = 33c1 Found XOR loop in file "ScreenConnect.WindowsFileManager.exe" at offset 53864; code bytes = 33c1 Found XOR loop in file "ScreenConnect.WindowsFileManager.exe" at offset 53892; code bytes = 33c1 Found XOR loop in file "ScreenConnect.WindowsFileManager.exe" at offset 53936; code bytes = 33c1 Found XOR loop in file "ScreenConnect.WindowsFileManager.exe" at offset 29003; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsFileManager.exe" at offset 73958; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsFileManager.exe" at offset 76747; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsFileManager.exe" at offset 76994; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientService.dll" at offset 1352; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsBackstageShell.exe" at offset 8595; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsBackstageShell.exe" at offset 53478; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsBackstageShell.exe" at offset 56268; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsBackstageShell.exe" at offset 56515; code bytes = 8030 Found XOR loop in file "Microsoft.Deployment.Compression.dll" at offset 11797; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 35635; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 164779; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 167873; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 461107; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 677589; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 1413970; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 1433036; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 1438208; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 2171216; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 2351395; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 2520612; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 2601993; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 2616099; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 2637409; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 2694685; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 3056641; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 3062998; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 3153885; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 3224903; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 3409175; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 3483657; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 3578109; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 3707492; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 3740585; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 3747865; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 3760919; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 3796956; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 4036491; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 4081824; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 4092391; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 4107390; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 4154146; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 4160917; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 4338388; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 4388449; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 4420912; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 4428246; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 4624507; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 4691259; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 4727559; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 4732167; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 4762593; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 4791967; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 4877424; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 4916057; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 4957724; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 4959374; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 4997973; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 5020129; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 5035661; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 5132611; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 5175071; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 5175784; code bytes = 30d0 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 3187; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 4838; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 1029196; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 1091353; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 1104201; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 1129668; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 1289266; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 1289271; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 1412509; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 1420118; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 1420247; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 1471881; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 1484617; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 1510140; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 1612965; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 1666712; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 1667452; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 1667831; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 1668272; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 1668657; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 1732901; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 1741988; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 1742036; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 1742092; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 1962052; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 2077231; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 2265928; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 2577705; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 2608739; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 2612187; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 2702531; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 2923047; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 2932440; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 2995705; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 3176151; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 3348591; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 3403236; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 3462688; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 3534324; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 3586581; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 3587362; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 3714759; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 3746189; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 3836467; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 3838009; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 3847572; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 3904577; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 3922432; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 3923658; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 4035962; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 4101830; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 4113780; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 4136804; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 4303051; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 4312038; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 4372729; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 4403417; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 4550506; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 4578571; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 4639585; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 4648283; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 4698604; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 4789650; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 5019032; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 5050089; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 5081050; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 5111328; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 5153575; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 5178999; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 138816; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 239225; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 674617; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 1091980; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 1104828; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 1118095; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 1124591; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 1124727; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 1142198; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 1159759; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 1291598; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 1343417; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 1472508; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 1485244; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 1498567; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 1505063; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 1505199; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 1522670; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 1530560; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 1542910; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 1571658; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 1645830; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 1725414; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 1760521; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 2351376; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 2763842; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 2821534; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 2835705; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 2868726; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 2958620; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 2965130; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 3001104; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 3039038; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 3059860; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 3063536; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 3087831; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 3157763; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 3157829; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 3351639; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 3363809; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 3369176; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 3370024; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 3417051; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 3436515; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 3447230; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 3528696; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 3552884; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 3554978; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 3647414; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 3736346; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 3811325; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 3843514; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 3859322; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 3949220; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 4046837; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 4076645; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 4125173; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 4223339; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 4281167; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 4303744; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 4377751; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 4567810; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 4781478; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 4840107; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 4945959; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 5030739; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 5038815; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 5057952; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientSetup.exe3896969975" at offset 5211704; code bytes = 8030 Found XOR loop in file "MSI4F2E.tmp" at offset 170376; code bytes = 30d0 Found XOR loop in file "MSI4F2E.tmp" at offset 220437; code bytes = 30d0 Found XOR loop in file "MSI4F2E.tmp" at offset 252900; code bytes = 30d0 Found XOR loop in file "MSI4F2E.tmp" at offset 260234; code bytes = 30d0 Found XOR loop in file "MSI4F2E.tmp" at offset 456495; code bytes = 30d0 Found XOR loop in file "MSI4F2E.tmp" at offset 523247; code bytes = 30d0 Found XOR loop in file "MSI4F2E.tmp" at offset 559547; code bytes = 30d0 Found XOR loop in file "MSI4F2E.tmp" at offset 564155; code bytes = 30d0 Found XOR loop in file "MSI4F2E.tmp" at offset 594581; code bytes = 30d0 Found XOR loop in file "MSI4F2E.tmp" at offset 623955; code bytes = 30d0 Found XOR loop in file "MSI4F2E.tmp" at offset 709412; code bytes = 30d0 Found XOR loop in file "MSI4F2E.tmp" at offset 748045; code bytes = 30d0 Found XOR loop in file "MSI4F2E.tmp" at offset 789712; code bytes = 30d0 Found XOR loop in file "MSI4F2E.tmp" at offset 791362; code bytes = 30d0 Found XOR loop in file "MSI4F2E.tmp" at offset 829961; code bytes = 30d0 Found XOR loop in file "MSI4F2E.tmp" at offset 852117; code bytes = 30d0 Found XOR loop in file "MSI4F2E.tmp" at offset 867649; code bytes = 30d0 Found XOR loop in file "MSI4F2E.tmp" at offset 964599; code bytes = 30d0 Found XOR loop in file "MSI4F2E.tmp" at offset 1007059; code bytes = 30d0 Found XOR loop in file "MSI4F2E.tmp" at offset 1007772; code bytes = 30d0 Found XOR loop in file "MSI4F2E.tmp" at offset 135039; code bytes = 33c1 Found XOR loop in file "MSI4F2E.tmp" at offset 144026; code bytes = 33c1 Found XOR loop in file "MSI4F2E.tmp" at offset 204717; code bytes = 33c1 Found XOR loop in file "MSI4F2E.tmp" at offset 235405; code bytes = 33c1 Found XOR loop in file "MSI4F2E.tmp" at offset 382494; code bytes = 33c1 Found XOR loop in file "MSI4F2E.tmp" at offset 410559; code bytes = 33c1 Found XOR loop in file "MSI4F2E.tmp" at offset 471573; code bytes = 33c1 Found XOR loop in file "MSI4F2E.tmp" at offset 480271; code bytes = 33c1 Found XOR loop in file "MSI4F2E.tmp" at offset 530592; code bytes = 33c1 Found XOR loop in file "MSI4F2E.tmp" at offset 621638; code bytes = 33c1 Found XOR loop in file "MSI4F2E.tmp" at offset 851020; code bytes = 33c1 Found XOR loop in file "MSI4F2E.tmp" at offset 882077; code bytes = 33c1 Found XOR loop in file "MSI4F2E.tmp" at offset 913038; code bytes = 33c1 Found XOR loop in file "MSI4F2E.tmp" at offset 943316; code bytes = 33c1 Found XOR loop in file "MSI4F2E.tmp" at offset 985563; code bytes = 33c1 Found XOR loop in file "MSI4F2E.tmp" at offset 1010987; code bytes = 33c1 Found XOR loop in file "MSI4F2E.tmp" at offset 1084815; code bytes = 33c1 Found XOR loop in file "MSI4F2E.tmp" at offset 55327; code bytes = 8030 Found XOR loop in file "MSI4F2E.tmp" at offset 113155; code bytes = 8030 Found XOR loop in file "MSI4F2E.tmp" at offset 135732; code bytes = 8030 Found XOR loop in file "MSI4F2E.tmp" at offset 209739; code bytes = 8030 Found XOR loop in file "MSI4F2E.tmp" at offset 399798; code bytes = 8030 Found XOR loop in file "MSI4F2E.tmp" at offset 613466; code bytes = 8030 Found XOR loop in file "MSI4F2E.tmp" at offset 672095; code bytes = 8030 Found XOR loop in file "MSI4F2E.tmp" at offset 777947; code bytes = 8030 Found XOR loop in file "MSI4F2E.tmp" at offset 862727; code bytes = 8030 Found XOR loop in file "MSI4F2E.tmp" at offset 870803; code bytes = 8030 Found XOR loop in file "MSI4F2E.tmp" at offset 889940; code bytes = 8030 Found XOR loop in file "MSI4F2E.tmp" at offset 1043692; code bytes = 8030 Found XOR loop in file "MSI4F2E.tmp" at offset 1080982; code bytes = 8030 Found XOR loop in file "MSI4F2E.tmp" at offset 1086434; code bytes = 8030 Found XOR loop in file "MSI6901.tmp" at offset 203891; code bytes = 30d0 Found XOR loop in file "MSI6901.tmp" at offset 206671; code bytes = 30d0 Found XOR loop in file "MSI6901.tmp" at offset 204721; code bytes = 33c1 Found XOR loop in file "MSI6901.tmp" at offset 101287; code bytes = 8030 Found XOR loop in file "MSI6901.tmp" at offset 206652; code bytes = 8030 Found XOR loop in file "MSI6A0C.tmp" at offset 203891; code bytes = 30d0 Found XOR loop in file "MSI6A0C.tmp" at offset 206671; code bytes = 30d0 Found XOR loop in file "MSI6A0C.tmp" at offset 204721; code bytes = 33c1 Found XOR loop in file "MSI6A0C.tmp" at offset 101287; code bytes = 8030 Found XOR loop in file "MSI6A0C.tmp" at offset 206652; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 87154; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1583760; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1698828; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1951987; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2081131; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2084225; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2377459; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2593941; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3330322; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3349388; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3354560; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4087568; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4267747; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4436964; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4518345; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4532451; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4553761; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4611037; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4972993; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4979350; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5070237; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5141255; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5325527; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5400009; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5494461; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5623844; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5656937; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5664217; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5677271; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5713308; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5952843; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5998176; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6008743; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6023742; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6070498; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6077269; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6254740; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6304801; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6337264; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6344598; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6540859; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6607611; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6643911; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6648519; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6678945; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6708319; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6793776; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6832409; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6874076; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6875726; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6914325; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6936481; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6952013; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7048963; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7091423; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7092136; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7377791; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7380571; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1919539; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1921190; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2945548; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3007705; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3020553; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3046020; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3205618; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3205623; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3328861; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3336470; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3336599; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3388233; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3400969; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3426492; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3529317; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3583064; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3583804; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3584183; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3584624; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3585009; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3649253; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3658340; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3658388; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3658444; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3878404; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3993583; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4182280; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4494057; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4525091; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4528539; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4618883; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4839399; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4848792; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4912057; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5092503; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5264943; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5319588; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5379040; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5450676; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5502933; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5503714; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5631111; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5662541; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5752819; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5754361; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5763924; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5820929; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5838784; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5840010; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5952314; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6018182; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6030132; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6053156; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6219403; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6228390; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6289081; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6319769; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6466858; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6494923; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6555937; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6564635; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6614956; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6706002; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6935384; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6966441; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6997402; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7027680; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7069927; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7095351; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7169179; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7378621; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7647032; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 187542; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 226121; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 226481; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 226881; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 229043; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 252369; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 272496; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 422277; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 422973; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 423614; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 433993; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 930636; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1250756; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1419900; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1700184; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1746208; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1821304; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2055168; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2155577; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2590969; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3008332; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3021180; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3034447; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3040943; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3041079; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3058550; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3076111; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3207950; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3259769; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3388860; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3401596; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3414919; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3421415; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3421551; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3439022; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3446912; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3459262; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3488010; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3562182; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3641766; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3676873; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4267728; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4680194; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4737886; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4752057; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4785078; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4874972; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4881482; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4917456; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4955390; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4976212; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4979888; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5004183; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5074115; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5074181; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5267991; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5280161; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5285528; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5286376; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5333403; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5352867; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5363582; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5445048; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5469236; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5471330; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5563766; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5652698; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5727677; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5759866; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5775674; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5865572; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5963189; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5992997; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6041525; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6139691; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6197519; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6220096; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6294103; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6484162; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6697830; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6756459; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6862311; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6947091; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6955167; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6974304; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7128056; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7165346; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7170798; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7275187; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7380552; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7445626; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7448415; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7448662; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7463324; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7466665; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7469457; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7469704; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7647928; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7656340; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7687822; code bytes = 803036:T6a9,file/memory contains long string with (Indicator: "GetCommandLine"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "GetCommandLine"; File: "ScreenConnect.ClientService.exe") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00000684-00000C2C-1937793592") Found string "syscall.GetCommandLine" (Indicator: "GetCommandLine"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found string "GetCommandLineArgs" (Indicator: "GetCommandLine"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found string "GetLastInputInfo" (Indicator: "GetLastInputInfo"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "GetCommandLine"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") Found string "syscall.GetCommandLine" (Indicator: "GetCommandLine"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00004284.00000001.190028.00EDD000.00000002.mdmp, 00000000-00004284.00000001.190028.06800000.00000004.mdmp, 00000000-00004284.00000001.190028.08110000.00000004.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004284.00000001.190028.00EDD000.00000002.mdmp, 00000000-00004284.00000001.190028.06800000.00000004.mdmp, 00000000-00004284.00000001.190028.08110000.00000004.mdmp")37:T52a,file/memory contains long string with (Indicator: "WTSFreeMemory"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "ProcessIdToSessionId"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "WTSEnumerateSessions"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "ProcessIdToSessionId"; File: "ScreenConnect.WindowsBackstageShell.exe") Found reference to API "ProcessIdToSessionId" (Indicator: "ProcessIdToSessionId"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "WTSEnumerateSessions" (Indicator: "WTSEnumerateSessions"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "WTSFreeMemory" (Indicator: "WTSFreeMemory"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "WTSFreeMemory"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") file/memory contains long string with (Indicator: "WTSEnumerateSessions"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp")38:T6e8,file/memory contains long string with (Indicator: "FreeSid"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "CheckTokenMembership"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "AllocateAndInitializeSid"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004284-00000C2C-1940062425") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00004284-00000C2C-1940063048") file/memory contains long string with (Indicator: "FreeSid"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") file/memory contains long string with (Indicator: "CheckTokenMembership"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") file/memory contains long string with (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp, 00000000-00004284.00000001.190028.08110000.00000004.mdmp")39:Ta64,Found system information discovery API: "GetEnvironmentStringsW" in file "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin" Found system information discovery API: "GetSystemInfo" in file "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin" Found system information discovery API: "GetEnvironmentStrings (in long string)" in file "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin" Found system information discovery API: "ExpandEnvironmentStrings (in long string)" in file "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin" Found system information discovery API: "RtlNtStatusToDosError (in long string)" in file "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin" Found system information discovery API: "syscall.GetEnvironmentStrings" in file "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin" Found system information discovery API: "GetUserObjectInformation" in file "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin" Found system information discovery API: "GetMonitorInfo" in file "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin" Found system information discovery API: "GetUserObjectInformationW" in file "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin" Found system information discovery API: "ExpandEnvironmentStringsW" in file "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin" Found system information discovery API: "RtlNtStatusToDosError" in file "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin" Found system information discovery API: "ExpandEnvironmentStrings (in long string)" in "00000000-00000684.00000000.189801.6693D000.00000002.mdmp" Found system information discovery API: "syscall.GetEnvironmentStrings" in "00000000-00000684.00000000.189801.6693D000.00000002.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00004284.00000000.189912.711D1000.00000002.mdmp, 00000000-00004284.00000001.190028.08110000.00000004.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00004284.00000000.189912.711D1000.00000002.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00004284.00000000.189912.711D1000.00000002.mdmp, 00000000-00004284.00000001.190028.71235000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00004284.00000001.190028.00EDD000.00000002.mdmp, 00000000-00004284.00000001.190028.06800000.00000004.mdmp, 00000000-00004284.00000001.190028.08110000.00000004.mdmp"3a:T1779,file/memory contains long string with (Indicator: "enumwindows"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "enumchildwindows"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "CommandSendMessage" (Indicator: "sendmessage"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "sendmessage"; File: "ScreenConnect.WindowsFileManager.exe") file/memory contains long string with (Indicator: "sendmessage"; File: "ScreenConnect.ClientService.dll") file/memory contains long string with (Indicator: "sendmessage"; File: "ScreenConnect.WindowsBackstageShell.exe") Found reference to API "HasSendMessageCapability" (Indicator: "sendmessage"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "EnumWindowStationProc" (Indicator: "enumwindows"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "EnumWindowsProc" (Indicator: "enumwindows"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "WmsgSendMessage" (Indicator: "sendmessage"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "PostMessage" (Indicator: "postmessage"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "EnumWindowStations" (Indicator: "enumwindows"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "SendMessageTimeout" (Indicator: "sendmessage"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "FindWindowEx" (Indicator: "findwindow"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "SendMessage" (Indicator: "sendmessage"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "SYSTEMROOT=broken pipealarm clockbad messagefile existsbad addressRegCloseKeyCloseHandleCreateFileWDeleteFileWExitProcessFreeLibrarySetFileTimeVirtualLockWSARecvFromclosesocketgetpeernamegetsocknamecrypt32.dllmswsock.dllsecur32.dllshell32.dlluserenv.dllshort writeProcessPrngMoveFileExWNetShareAddNetShareDelassistQueuenetpollInitreflectOffsglobalAllocmSpanManualstart traceclobberfreegccheckmarkscheddetailunspecifiedcgocall nil s.nelems= of size runtime: p ms clock, nBSSRoots=runtime: P exp.) for minTrigger=GOMEMLIMIT=bad m value, elemsize= freeindex= span.list=, npages = p->status= in status idleprocs= gcwaiting= schedtick= timerslen= mallocing=bad timedivfloat64nan1float64nan2float64nan3float32nan2GOTRACEBACK) at entry+ (targetpc= , plugin: running < 0runtime: g : frame.sp=created by i/o timeoutsechost.dllversion.dllGetFileTimeSetCommMaskVirtualFreeNetUserEnumCoGetObjectEnumWindowsMessageBoxWgocachehashgocachetesthttp2clienthttp2serverrandseednoparchive/tartls10servercrypto/x509archive/zipClassHESIODexit status can't happeninvalid slothost is downillegal seekGetLengthSidGetLastErrorGetStdHandleGetTempPathWLoadLibraryWReadConsoleWSetEndOfFileTransmitFileGetAddrInfoWadvapi32.dlliphlpapi.dllkernel32.dllnetapi32.dllOpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQueryNtCreateFilesweepWaiterscleanupQueuetraceStringsspanSetSpinemspanSpecialtraceTypeTabgcBitsArenasmheapSpecialgcpacertraceharddecommitmadvdontneeddumping heapchan receivesynctest.Runcleanup wait span.limit= span.state=bad flushGen MB stacks, scan: total scan: class worker mode nDataRoots= nSpanRoots= wbuf1= wbuf2= gcscandone runtime: gp= found at *( s.elemsize= B (" (Indicator: "enumwindows"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") Found reference to API "SetEntriesInAclWSetServiceStatusCryptProtectDataCryptQueryObjectConnectNamedPipeCreateJobObjectWDefineDosDeviceWFindFirstVolumeWGetLogicalDrivesGetNamedPipeInfoGetPriorityClassSetDllDirectoryWSetFileValidDataSetPriorityClassVirtualProtectExRtlGetCurrentPebEnumChildWindowsGetDesktopWindowGetGUIThreadInfoWinVerifyTrustExGODEBUG: value "allowmultiplevcshttpcookiemaxnumRCodeFormatErrorwinreadlinkvolumeexec: killing Cmdexec: not startedpermission deniedwrong medium typeno data availableexec format errorLookupAccountSidWDnsRecordListFreeGetCurrentProcessGetShortPathNameWWSAEnumProtocolsWRegLoadMUIStringWgoroutine profileAllThreadsSyscallcontainermaxprocsGC assist markingselect (no cases)sync.RWMutex.Lockwait for GC cycletrace proc statussync.(*Cond).Wait: missing method notetsleepg on g0bad TinySizeClassimmortal metadataruntime: pointer g already scannedmark - bad statusscanobject n == 0swept cached spanmarkBits overflowruntime: summary[runtime: level = p.searchAddr = RtlGetCurrentPeb" (Indicator: "enumchildwindows"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp"), Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00004284.00000000.189912.035C0000.00000004.mdmp 00000000-00004284.00000001.190028.035C0000.00000004.mdmp"), Found reference to API "ommandSendMessage|" (Indicator: "sendmessage"; Source: "00000000-00004284.00000001.190028.06800000.00000004.mdmp")3b:T28d6,"__GetVersion" (Indicator: "GetVersion"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "GetVersionInfo" (Indicator: "GetVersion"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "3957685494,7700,3024,,RtlGetVersion,NTDLL.dll,"00:49:22.375",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00000684.00000000.189801.20EA0000.00000004.mdmp, 00000000-00000684.00000001.190047.20EA0000.00000004.mdmp") file/memory contains long string with (Indicator: "GetVersion"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") Found reference to API "internal/syscall/windows.rtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp, 00000000-00004284.00000001.190028.71235000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp, 00000000-00004284.00000001.190028.71235000.00000002.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp, 00000000-00004284.00000001.190028.08110000.00000004.mdmp, 00000000-00004284.00000001.190028.71235000.00000002.mdmp") Found reference to API "14871159572,5768,3024,,RtlGetVersion,NTDLL.dll,"00:49:28.765",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00004284.00000001.190028.035C0000.00000004.mdmp") Found reference to API "14436712706,5768,3024,,RtlGetVersion,NTDLL.dll,"00:49:28.578",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00004284.00000001.190028.035C0000.00000004.mdmp") Found reference to API "14429361936,5768,3024,,RtlGetVersion,NTDLL.dll,"00:49:28.578",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00004284.00000001.190028.035C0000.00000004.mdmp") Found reference to API "14872799978,5768,3024,,RtlGetVersion,NTDLL.dll,"00:49:28.765",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00004284.00000001.190028.035C0000.00000004.mdmp") Found reference to API "14674469898,5768,3024,,RtlGetVersion,NTDLL.dll,"00:49:28.671",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00004284.00000001.190028.035C0000.00000004.mdmp")42:T465,"ScreenConnect.ClientSetup.exe3896969975" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00000000-00004284-00000C17-1943241771 "rundll32.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\MSI4F2E.tmp-\Microsoft.Deployment.WindowsInstaller.dll" at 00000000-00007320-00000C17-1948182155 "rundll32.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\MSI4F2E.tmp-\ScreenConnect.InstallerActions.dll" at 00000000-00007320-00000C17-1948514591 "rundll32.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\MSI4F2E.tmp-\ScreenConnect.Core.dll" at 00000000-00007320-00000C17-1948557668 "rundll32.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\MSI4F2E.tmp-\ScreenConnect.Windows.dll" at 00000000-00007320-00000C17-1948583228 "rundll32.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00000000-00007320-00000C17-194860075343:T437,Found registry modification API: "RegCreateKey (in long string)" in file "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin" Found registry modification API: "RegLoadMUIString (in long string)" in file "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin" Found registry modification API: "RegConnectRegistry (in long string)" in file "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin" Found registry modification API: "RegCreateKeyEx" in file "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin" Found registry modification API: "RegCreateKeyExW" in file "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin" Found registry modification API: "RegCreateKeyW" in file "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin" Found registry modification API: "RegLoadMUIString (in long string)" in "00000000-00000684.00000000.189801.6693D000.00000002.mdmp" Found registry modification API: "RegCreateKeyExW" in "00000000-00004284.00000000.189912.711D1000.00000002.mdmp"44:T688,file/memory contains long string with (Indicator: "OpenSCManager"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "QueryServiceStatus"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "EnumServicesStatus"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "EnumDependentServices"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "OpenSCManager" (Indicator: "OpenSCManager"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "QueryServiceStatus" (Indicator: "QueryServiceStatus"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "OpenSCManagerW" (Indicator: "OpenSCManager"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "OpenSCManager"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") file/memory contains long string with (Indicator: "QueryServiceStatus"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") Found reference to API "QueryServiceStatus" (Indicator: "QueryServiceStatus"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp, 00000000-00004284.00000001.190028.08110000.00000004.mdmp") Found reference to API "OpenSCManagerW" (Indicator: "OpenSCManager"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp")45:T2edd,"b__2_0" (Indicator: "LoadResource"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "b__3_0" (Indicator: "LoadResource"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "b__1" (Indicator: "LoadResource"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "LoadResourcePack" (Indicator: "LoadResource"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "LoadResourcesFromStream" (Indicator: "LoadResource"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "LoadResourcePacks" (Indicator: "LoadResource"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "b__0_0" (Indicator: "LoadResource"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "LoadResourcePackFromFile" (Indicator: "LoadResource"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "FindResource" (Indicator: "FindResource"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "LoadResource"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") file/memory contains long string with (Indicator: "LockResource"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") file/memory contains long string with (Indicator: "FindResource"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") Found reference to API "10063664540,3044,3141,,LoadResource,kernel32.dll,"00:49:26.750",RX=0,PX=0" (Indicator: "LoadResource"; Source: "00000000-00004284.00000000.189912.035C0000.00000004.mdmp") Found reference to API "7228540538,3044,3141,,LoadResource,kernel32.dll,"00:49:25.578",RX=0,PX=0" (Indicator: "LoadResource"; Source: "00000000-00004284.00000000.189912.035C0000.00000004.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00004284.00000000.189912.056C0000.00000004.mdmp, 00000000-00004284.00000000.189912.05800000.00000004.mdmp, 00000000-00004284.00000000.189912.711D1000.00000002.mdmp, 00000000-00004284.00000001.190028.00EDD000.00000002.mdmp, 00000000-00004284.00000001.190028.71235000.00000002.mdmp") Found reference to API "FindResource" (Indicator: "FindResource"; Source: "00000000-00004284.00000000.189912.056C0000.00000004.mdmp, 00000000-00004284.00000000.189912.05800000.00000004.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00004284.00000000.189912.056C0000.00000004.mdmp, 00000000-00004284.00000000.189912.05800000.00000004.mdmp, 00000000-00004284.00000000.189912.711D1000.00000002.mdmp, 00000000-00004284.00000001.190028.00EDD000.00000002.mdmp, 00000000-00004284.00000001.190028.71235000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00004284.00000000.189912.056C0000.00000004.mdmp, 00000000-00004284.00000000.189912.05800000.00000004.mdmp, 00000000-00004284.00000000.189912.711D1000.00000002.mdmp, 00000000-00004284.00000001.190028.00EDD000.00000002.mdmp, 00000000-00004284.00000001.190028.71235000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp, 00000000-00004284.00000001.190028.00EDD000.00000002.mdmp, 00000000-00004284.00000001.190028.71235000.00000002.mdmp")4b:T6ae,file/memory contains long string with (Indicator: "GetCommandLine"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "CommandLineToArgv"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "syscall.GetCommandLine" (Indicator: "GetCommandLine"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "GetCommandLineArgs" (Indicator: "GetCommandLine"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "CommandLineToArgv"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") Found reference to API "syscall.GetCommandLine" (Indicator: "GetCommandLine"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00004284.00000001.190028.00EDD000.00000002.mdmp, 00000000-00004284.00000001.190028.06800000.00000004.mdmp, 00000000-00004284.00000001.190028.08110000.00000004.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004284.00000001.190028.00EDD000.00000002.mdmp, 00000000-00004284.00000001.190028.06800000.00000004.mdmp, 00000000-00004284.00000001.190028.08110000.00000004.mdmp")4c:Ta48,Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "OpenThread"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "ResumeThread"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "CreateThreadRunContext" (Indicator: "CreateThread"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "OpenThread" (Indicator: "OpenThread"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "OpenThread"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") file/memory contains long string with (Indicator: "ResumeThread"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp, 00000000-00004284.00000001.190028.08110000.00000004.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp")4d:T58d,file/memory contains long string with (Indicator: "OpenProcess"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "<1>__OpenProcessToken" (Indicator: "OpenProcess"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp, 00000000-00004284.00000001.190028.08110000.00000004.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp, 00000000-00004284.00000001.190028.00EDD000.00000002.mdmp, 00000000-00004284.00000001.190028.06800000.00000004.mdmp, 00000000-00004284.00000001.190028.08110000.00000004.mdmp, 00000000-00004284.00000001.190028.71235000.00000002.mdmp")4e:T48f,file/memory contains long string with (Indicator: "GetLastError"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp, 00000000-00004284.00000001.190028.00EDD000.00000002.mdmp, 00000000-00004284.00000001.190028.06800000.00000004.mdmp, 00000000-00004284.00000001.190028.08110000.00000004.mdmp, 00000000-00004284.00000001.190028.71235000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp, 00000000-00004284.00000001.190028.00EDD000.00000002.mdmp, 00000000-00004284.00000001.190028.06800000.00000004.mdmp, 00000000-00004284.00000001.190028.08110000.00000004.mdmp, 00000000-00004284.00000001.190028.71235000.00000002.mdmp")4f:T4ae,file/memory contains long string with (Indicator: "StartService"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "StartServiceCtrlDispatcher"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "StartService" (Indicator: "StartService"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "StartServiceCtrlDispatcherW" (Indicator: "StartServiceCtrlDispatcher"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "StartServiceCtrlDispatcherW" (Indicator: "StartService"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "StartServiceW" (Indicator: "StartService"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "StartService"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") Found reference to API "StartServiceW" (Indicator: "StartService"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp")50:T910,"ScreenConnect.WindowsCredentialProvider.dll" contains export function called "DllGetClassObject" at ordinal 1 "ScreenConnect.WindowsAuthenticationPackage.dll" contains export function called "LsaApCallPackage" at ordinal 1 "ScreenConnect.WindowsAuthenticationPackage.dll" contains export function called "LsaApCallPackagePassthrough" at ordinal 2 "ScreenConnect.WindowsAuthenticationPackage.dll" contains export function called "LsaApCallPackageUntrusted" at ordinal 3 "ScreenConnect.WindowsAuthenticationPackage.dll" contains export function called "LsaApInitializePackage" at ordinal 4 "ScreenConnect.WindowsAuthenticationPackage.dll" contains export function called "LsaApLogonTerminated" at ordinal 5 "ScreenConnect.WindowsAuthenticationPackage.dll" contains export function called "LsaApLogonUser" at ordinal 6 "MSI4F2E.tmp" contains export function called "FixupServiceArguments" at ordinal 127 "MSI4F2E.tmp" contains export function called "TerminateProcesses" at ordinal 128 "MSI4F2E.tmp" contains export function called "zzzEmbeddedUIHandler" at ordinal 129 "MSI4F2E.tmp" contains export function called "zzzInitializeEmbeddedUI" at ordinal 130 "MSI4F2E.tmp" contains export function called "zzzShutdownEmbeddedUI" at ordinal 131 "MSI4F2E.tmp" contains export function called "zzzzInvokeManagedCustomActionOutOfProcW" at ordinal 132 "MSI6901.tmp" contains export function called "CAQuietExec" at ordinal 2 "MSI6901.tmp" contains export function called "CAQuietExec64" at ordinal 1 "MSI6901.tmp" contains export function called "CommitCAScriptCleanup" at ordinal 3 "MSI6901.tmp" contains export function called "ExecSecureObjects" at ordinal 4 "MSI6901.tmp" contains export function called "ExecSecureObjectsRollback" at ordinal 5 "MSI6901.tmp" contains export function called "ExecServiceConfig" at ordinal 6 "MSI6901.tmp" contains export function called "ExecXmlConfig" at ordinal 7 "MSI6901.tmp" contains export function called "ExecXmlConfigRollback" at ordinal 8 "MSI6901.tmp" contains export function called "ExecXmlFile" at ordinal 9 "MSI6901.tmp" contains export function called "ExecXmlFileRollback" at ordinal 10 "MSI6901.tmp" contains export function called "RollbackServiceConfig" at ordinal 11 "MSI6901.tmp" contains export function called "SchedSecureObjects" at ordinal 1251:T1eac,"buffer for done generationtrace: non-empty full trace buffer for next generationgoroutine running on other thread; stack unavailablebytes.Buffer: reader returned negative count from Readinternal error: negative process handle reference countmheap.freeSpanLocked - invalid free of user arena chunkcasfrom_Gscanstatus:top gp->status is not in scan state is currently not supported for use in system callbacksSOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zonesstrings: illegal use of non-zero Builder copied by valuefailed to allocate aligned heap memory; too many retriesprofilealloc called without a P or outside bootstrappingdetected possible issues with cleanups and/or finalizersin gcMark expecting to see gcphase as _GCmarkterminationruntime: NtAssociateWaitCompletionPacket failed; errno= cannot run executable found relative to current directory (set GODEBUG=execwait=2 to capture stacks for debugging)runtime: checkmarks found unexpected unmarked object obj=crypto/drbg: internal error: request size exceeds max" in Source: e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin "SYSTEM\CurrentControlSet\Services\" in Source: e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin "SOFTWARE\Microsoft\Cryptography" in Source: e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" in Source: e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin "uSoftware\Policies\Microsoft\Windows\Installer" in Source: e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin "buffer for done generationtrace: non-empty full trace buffer for next generationgoroutine running on other thread; stack unavailablebytes.Buffer: reader returned negative count from Readinternal error: negative process handle reference countmheap.freeSpanLocked - invalid free of user arena chunkcasfrom_Gscanstatus:top gp->status is not in scan state is currently not supported for use in system callbacksSOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zonesstrings: illegal use of non-zero Builder copied by valuefailed to allocate aligned heap memory; too many retriesprofilealloc called without a P or outside bootstrappingdetected possible issues with cleanups and/or finalizersin gcMark expecting to see gcphase as _GCmarkterminationruntime: NtAssociateWaitCompletionPacket failed; errno= cannot run executable found relative to current directory (set GODEBUG=execwait=2 to capture stacks for debugging)runtime: checkmarks found unexpected unmarked object obj=crypto/drbg: internal error: request size exceeds ma" in Source: e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin "Software\Policies\Microsoft\Windows\Installer" in Source: e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin "ease install the .NET Framework then run this installer again.REMOVE OR NOT NEW_VERSIONInstallation cannot continue. There is a later version of this product installed. Please manually uninstall the existing version if you wish to install this version.#Default.cabARPPRODUCTICONARPNOREPAIRyesARPNOMODIFYALLUSERS1ManufacturerScreenConnect SoftwareProductCode{B292C5EA-BF5F-4280-B056-1670FB10BB1D}ProductLanguage1033ProductNameProductVersion{20AB6B9A-CF56-446C-A5AB-99B56F58BAFF}SecureCustomPropertiesARPNOMODIFY;ARPNOREPAIR;NETFRAMEWORK20;NETFRAMEWORK40CLIENT;NEW_VERSION;OLD_PRODUCT_1;OLD_PRODUCT_2;OLD_PRODUCT_3reg239C9CCDE4AB59853602A60F6F05D51B[URL_SCHEME]URL ProtocolregC511015E3F744DB5C5D9473BF2B6E27BUseOriginalUrlEncoding#1regED314AE69CE5D835D523FB365C82C36B[URL_SCHEME]\shell\open\command"[INSTALLLOCATION]ScreenConnect.WindowsClient.exe" "%1"reg3831C0C36D9CE44BC3E6FAE6F161BEA8System\CurrentControlSet\Control\SafeBoot\Network\[SERVICE_NAME]ServiceregB33BA5DF8D6A3B0A5B5032B6CB3E561BSYSTEM\CurrentControlSet\Contro" in Source: e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin "\LsaAuthentication Packages[~][#ScreenConnect.WindowsAuthenticationPackage.dll]reg86A6324C5FADB6CB634CB54F9A254136CLSID\[CREDENTIAL_PROVIDER_CLASS_ID][ProductName] Credential ProviderregA0D3A6DD84118D3DB3724140CDD67EB3CLSID\[CREDENTIAL_PROVIDER_CLASS_ID]\InprocServer32[#ScreenConnect.WindowsCredentialProvider.dll]regBE7B0E97E26F674069B85EA56F7ED91AThreadingModelApartmentreg6D36DB0A1418FE132B81E493007857D7-regCC3768849A0489209CB6D1FE238BF1F1Software\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\[CREDENTIAL_PROVIDER_CLASS_ID]reg685500C4A1A36BBDF1BB32EEE98CBEDESoftware\Microsoft\NET Framework Setup\NDP\v2.0.50727InstallSOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Client[SERVICE_NAME]restartnoneRemote Control"[SERVICE_CLIENT_LAUNCH_PARAMETERS]"{0C94448B-0C9E-4112-AC7D-B00E6BA76D82}0.0.0.0125.0.0.0OLD_PRODUCT_1{1F85D7FE-5576-41EE-9480-E3F7F9C31B8B}OLD_PRODUCT_2OLD_PRODUCT_3NEW_VERSION" in Source: e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin "bytes.Buffer: reader returned negative count from Readinternal error: negative process handle reference countmheap.freeSpanLocked - invalid free of user arena chunkcasfrom_Gscanstatus:top gp->status is not in scan state is currently not supported for use in system callbacksSOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zonesstrings: illegal use of non-zero Builder copied by valuefailed to allocate aligned heap memory; too many retriesprofilealloc called without a P or outside bootstrappingdetected possible issues with cleanups and/or finalizersin gcMark expecting to see gcphase as _GCmarkterminationruntime: NtAssociateWaitCompletionPacket failed; errno= cannot run executable found relative to current directory (set GODEBUG=execwait=2 to capture stacks for debugging)runtime: checkmarks found unexpected unmarked object obj=crypto/drbg: internal error: request size exceeds maximumGODEBUG=execwait=2 detected a leaked exec.Cmd created by:" in Source: 00000000-00000684.00000000.189801.6693D000.00000002.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004284.00000000.189912.035C0000.00000004.mdmp 00000000-00004284.00000001.190028.035C0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004284.00000000.189912.035C0000.00000004.mdmp 00000000-00004284.00000001.190028.035C0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00004284.00000000.189912.05800000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00004284.00000000.189912.05800000.00000004.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00004284.00000000.189912.71141000.00000020.mdmp "Software\Microsoft\RemovalTools\MRT" in Source: 00000000-00004284.00000000.189912.71141000.00000020.mdmp "HKLM\" in Source: 00000000-00004284.00000000.189912.71141000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00004284.00000000.189912.71141000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004284.00000000.189912.71141000.00000020.mdmp "STRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004284.00000001.190028.035C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004284.00000001.190028.035C0000.00000004.mdmp "stry\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00004284.00000001.190028.035C0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00004284.00000001.190028.035C0000.00000004.mdmp52:T60e,Process ScreenConnect.ClientSetup.exe3896969975 created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4284:168:WilStaging_02" Process ScreenConnect.ClientSetup.exe3896969975 created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4284:168:WilStaging_02" Process ScreenConnect.ClientSetup.exe3896969975 created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4284:64:WilError_01" Process ScreenConnect.ClientSetup.exe3896969975 created mutex with name "\BaseNamedObjects\SyncRootManager" Process ScreenConnect.ClientSetup.exe3896969975 created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4284:64:WilError_01" Process ScreenConnect.ClientSetup.exe3896969975 created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process ScreenConnect.ClientSetup.exe3896969975 created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process ScreenConnect.ClientSetup.exe3896969975 created mutex with name "Local\SM0:4284:64:WilError_01" Process ScreenConnect.ClientSetup.exe3896969975 created mutex with name "Local\SM0:4284:168:WilStaging_02" Process ScreenConnect.ClientSetup.exe3896969975 created mutex with name "SM0:4284:168:WilStaging_02" Process ScreenConnect.ClientSetup.exe3896969975 created mutex with name "Local\ZonesLockedCacheCounterMutex" Process ScreenConnect.ClientSetup.exe3896969975 created mutex with name "SM0:4284:64:WilError_01" Process ScreenConnect.ClientSetup.exe3896969975 created mutex with name "Local\ZonesCacheCounterMutex"53:T8bb,Antivirus vendors marked dropped file "2d648d.msi" as clean (type is "Composite Document File V2 Document Can't read SAT") Antivirus vendors marked dropped file "ScreenConnect.WindowsCredentialProvider.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"), Antivirus vendors marked dropped file "ScreenConnect.WindowsClient.exe" as clean (type is "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"), Antivirus vendors marked dropped file "ScreenConnect.WindowsAuthenticationPackage.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"), Antivirus vendors marked dropped file "ScreenConnect.Client.dll" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"), Antivirus vendors marked dropped file "Microsoft.Deployment.WindowsInstaller.dll" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"), Antivirus vendors marked dropped file "ScreenConnect.WindowsBackstageShell.exe" as clean (type is "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"), Antivirus vendors marked dropped file "Microsoft.Deployment.WindowsInstaller.Package.dll" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"), Antivirus vendors marked dropped file "Microsoft.Deployment.Compression.Cab.dll" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"), Antivirus vendors marked dropped file "Microsoft.Deployment.Compression.dll" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"), Antivirus vendors marked dropped file "ScreenConnect.InstallerActions.dll" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"), Antivirus vendors marked dropped file "MSI4F2E.tmp" as clean (type is "PE32 executable for MS Windows 5.01 (DLL) Intel i386 InstallShield self-extracting archive 5 sections"), Antivirus vendors marked dropped file "MSI6901.tmp" as clean (type is "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections")54:T8c0,"ScreenConnect.ClientSetup.exe3896969975" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "ScreenConnect.ClientSetup.exe3896969975" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "ScreenConnect.ClientSetup.exe3896969975" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "ScreenConnect.ClientSetup.exe3896969975" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "ScreenConnect.ClientSetup.exe3896969975" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "ScreenConnect.ClientSetup.exe3896969975" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "ScreenConnect.ClientSetup.exe3896969975" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "ScreenConnect.ClientSetup.exe3896969975" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "rundll32.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "rundll32.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "rundll32.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "rundll32.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "rundll32.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "rundll32.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135]55:T8de,"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "ScreenConnect.WindowsCredentialProvider.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "ScreenConnect.WindowsAuthenticationPackage.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "ScreenConnect.ClientService.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "ScreenConnect.WindowsFileManager.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "ScreenConnect.ClientService.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "Microsoft.Deployment.WindowsInstaller.Package.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "Microsoft.Deployment.Compression.Cab.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "Microsoft.Deployment.Compression.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "ScreenConnect.InstallerActions.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "MSI4F2E.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "MSI6901.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT56:Tce2,"bytes.Buffer: reader returned negative count from Readinternal error: negative process handle reference countmheap.freeSpanLocked - invalid free of user arena chunkcasfrom_Gscanstatus:top gp->status is not in scan state is currently not supported for use in system callbacksSOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zonesstrings: illegal use of non-zero Builder copied by valuefailed to allocate aligned heap memory; too many retriesprofilealloc called without a P or outside bootstrappingdetected possible issues with cleanups and/or finalizersin gcMark expecting to see gcphase as _GCmarkterminationruntime: NtAssociateWaitCompletionPacket failed; errno= cannot run executable found relative to current directory (set GODEBUG=execwait=2 to capture stacks for debugging)runtime: checkmarks found unexpected unmarked object obj=crypto/drbg: internal error: request size exceeds maximumGODEBUG=execwait=2 detected a leaked exec.Cmd created by:" in Source: 00000000-00000684.00000000.189801.6693D000.00000002.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004284.00000000.189912.035C0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004284.00000000.189912.035C0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00004284.00000000.189912.05800000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00004284.00000000.189912.05800000.00000004.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00004284.00000000.189912.71141000.00000020.mdmp "Software\Microsoft\RemovalTools\MRT" in Source: 00000000-00004284.00000000.189912.71141000.00000020.mdmp "HKLM\" in Source: 00000000-00004284.00000000.189912.71141000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00004284.00000000.189912.71141000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004284.00000000.189912.71141000.00000020.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004284.00000001.190028.035C0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004284.00000001.190028.035C0000.00000004.mdmp "STRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004284.00000001.190028.035C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004284.00000001.190028.035C0000.00000004.mdmp "stry\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00004284.00000001.190028.035C0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00004284.00000001.190028.035C0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00007320.00000000.190378.02E60000.00000004.mdmp57:T2cde,"g__CreateAndConnectNamedPipe|97_0" (Indicator: "ConnectNamedPipe"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "g__WaitAndConnectNamedPipe|97_1" (Indicator: "ConnectNamedPipe"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "CreateNamedPipe" (Indicator: "CreateNamedPipe"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "ConnectNamedPipe" (Indicator: "ConnectNamedPipe"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "CreateNamedPipeW" (Indicator: "CreateNamedPipe"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "CreatePipe"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") file/memory contains long string with (Indicator: "CreateNamedPipe"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") file/memory contains long string with (Indicator: "ConnectNamedPipe"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") file/memory contains long string with (Indicator: "GetNamedPipe"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") Found reference to API "syscall.CreatePipe" (Indicator: "CreatePipe"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp")69:Td51,file/memory contains long string with (Indicator: "wsastartup"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "wsacleanup"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "gethostbyname"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: " send "; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: " socket "; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "Failed to bind to the CLR. Error code 0x%X" (Indicator: " bind "; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: " send "; File: "Client.en-US.resources") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00000684-00000C2C-1937821313") Found reference to API "syscall.WSAStartup" (Indicator: "wsastartup"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "App: %ls found running, %d processes, attempting to send message." (Indicator: " send "; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "failed to send progress message" (Indicator: " send "; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "failed to get message to send to users when server reboots due to service failure." (Indicator: " send "; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "wsastartup"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") file/memory contains long string with (Indicator: "wsacleanup"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") file/memory contains long string with (Indicator: "gethostbyname"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") file/memory contains long string with (Indicator: " send "; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") file/memory contains long string with (Indicator: " socket "; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") Found reference to API "syscall.WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00004284.00000000.189912.035C0000.00000004.mdmp, 00000000-00004284.00000001.190028.035C0000.00000004.mdmp") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00004284.00000000.189912.035C0000.00000004.mdmp, 00000000-00004284.00000001.190028.035C0000.00000004.mdmp") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; Source: "00000000-00004284.00000000.189912.71141000.00000020.mdmp") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00004284.00000000.189912.71141000.00000020.mdmp")6a:T1ed4,Heuristic match: "*abi.name" Heuristic match: "*godebugs.info" Pattern match: "golang.org/x/sys/windows" Pattern match: "golang.org/x/net/dns/dnsmessage" Pattern match: "https://go.dev/issue/66821" Pattern match: "depgolang.org/x/sysv0.21.0h1:rf+pyz3dagsqaxau1cbc7catzg4ebc4uieihkxbzvws=build-buildmode=exebuild-compiler=gcbuild-ldflags=-s" Heuristic match: "internal/abi.name.name" Heuristic match: "type:.eq.internal/godebugs.info" Heuristic match: "runtime.(*bucket).mp" Heuristic match: "runtime.(*polldesc).info" Heuristic match: "runtime.srcfunc.name" Pattern match: "https://feedback.screenconnect.com/feedback.axd" Pattern match: "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c" Heuristic match: "errors.is" Pattern match: "eq.sync/atomic.bool" Pattern match: "eq.sync/atomic.int32" Pattern match: "eq.sync/atomic.uint32" Pattern match: "eq.sync/atomic.uint64" Heuristic match: "sync.(*once).do" Pattern match: "eq.sync/atomic.pointer[sync.poolchainelt" Pattern match: "eq.sync/atomic.pointer[internal/sync.indirect[interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.entry[interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.node[interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.entry[go.shape.interface" Pattern match: "eq.sync/atomic.pointer[go.shape.struct" Pattern match: "eq.sync/atomic.pointer[internal/bisect.dedup" Heuristic match: "internal/godebug.(*setting).name" Pattern match: "eq.sync/atomic.pointer[internal/godebug.value" Heuristic match: "syscall.errno.is" Heuristic match: "syscall.(*errno).is" Pattern match: "eq.io/fs.patherror" Pattern match: "eq.sync/atomic.pointer[os.dirinfo" Heuristic match: "unicode.to" Pattern match: "eq.os/exec.error" Pattern match: "eq.os/exec.wrappederror" Pattern match: "eq.os/exec.ctxresult" Pattern match: "eq.sync/atomic.pointer[internal/sync.indirect[*internal/abi.type,interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.entry[*internal/abi.type,interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.node[*internal/abi.type,interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.entry[go.shape.*internal/abi.type,go.shape.interface" Pattern match: "eq.net/netip.addrdetail" Pattern match: "eq.sync/atomic.pointer[unique.node[net/netip.addrdetail" Pattern match: "eq.sync/atomic.pointer[unique.entry[net/netip.addrdetail" Pattern match: "eq.sync/atomic.pointer[unique.indirect[net/netip.addrdetail" Pattern match: "hash.net/netip.addrdetail" Pattern match: "eq.sync/atomic.pointer[unique.entry[go.shape.struct" Pattern match: "golang.org/x/net/dns/dnsmessage.init" Pattern match: "golang.org/x/sys/windows.init" Pattern match: "golang.org/x/sys/windows.(*dllerror).error" Pattern match: "golang.org/x/sys/windows.(*dllerror).unwrap" Pattern match: "golang.org/x/sys/windows.loaddll" Pattern match: "golang.org/x/sys/windows.(*dll).findproc" Pattern match: "golang.org/x/sys/windows.byteptrfromstring" Pattern match: "golang.org/x/sys/windows.(*lazydll).load" Pattern match: "golang.org/x/sys/windows.(*lazydll).load.deferwrap1" Pattern match: "golang.org/x/sys/windows.(*lazyproc).find" Pattern match: "golang.org/x/sys/windows.(*lazyproc).find.deferwrap1" Pattern match: "golang.org/x/sys/windows.initcandosearchsystem32" Pattern match: "golang.org/x/sys/windows.(*lazydll).newproc" Pattern match: "golang.org/x/sys/windows.loadlibraryex" Pattern match: "golang.org/x/sys/windows.candosearchsystem32" Pattern match: "golang.org/x/sys/windows.isbasename" Pattern match: "golang.org/x/sys/windows.getsystemdirectory" Pattern match: "golang.org/x/sys/windows.utf16tostring" Pattern match: "golang.org/x/sys/windows.byteslicefromstring" Pattern match: "golang.org/x/sys/windows.utf16ptrfromstring" Pattern match: "golang.org/x/sys/windows.utf16fromstring" Pattern match: "golang.org/x/sys/windows.getstdhandle" Pattern match: "golang.org/x/sys/windows.(*lazyproc).addr" Pattern match: "golang.org/x/sys/windows.(*lazyproc).mustfind" Pattern match: "golang.org/x/sys/windows.(*proc).addr" Pattern match: "golang.org/x/sys/windows.errnoerr" Pattern match: "golang.org/x/sys/windows._loadlibraryex" Pattern match: "eq.golang.org/x/sys/windows.dllerror" Pattern match: "eq.golang.org/x/sys/windows.dll" Pattern match: "eq.golang.org/x/sys/windows.proc" Pattern match: "eq.golang.org/x/sys/windows.lazydll" Pattern match: "eq.golang.org/x/sys/windows.lazyproc" Pattern match: "golang.org/x/sys/windows/registry.init" Heuristic match: "os.(*file).name" Pattern match: "golang.org/x/net/dns/dnsmessage/message.go" Pattern match: "golang.org/x/sys@v0.21.0/windows/syscall_windows.go" Pattern match: "golang.org/x/sys@v0.21.0/windows/zsyscall_windows.go" Pattern match: "golang.org/x/sys@v0.21.0/windows/dll_windows.go" Pattern match: "golang.org/x/sys@v0.21.0/windows/syscall.go" Pattern match: "golang.org/x/sys@v0.21.0/windows/security_windows.go" Pattern match: "golang.org/x/sys@v0.21.0/windows/registry/zsyscall_windows.go" Heuristic match: "+*.sv" Pattern match: "eedback.screenconnect.com/feedback.axd" Pattern match: "feedback.screenconnect.com/feedback.axd" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Pattern match: "golang.org/x/sys" Pattern match: "eq.os/exec.goroutinestatus" Pattern match: "microsoft.net/framework/v4.0.30319/" Heuristic match: "icrosoft.visualstudio.tools.office.runtime.int" Pattern match: "https://wdcp.microsoft.com/wdcp.svc/submitreport" Pattern match: "go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&" Heuristic match: "screenconnect.clientsetup.exe3896969975.co" Pattern match: "microsoft.net/assembly/gac_32/mscorlib/v4.0_4.0.0.0__b77a5c561934e089/mscorlib.dll" Pattern match: "www.digicert.com1!0" Pattern match: "http://ocsp.digicert.com0a" Pattern match: "cacerts.digicert.com/digicerttrustedrootg4.crt0c" Pattern match: "crl3.digicert.com/digicerttrustedrootg4.crl0" Pattern match: "crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0s" Pattern match: "crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0" Pattern match: "http://www.digicert.com/cps0" Pattern match: "http://ocsp.digicert.com0\" Pattern match: "cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" Pattern match: "www.digicert.com" Pattern match: "cacerts.digicert.com/digicerttrustedrootg4.crt" Pattern match: "crl3.digicert.com/digicerttrustedrootg4.crl" Pattern match: "crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl" Pattern match: "http://www.digicert.com/cps" Pattern match: "cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt" Pattern match: "crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0" Pattern match: "http://ocsp.digicert.com0x" Pattern match: "cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0" Pattern match: "www.digicert.com1$0" Pattern match: "http://ocsp.digicert.com0c" Pattern match: "cacerts.digicert.com/digicertassuredidrootca.crt0e" Pattern match: "crl3.digicert.com/digicertassuredidrootca.crl0" Pattern match: "cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt" Pattern match: "crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl" Pattern match: "cacerts.digicert.com/digicertassuredidrootca.crt" Pattern match: "crl3.digicert.com/digicertassuredidrootca.crl" Pattern match: "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=" Pattern match: "https://go.microsoft.com/fwlink/?linkid=74408&enterprise=" Pattern match: "https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%d" Pattern match: "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&" Heuristic match: "fr.mv" Heuristic match: ".#[.ma" Heuristic match: "ebw.fm"6b:T279e,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00000684.00000000.189801.20EA0000.00000004.mdmp") Found URL "https://go.dev/issue/66821):" - Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004284.00000000.189912.035C0000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportoftware\policies\microsoft\windows" - Source: "00000000-00004284.00000000.189912.056F0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00004284.00000000.189912.05800000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0>705030)0'http://www.digicert.com/cps0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0uz" - Source: "00000000-00004284.00000000.189912.05800000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0x!3qx!3qx!3qx!3qx!3qx!3qx!3qx!3q" - Source: "00000000-00004284.00000000.189912.05800000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0x!3qx!3quq]dlk0i0$http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0x!3qx!3qx!3qx!3qx!3qx!3qx!3qx!3qx!3qx!3qx!3qq]dlx!3qx!3qx!3qq]dlx!3qx!3qx!3qx!3qx!3qx!3qx!3qx!3qx!3qx!3qwk0i0$http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crtx!3qx!3qx!3qk0i0$http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crtx!3qc<0:082http://crl3.digicert.com/digicerttrustedrootg4.crlx!3qx!3qx!3q<0:082http://crl3.digicert.com/digicerttrustedrootg4.crlx!3qx!3qx!3qx!3qx!3qx!3qx!3q" - Source: "00000000-00004284.00000000.189912.05800000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0>705030)0'http://www.digicert.com/cps0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0x!3qx!3qx!3qx!3qx!3qx!3qx!3qx!3q" - Source: "00000000-00004284.00000000.189912.05800000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0>705030)0'http://www.digicert.com/cps0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0x!3qx!3qmhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0>705030)0'http://www.digicert.com/cps0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0x!3qx!3qx!3qx!3qx!3qx!3qx!3qx!3qx!3qx!3qx!3qx!3qx!3qx!3qx!3qx!3qx!3qx!3qx!3qmhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crlx!3qx!3qx!3qmhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crlx!3q>705030)0'http://www.digicert.com/cpsx!3qx!3qx!3q705030)0'http://www.digicert.com/cpsx!3qhttp://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crtx!3qx!3qx!3qhttp://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crtx!3qx!3qx!3qx!3qx!3qx!3qx!3qx!3q" - Source: "00000000-00004284.00000000.189912.05800000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0mm*v;z" - Source: "00000000-00004284.00000000.189912.05800000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00004284.00000000.189912.05800000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00004284.00000000.189912.05800000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crtx!3qx!3qx!3qx!3qx!3qx!3qx!3qx!3q" - Source: "00000000-00004284.00000000.189912.05800000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crtx!3qx!3q/s)vs0q0oihttp://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crtx!3qx!3qx!3qx!3qx!3qx!3qx!3qx!3qx!3qx!3qx!3qx!3qx!3qx!3qx!3qx!3qx!3q" - Source: "00000000-00004284.00000000.189912.05800000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crlx!3qx!3qx!3qs0q0oihttp://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crlx!3qhttp://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crtx!3qx!3qx!3qhttp://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crtx!3qx!3qx!3q" - Source: "00000000-00004284.00000000.189912.05800000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crtx!3qx!3qx!3qk0i0$http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crtx!3qc<0:082http://crl3.digicert.com/digicerttrustedrootg4.crlx!3qx!3qx!3q<0:082http://crl3.digicert.com/digicerttrustedrootg4.crlx!3q" - Source: "00000000-00004284.00000000.189912.05800000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0x!3qx!3qx!3qx!3qx!3qx!3qx!3qx!3q" - Source: "00000000-00004284.00000000.189912.05800000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0x!3qx!3q6q]dlm0k0$http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0x!3qx!3qx!3qx!3qx!3qx!3qx!3qq]dlx!3qx!3qx!3qq]dlx!3qx!3qx!3qx!3qx!3qx!3qx!3qx!3qx!3qx!3qym0k0$http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crtx!3qx!3qx!3qm0k0$http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crtx!3qe>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crlx!3qx!3qx!3q>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crlx!3qx!3qx!3qx!3qx!3qx!3qx!3q" - Source: "00000000-00004284.00000000.189912.05800000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00004284.00000000.189912.71141000.00000020.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00004284.00000000.189912.71141000.00000020.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllpconfigut-53e7e780-2330-40c6-94c6-be75e946e933software\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00004284.00000000.189912.71141000.00000020.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004284.00000001.190028.035C0000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportoftware\policies\microsoft\windows" - Source: "00000000-00004284.00000001.190028.056F0000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00004284.00000001.190028.71221000.00000020.mdmp")6c:T5b9,YARA signature for RSA public and private key matched on file "Microsoft.Deployment.Compression.Cab.dll" YARA signature for RSA public and private key matched on file "ScreenConnect.ClientService.dll" YARA signature for RSA public and private key matched on file "ScreenConnect.WindowsClient.exe" YARA signature for RSA public and private key matched on process "00000000-00004284" YARA signature for RSA public and private key matched on file "Microsoft.Deployment.WindowsInstaller.Package.dll" YARA signature for RSA public and private key matched on file "Microsoft.Deployment.Compression.dll" YARA signature for RSA public and private key matched on file "sample.bin" YARA signature for RSA public and private key matched on file "ScreenConnect.Client.dll" YARA signature for RSA public and private key matched on file "ScreenConnect.WindowsFileManager.exe" YARA signature for RSA public and private key matched on file "ScreenConnect.InstallerActions.dll" YARA signature for RSA public and private key matched on file "ScreenConnect.ClientSetup.exe3896969975" YARA signature for RSA public and private key matched on file "ScreenConnect.Core.dll" YARA signature for RSA public and private key matched on file "Microsoft.Deployment.WindowsInstaller.dll" YARA signature for RSA public and private key matched on file "ScreenConnect.Windows.dll" YARA signature for RSA public and private key matched on file "ScreenConnect.WindowsBackstageShell.exe"6d:Te1c,file/memory contains long string with (Indicator: "GetDesktopWindow"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "b__0" (Indicator: "GetDesktopWindow"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "b__1" (Indicator: "GetDesktopWindow"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "CreateDC" (Indicator: "CreateDC"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "GetDC" (Indicator: "GetDC"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "GetDesktopWindowHandles" (Indicator: "GetDesktopWindow"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "GetDesktopWindow"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004284.00000000.189912.035C0000.00000004.mdmp, 00000000-00004284.00000001.190028.035C0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004284.00000000.189912.035C0000.00000004.mdmp, 00000000-00004284.00000001.190028.035C0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00004284.00000000.189912.035C0000.00000004.mdmp, 00000000-00004284.00000001.190028.035C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004284.00000000.189912.035C0000.00000004.mdmp, 00000000-00004284.00000001.190028.035C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004284.00000000.189912.035C0000.00000004.mdmp, 00000000-00004284.00000001.190028.035C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004284.00000000.189912.035C0000.00000004.mdmp, 00000000-00004284.00000001.190028.035C0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00004284.00000000.189912.035C0000.00000004.mdmp, 00000000-00004284.00000001.190028.035C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004284.00000000.189912.035C0000.00000004.mdmp, 00000000-00004284.00000001.190028.035C0000.00000004.mdmp")6e:Tc55,file/memory contains long string with (Indicator: "RtlGetVersion"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "RtlGetNtVersionNumbers"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "3957685494,7700,3024,,RtlGetVersion,NTDLL.dll,"00:49:22.375",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00000684.00000000.189801.20EA0000.00000004.mdmp, 00000000-00000684.00000001.190047.20EA0000.00000004.mdmp") file/memory contains long string with (Indicator: "RtlGetVersion"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") Found reference to API "RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp, 00000000-00004284.00000001.190028.08110000.00000004.mdmp, 00000000-00004284.00000001.190028.71235000.00000002.mdmp") Found reference to API "14872736962,5768,3025,,RtlGetNtProductType,NTDLL.dll,"00:49:28.765",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00004284.00000001.190028.035C0000.00000004.mdmp") Found reference to API "14871159572,5768,3024,,RtlGetVersion,NTDLL.dll,"00:49:28.765",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00004284.00000001.190028.035C0000.00000004.mdmp") Found reference to API "14436712706,5768,3024,,RtlGetVersion,NTDLL.dll,"00:49:28.578",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00004284.00000001.190028.035C0000.00000004.mdmp") Found reference to API "14316826050,5768,3025,,RtlGetNtProductType,NTDLL.dll,"00:49:28.531",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00004284.00000001.190028.035C0000.00000004.mdmp") Found reference to API "14674344156,5768,3025,,RtlGetNtProductType,NTDLL.dll,"00:49:28.671",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00004284.00000001.190028.035C0000.00000004.mdmp") Found reference to API "14305840570,5768,3025,,RtlGetNtProductType,NTDLL.dll,"00:49:28.515",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00004284.00000001.190028.035C0000.00000004.mdmp") Found reference to API "14429361936,5768,3024,,RtlGetVersion,NTDLL.dll,"00:49:28.578",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00004284.00000001.190028.035C0000.00000004.mdmp") Found reference to API "14434722692,5768,3025,,RtlGetNtProductType,NTDLL.dll,"00:49:28.578",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00004284.00000001.190028.035C0000.00000004.mdmp") Found reference to API "14327832350,5768,3025,,RtlGetNtProductType,NTDLL.dll,"00:49:28.531",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00004284.00000001.190028.035C0000.00000004.mdmp") Found reference to API "14872799978,5768,3024,,RtlGetVersion,NTDLL.dll,"00:49:28.765",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00004284.00000001.190028.035C0000.00000004.mdmp") Found reference to API "14674469898,5768,3024,,RtlGetVersion,NTDLL.dll,"00:49:28.671",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00004284.00000001.190028.035C0000.00000004.mdmp")6f:T9ed,Found registry query API: "RegOpenKey (in long string)" in file "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin" Found registry query API: "RegQueryValue (in long string)" in file "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin" Found registry query API: "RegNotifyChangeKeyValue (in long string)" in file "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin" Found registry query API: "syscall.RegOpenKeyEx" in file "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin" Found registry query API: "syscall.RegQueryValueEx" in file "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin" Found registry query API: "syscall.RegEnumKeyEx" in file "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin" Found registry query API: "RegQueryValueEx" in file "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin" Found registry query API: "<11>__RegOpenKeyEx" in file "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin" Found registry query API: "RegOpenKeyW" in file "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin" Found registry query API: "RegOpenKey (in long string)" in "00000000-00000684.00000000.189801.6693D000.00000002.mdmp" Found registry query API: "RegQueryValue (in long string)" in "00000000-00000684.00000000.189801.6693D000.00000002.mdmp" Found registry query API: "RegNotifyChangeKeyValue (in long string)" in "00000000-00000684.00000000.189801.6693D000.00000002.mdmp" Found registry query API: "syscall.RegOpenKeyEx" in "00000000-00000684.00000000.189801.6693D000.00000002.mdmp" Found registry query API: "syscall.RegQueryValueEx" in "00000000-00000684.00000000.189801.6693D000.00000002.mdmp" Found registry query API: "syscall.RegEnumKeyEx" in "00000000-00000684.00000000.189801.6693D000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00004284.00000000.189912.711D1000.00000002.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00004284.00000000.189912.711D1000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00004284.00000000.189912.711D1000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00004284.00000000.189912.711D1000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00004284.00000000.189912.711D1000.00000002.mdmp" Found registry query API: "RegNotifyChangeKeyValue" in "00000000-00004284.00000000.189912.711D1000.00000002.mdmp"70:Tbf4,"ScreenConnect.ClientSetup.exe3896969975" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00004284) "ScreenConnect.ClientSetup.exe3896969975" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00004284) "ScreenConnect.ClientSetup.exe3896969975" called "FindNextFileW" with parameter .. (UID: 00000000-00004284) "ScreenConnect.ClientSetup.exe3896969975" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00004284) "ScreenConnect.ClientSetup.exe3896969975" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00004284) "ScreenConnect.ClientSetup.exe3896969975" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00004284) "ScreenConnect.ClientSetup.exe3896969975" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00004284) "ScreenConnect.ClientSetup.exe3896969975" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00004284) "ScreenConnect.ClientSetup.exe3896969975" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00004284) "ScreenConnect.ClientSetup.exe3896969975" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00004284) "ScreenConnect.ClientSetup.exe3896969975" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00004284) "ScreenConnect.ClientSetup.exe3896969975" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00004284) "ScreenConnect.ClientSetup.exe3896969975" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00004284) "ScreenConnect.ClientSetup.exe3896969975" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00004284) "ScreenConnect.ClientSetup.exe3896969975" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00004284) "ScreenConnect.ClientSetup.exe3896969975" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00004284) "ScreenConnect.ClientSetup.exe3896969975" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00004284) "ScreenConnect.ClientSetup.exe3896969975" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00004284) "ScreenConnect.ClientSetup.exe3896969975" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00004284) "ScreenConnect.ClientSetup.exe3896969975" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00004284) "ScreenConnect.ClientSetup.exe3896969975" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00004284) "ScreenConnect.ClientSetup.exe3896969975" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00004284) "ScreenConnect.ClientSetup.exe3896969975" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00004284) "ScreenConnect.ClientSetup.exe3896969975" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00004284)71:Te9e,Found string "chacha8" (Indicator: "chacha"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found string "*aes.CTR" (Indicator: "aes"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found string "*aes.Block" (Indicator: "aes"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found string "*aes.block" (Indicator: "aes"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found string "*aes.KeySizeError" (Indicator: "aes"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found string "*chacha8rand.State" (Indicator: "chacha"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found string "*aes.blockExpanded" (Indicator: "aes"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found string "internal/chacha8rand" (Indicator: "chacha"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found string "crypto/internal/fips140/aes" (Indicator: "aes"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "aes"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "3des"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found string "internal/chacha8rand.(*State).Init" (Indicator: "chacha"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found string "internal/chacha8rand.(*State).Init64" (Indicator: "chacha"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found string "internal/chacha8rand.(*State).Refill" (Indicator: "chacha"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found string "internal/chacha8rand.(*State).Reseed" (Indicator: "chacha"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found string "internal/chacha8rand.(*State).Next" (Indicator: "chacha"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found string "internal/chacha8rand.block" (Indicator: "chacha"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found string "type:.eq.internal/chacha8rand.State" (Indicator: "chacha"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found string "runtime.initAlgAES" (Indicator: "aes"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "base64"; File: "ScreenConnect.ClientService.dll") file/memory contains long string with (Indicator: "ToBase64String"; File: "ScreenConnect.ClientService.dll") Found string "aeshashbody" (Indicator: "aes"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found string "crypto/internal/fips140/aes.init" (Indicator: "aes"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found string "crypto/internal/fips140/aes.KeySizeError.Error" (Indicator: "aes"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found string "crypto/internal/fips140/aes.newOutlined" (Indicator: "aes"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found string "crypto/internal/fips140/aes.newOutlined" (Indicator: "aes.new"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found string "crypto/internal/fips140/aes.(*Block).BlockSize" (Indicator: "aes"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin")72:T8da,file/memory contains long string with (Indicator: "FindFirstFile"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "FindNextFile"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "syscall.FindFirstFile" (Indicator: "FindFirstFile"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "FindFirstFileExA" (Indicator: "FindFirstFile"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "FindFirstFile"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") file/memory contains long string with (Indicator: "FindNextFile"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") Found reference to API "syscall.FindFirstFile" (Indicator: "FindFirstFile"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp, 00000000-00004284.00000001.190028.06800000.00000004.mdmp, 00000000-00004284.00000001.190028.08110000.00000004.mdmp") Found reference to API "FindFirstFileExA" (Indicator: "FindFirstFile"; Source: "00000000-00004284.00000001.190028.00EDD000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00004284.00000001.190028.00EDD000.00000002.mdmp")73:T10e9,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "Module32Next"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "Thread32Next"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "Process32Next"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "EnumProcesses"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "Thread32First"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "Process32First"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "GetCurrentProcess"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "EnumProcessModules"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "GetEnvironmentStrings"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "CreateToolhelp32Snapshot"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "QueryInformationProcess"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "syscall.GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "syscall.GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "GetCurrentProcessMainModuleFileName" (Indicator: "GetCurrentProcess"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "GetCurrentProcessSessionID" (Indicator: "GetCurrentProcess"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "GetCurrentProcessTokenInformation" (Indicator: "GetCurrentProcess"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "EnumProcesses" (Indicator: "EnumProcesses"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin")74:T806,file/memory contains long string with (Indicator: "GetModuleHandle"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "GetModuleHandleExA" (Indicator: "GetModuleHandle"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "GetModuleHandle"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; Source: "00000000-00004284.00000000.189912.056C0000.00000004.mdmp, 00000000-00004284.00000000.189912.05800000.00000004.mdmp, 00000000-00004284.00000001.190028.08110000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp, 00000000-00004284.00000001.190028.00EDD000.00000002.mdmp, 00000000-00004284.00000001.190028.06800000.00000004.mdmp, 00000000-00004284.00000001.190028.08110000.00000004.mdmp, 00000000-00004284.00000001.190028.71235000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp, 00000000-00004284.00000001.190028.00EDD000.00000002.mdmp, 00000000-00004284.00000001.190028.06800000.00000004.mdmp, 00000000-00004284.00000001.190028.08110000.00000004.mdmp, 00000000-00004284.00000001.190028.71235000.00000002.mdmp")75:T11f2,Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "GetTempPath"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "GetFileAttributes"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "GetSystemDirectory"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "GetCurrentDirectory"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "GetFileVersionInfo"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "ReadDirectoryChange"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "GetFileVersionInfoSize"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "GetFileInformationByHandle"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "internal/syscall/windows.GetSystemDirectory" (Indicator: "GetSystemDirectory"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "syscall.GetCurrentDirectory" (Indicator: "GetCurrentDirectory"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "syscall.GetFileAttributesEx" (Indicator: "GetFileAttributes"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "syscall.GetFileAttributes" (Indicator: "GetFileAttributes"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "syscall.GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "syscall.GetTempPath" (Indicator: "GetTempPath"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "internal/syscall/windows.GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "internal/syscall/windows.GetTempPath2" (Indicator: "GetTempPath"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "internal/syscall/windows.NtQueryInformationFile" (Indicator: "QueryInformationFile"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "internal/syscall/windows.ErrorLoadingGetTempPath2" (Indicator: "GetTempPath"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "os.newFileStatFromGetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "golang.org/x/sys/windows.GetSystemDirectory" (Indicator: "GetSystemDirectory"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "GetTempPath2" (Indicator: "GetTempPath"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "GetTempPath" (Indicator: "GetTempPath"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin")76:T536,file/memory contains long string with (Indicator: "GetModuleFileName"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "internal/syscall/windows.GetModuleFileName" (Indicator: "GetModuleFileName"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "internal/syscall/windows.GetModuleFileName" (Indicator: "GetModuleFileName"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp, 00000000-00004284.00000001.190028.06800000.00000004.mdmp, 00000000-00004284.00000001.190028.08110000.00000004.mdmp, 00000000-00004284.00000001.190028.71235000.00000002.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00004284.00000001.190028.00EDD000.00000002.mdmp, 00000000-00004284.00000001.190028.08110000.00000004.mdmp")77:T10ba,file/memory contains long string with (Indicator: "NetUserEnum"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "GetUserName"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "NetUserGetInfo"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "LookupAccountSid"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "LookupAccountName"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "WTSQueryUserToken"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "NetGetJoinInformation"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "NtQuerySystemInformation"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "NtQueryInformationProcess"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "LsaGetLogonSessionData" (Indicator: "LsaGetLogonSessionData"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "NetUserEnum" (Indicator: "NetUserEnum"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "WTSQueryUserToken" (Indicator: "WTSQueryUserToken"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "<1>__OpenProcessToken" (Indicator: "OpenProcessToken"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "NetGetJoinInformation" (Indicator: "NetGetJoinInformation"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "WTSQuerySessionInformation" (Indicator: "WTSQuerySessionInformation"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "GetUserObjectInformation" (Indicator: "GetUserObjectInformation"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "NetUserGetInfo" (Indicator: "NetUserGetInfo"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "LookupAccountNameW" (Indicator: "LookupAccountName"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "GetUserName"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") file/memory contains long string with (Indicator: "NetUserGetInfo"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") file/memory contains long string with (Indicator: "LookupAccountSid"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp")78:T539,Found string "password" (Indicator: "password"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found string "secretBytes" (Indicator: "secret"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found string "secretKey" (Indicator: "secret"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found string "usri4_password_expired" (Indicator: "password"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found string "usri1_password" (Indicator: "password"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found string "usri1003_password" (Indicator: "password"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found string "usri4_password" (Indicator: "password"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found string "usri1_password_age" (Indicator: "password"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found string "usri4_password_age" (Indicator: "password"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "password"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin")79:T42a,Found string "SELECT ProcessId, ParentProcessId FROM Win32_Process" (Indicator: " Win32_Process"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found string "SELECT * FROM Win32_GroupUser WHERE GroupComponent="Win32_Group.Domain='" (Indicator: " Win32_Group"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin"), Found string "SELECT * FROM Win32_GroupUser WHERE GroupComponent="Win32_Group.Domain='" (Indicator: " Win32_GroupUser"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin"), Found string "SELECT * FROM Win32_UserAccount WHERE Name='" (Indicator: " Win32_UserAccount"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin"), Found string "d, ParentProcessId FROM Win32_Process" (Indicator: " Win32_Process"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin"), Found string "OM Win32_UserAccount WHERE Name='" (Indicator: " Win32_UserAccount"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin")7a:T50c,file/memory contains long string with (Indicator: "OpenProcess"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "OpenProcess"; File: "ScreenConnect.ClientService.dll") Found string "<1>__OpenProcessToken" (Indicator: "OpenProcess"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found string "OpenProcess" (Indicator: "OpenProcess"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00004284-00000C2C-1939612019") Found string "OpenProcessTokenW" (Indicator: "OpenProcess"; Source: "00000000-00004284-00000C2C-1943384059") Found string "OpenProcessW" (Indicator: "OpenProcess"; Source: "00000000-00004284-00000C2C-1943384610") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp, 00000000-00004284.00000001.190028.08110000.00000004.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp")7b:T700,file/memory contains long string with (Indicator: "DeleteFile"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "RemoveDirectory"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "syscall.DeleteFile" (Indicator: "DeleteFile"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "syscall.RemoveDirectory" (Indicator: "RemoveDirectory"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "DeleteFileTransacted" (Indicator: "DeleteFile"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "DeleteFile" (Indicator: "DeleteFile"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "RemoveDirectory"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") Found reference to API "syscall.DeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") Found reference to API "syscall.RemoveDirectory" (Indicator: "RemoveDirectory"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") Found reference to API "20974052430,7700,3137,,RemoveDirectoryW,kernel32.dll,"00:49:29.468",RX=0,PX=0" (Indicator: "RemoveDirectory"; Source: "00000000-00000684.00000001.190047.20EA0000.00000004.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp")7c:T723,file/memory contains long string with (Indicator: "CheckTokenMembership"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "LookupPrivilegeValue"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "LookupPrivilegeValue" (Indicator: "LookupPrivilegeValue"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00004284.00000000.189912.035C0000.00000004.mdmp, 00000000-00004284.00000000.189912.05800000.00000004.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp, 00000000-00004284.00000001.190028.08110000.00000004.mdmp")7d:T6ee,file/memory contains long string with (Indicator: "SetFileAttributes"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "SetInformationFile"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "NtSetInformationFile"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "syscall.SetFileAttributes" (Indicator: "SetFileAttributes"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "internal/syscall/windows.NtSetInformationFile" (Indicator: "SetInformationFile"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "internal/syscall/windows.NtSetInformationFile" (Indicator: "NtSetInformationFile"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "SetFileAttributes"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") Found reference to API "syscall.SetFileAttributes" (Indicator: "SetFileAttributes"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") Found reference to API "internal/syscall/windows.NtSetInformationFile" (Indicator: "SetInformationFile"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") Found reference to API "internal/syscall/windows.NtSetInformationFile" (Indicator: "NtSetInformationFile"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp")7e:T1a5a,file/memory contains long string with (Indicator: "CopySid"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "FreeSid"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "EqualSid"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "IsValidSid"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "GetLengthSid"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "RevertToSelf"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "ImpersonateSelf"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "IsWellKnownSid"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "MakeAbsoluteSD"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "DuplicateToken"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "DuplicateTokenEx"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "SetEntriesInAcl"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "AdjustTokenGroups"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "GetSidSubAuthority"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "IsTokenRestricted"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "CreateWellKnownSid"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "MakeSelfRelativeSD"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "SetTokenInformation"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "GetSidSubAuthorityCount"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "ImpersonateLoggedOnUser"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "SetKernelObjectSecurity"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "AllocateAndInitializeSid"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "GetSidIdentifierAuthority"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "InitializeSid"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "GetSecurityDescriptorDacl"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "GetSecurityDescriptorSacl"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "SetSecurityDescriptorDacl"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "SetSecurityDescriptorSacl"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "GetSecurityDescriptorGroup"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "GetSecurityDescriptorOwner"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "SetSecurityDescriptorGroup"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "SetSecurityDescriptorOwner"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "GetSecurityDescriptorLength"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "GetSecurityDescriptorControl"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "InitializeSecurityDescriptor"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "SetSecurityDescriptorControl"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "GetSecurityDescriptorRMControl"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "SetSecurityDescriptorRMControl"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "b__8_0" (Indicator: "ImpersonateLoggedOnUser"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "CreateWellKnownSid" (Indicator: "CreateWellKnownSid"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "DuplicateToken" (Indicator: "DuplicateToken"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin")7f:Tb99,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "ExitProcess"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "TerminateProcess"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.TerminateProcesses" (Indicator: "TerminateProcess"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "syscall.TerminateProcess" (Indicator: "TerminateProcess"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "b__161_0" (Indicator: "TerminateProcess"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "TryTerminateProcess" (Indicator: "TerminateProcess"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "InstallerActions!ScreenConnect.ClientInstallerActions.TerminateProcesses" (Indicator: "TerminateProcess"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") Found reference to API "TerminateProcesses" (Indicator: "TerminateProcess"; File: "e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin") file/memory contains long string with (Indicator: "TerminateProcess"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") Found reference to API "syscall.TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00000684.00000000.189801.6693D000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004284.00000000.189912.711D1000.00000002.mdmp, 00000000-00004284.00000001.190028.00EDD000.00000002.mdmp, 00000000-00004284.00000001.190028.06800000.00000004.mdmp, 00000000-00004284.00000001.190028.08110000.00000004.mdmp, 00000000-00004284.00000001.190028.71235000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004284.00000001.190028.00EDD000.00000002.mdmp, 00000000-00004284.00000001.190028.06800000.00000004.mdmp, 00000000-00004284.00000001.190028.08110000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004284.00000001.190028.00EDD000.00000002.mdmp, 00000000-00004284.00000001.190028.06800000.00000004.mdmp, 00000000-00004284.00000001.190028.08110000.00000004.mdmp")80:Tda5,Observed import api "AddAccessAllowedAce" which can "add an access-allowed access control entry (ACE) to an access control list (ACL)" [Source: ScreenConnect.WindowsCredentialProvider.dll] Observed import api "CreateWellKnownSid" which can "create a SID for predefined aliases" [Source: ScreenConnect.WindowsCredentialProvider.dll] Observed import api "GetSidIdentifierAuthority" which can "return a pointer to the SID_IDENTIFIER_AUTHORITY structure in a specified security identifier (SID)" [Source: ScreenConnect.WindowsCredentialProvider.dll] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: ScreenConnect.WindowsCredentialProvider.dll] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: ScreenConnect.WindowsCredentialProvider.dll] Observed import api "ImpersonateLoggedOnUser" which can "let the calling thread impersonate the security context of a logged-on user" [Source: ScreenConnect.WindowsCredentialProvider.dll] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: ScreenConnect.WindowsCredentialProvider.dll] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: ScreenConnect.WindowsCredentialProvider.dll] Observed import api "RevertToSelf" which can "terminate the impersonation of a client application" [Source: ScreenConnect.WindowsCredentialProvider.dll] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: ScreenConnect.WindowsCredentialProvider.dll] Observed import api "SetSecurityDescriptorOwner" which can "set the owner information of an absolute-format security descriptor" [Source: ScreenConnect.WindowsCredentialProvider.dll] Observed import api "AllocateLocallyUniqueId" which can "allocate a locally unique identifier (LUID)" [Source: ScreenConnect.WindowsAuthenticationPackage.dll] Observed import api "CreateWellKnownSid" which can "create a SID for predefined aliases" [Source: ScreenConnect.WindowsAuthenticationPackage.dll] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: ScreenConnect.WindowsAuthenticationPackage.dll] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: ScreenConnect.WindowsAuthenticationPackage.dll] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: ScreenConnect.WindowsAuthenticationPackage.dll] Observed import api "IsWellKnownSid" which can "compare a SID to a well-known SID and returns TRUE if they match" [Source: ScreenConnect.WindowsAuthenticationPackage.dll] Observed import api "CreateWellKnownSid" which can "create a SID for predefined aliases" [Source: MSI6901.tmp] Observed import api "GetSecurityDescriptorControl" which can "retrieve a security descriptor control and revision information" [Source: MSI6901.tmp] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: MSI6901.tmp] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: MSI6901.tmp]81:Ta14,"__OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n file/memory contains long string with (Indicator: \"OpenProcessToken\"; Source: \"00000000-00000684.00000000.189801.6693D000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00004284.00000000.189912.711D1000.00000002.mdmp\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; Source: \"00000000-00004284.00000000.189912.711D1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load content from resource","description":"Observed function \"ResourceManagerEx.GetObject\" in \"ScreenConnect.ClientService.dll\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-112","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"file/memory contains long string with (Indicator: \"RegSetValue\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n Found reference to API \"RegSetValueEx\" (Indicator: \"RegSetValue\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n file/memory contains long string with (Indicator: \"RegSetValue\"; Source: \"00000000-00000684.00000000.189801.6693D000.00000002.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00004284.00000000.189912.711D1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"file/memory contains long string with (Indicator: \"OpenService\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n Found reference to API \"OpenService\" (Indicator: \"OpenService\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n Found reference to API \"OpenServiceControlManager\" (Indicator: \"OpenService\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n Found reference to API \"OpenServiceRegistryKey\" (Indicator: \"OpenService\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00004284.00000000.189912.711D1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProc\" (Indicator: \"CallWindowProc\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00004284.00000000.189912.035C0000.00000004.mdmp, 00000000-00004284.00000001.190028.035C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"file/memory contains long string with (Indicator: \"SetFileTime\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00004284.00000000.189912.035C0000.00000004.mdmp\n 00000000-00004284.00000001.190028.035C0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Detected msiexec.exe process execution","description":"Process \"msiexec.exe\" with commandline \"/i \"%TEMP%\\\\ScreenConnect\\\\25.2.4.9229\\\\067c8dc33b68b555\\\\ScreenConnect.ClientSetup.msi\"\" (UID: 00000000-00007804)\n\n Process \"MsiExec.exe\" with commandline \"-Embedding 0A6BFE60F8103649BAFC75889D6B7A43 C\" (UID: 00000000-00005104)\n\n Process \"MsiExec.exe\" with commandline \"-Embedding 62C165DB214C130E4DCF05691B8923E9\" (UID: 00000000-00006304)\n\n Process \"MsiExec.exe\" with commandline \"-Embedding 8C8EC9D61EB4682AB61079C99D6BCB56 E Global\\\\MSI0000\" (UID: 00000000-00000372)\n","origin":"Monitored Target","mitre_attack_id":"T1218.007","relevance":2,"id":"target-152","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"System\" and MemberReference \"GetMethod\" in \"Microsoft.Deployment.WindowsInstaller.Package.dll\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00004284.00000000.189912.056C0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004284.00000000.189912.05800000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004284.00000000.189912.080F0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004284.00000001.190028.08040000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004284.00000001.190028.08110000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2e","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to block user input (API string)","description":"Found reference to API \"BlockInput\" (Indicator: \"BlockInput\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-547","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"file/memory contains long string with (Indicator: \"CryptProtectData\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n file/memory contains long string with (Indicator: \"CryptUnprotectData\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n file/memory contains long string with (Indicator: \"CryptProtectData\"; Source: \"00000000-00000684.00000000.189801.6693D000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00000684.00000000.189801.6693D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decode string content at runtime (.NET)","description":"Observed function \"ToBase64String\" in \"ScreenConnect.ClientService.dll\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"$30","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$31","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"00000000-00004284.00000000.189912.71141000.00000020.mdmp, 00000000-00004284.00000000.189912.711D1000.00000002.mdmp\")\n Found reference to API \"BCryptCloseAlgorithmProvider\" (Indicator: \"BCryptCloseAlgorithmProvider\"; Source: \"00000000-00004284.00000000.189912.71141000.00000020.mdmp, 00000000-00004284.00000000.189912.711D1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"<1>__ConvertFromBase64StringFlexible\" (Indicator: \"FromBase64String\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decrypt data using RSA (Dotnet String)","description":"Observed string: \"System.Security.Cryptography.RSACryptoServiceProvider.CreateDecryptor\" in Source: e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-357","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt data using RSA (Dotnet String)","description":"Observed string: \"System.Security.Cryptography.RSACryptoServiceProvider.set_EncryptedSecretKey\" in Source: e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-358","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES decryption (Dotnet String)","description":"Observed string: \"System.Security.Cryptography.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089.CreateDecryptor\" in Source: e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-445","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"file/memory contains long string with (Indicator: \"CryptUnprotectData\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"file/memory contains long string with (Indicator: \"CryptProtectData\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n file/memory contains long string with (Indicator: \"CryptProtectData\"; Source: \"00000000-00000684.00000000.189801.6693D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"EncryptRSA\" (Indicator: \"EncryptRSA\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n Found string \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains possible references to Golang crypto modules","description":"$33","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-234","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.15106","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$34","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$35","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004284-00000C2C-1943520621\")\n file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00000684.00000000.189801.6693D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system file/directory information (.NET)","description":"Observed dotnet function \"GetFiles\" in \"Microsoft.Deployment.WindowsInstaller.Package.dll\"\n Observed dotnet function \"GetFiles\" in \"Microsoft.Deployment.Compression.dll\"\n Observed dotnet function \"GetDirectories\" in \"Microsoft.Deployment.Compression.dll\"\n Observed dotnet function \"GetDirectories\" in \"ScreenConnect.InstallerActions.dll\"\n Observed dotnet function \"GetFileSystemEntries\" in \"ScreenConnect.InstallerActions.dll\"\n Observed dotnet function \"GetFiles\" in \"ScreenConnect.InstallerActions.dll\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":3,"id":"static-200","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"file/memory contains long string(File: \"ScreenConnect.ClientService.dll\")\n file/memory contains long string(Source: \"00000000-00000684.00000000.189801.6693D000.00000002.mdmp\")\n Found string \"GetTrueOSVersion\" (Source: \"00000000-00004284.00000000.189912.080F0000.00000004.mdmp, 00000000-00004284.00000001.190028.08110000.00000004.mdmp\")\n Found string \"redentialsUserNameLabelText\" (Source: \"00000000-00004284.00000001.190028.06800000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004284-00000C2C-1943520621\")\n file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00000684.00000000.189801.6693D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"$37","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"file/memory contains long string(File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n Found string \"QueryServiceStatus\" (File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n Found string \"QueryServiceConfig2W\" (File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n file/memory contains long string(Source: \"00000000-00000684.00000000.189801.6693D000.00000002.mdmp\")\n Found string \"QueryServiceStatus\" (Source: \"00000000-00004284.00000000.189912.711D1000.00000002.mdmp, 00000000-00004284.00000001.190028.08110000.00000004.mdmp\")\n Found string \"QueryServiceConfigW\" (Source: \"00000000-00004284.00000000.189912.711D1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n Found reference to API \"EnumSystemLocalesW\" (Indicator: \"EnumSystemLocales\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"file/memory contains long string with (Indicator: \"GetDiskFreeSpace\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n file/memory contains long string with (Indicator: \"GetDiskFreeSpaceEx\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n file/memory contains long string with (Indicator: \"getaddrinfo\"; Source: \"00000000-00000684.00000000.189801.6693D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"file/memory contains long string with (Indicator: \"GetUserPreferredUILanguages\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n Found reference to API \"GetKeyboardLayoutName\" (Indicator: \"GetKeyboardLayout\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"ScreenConnect.ClientSetup.exe3896969975\" called \"GetTickCount\" with parameters (UID: 00000000-00004284)\n \"ScreenConnect.ClientSetup.exe3896969975\" called \"GetWriteWatch\" with parameters (UID: 00000000-00004284)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"__CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00004284.00000000.189912.711D1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"General","name":"Contains ability to copy files (API string)","description":"Found reference to API \"CopyFile\" (Indicator: \"CopyFile\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-449","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"General","name":"Contains ability to create a new user account (API string)","description":"file/memory contains long string with (Indicator: \"NetUserAdd\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n Found reference to API \"NetUserAdd\" (Indicator: \"NetUserAdd\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n Found reference to API \"NetLocalGroupAddMembers\" (Indicator: \"NetLocalGroupAddMembers\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n file/memory contains long string with (Indicator: \"NetUserAdd\"; Source: \"00000000-00000684.00000000.189801.6693D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1136.001","relevance":1,"id":"string-214","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"file/memory contains long string with (Indicator: \"CreateDirectory\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n file/memory contains long string with (Indicator: \"CreateDirectory\"; Source: \"00000000-00000684.00000000.189801.6693D000.00000002.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00004284.00000000.189912.711D1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"file/memory contains long string with (Indicator: \"DeviceIoControl\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"file/memory contains long string with (Indicator: \"RegCloseKey\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n Found reference to API \"syscall.RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n Found reference to API \"RegDisablePredefinedCache\" (Indicator: \"RegDisablePredefinedCache\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n Found reference to API \"<12>__RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n Found reference to API \"syscall.RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00000684.00000000.189801.6693D000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004284.00000000.189912.711D1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: ScreenConnect.WindowsCredentialProvider.dll)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"file/memory contains long string with (Indicator: \"ShellExecute\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n file/memory contains long string with (Indicator: \"ShellExecute\"; Source: \"00000000-00000684.00000000.189801.6693D000.00000002.mdmp\")\n Found reference to API \"yncShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00004284.00000001.190028.035C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"file/memory contains long string with (Indicator: \"LogonUser\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n Found reference to API \"LogonUser\" (Indicator: \"LogonUser\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n file/memory contains long string with (Indicator: \"LogonUser\"; Source: \"00000000-00000684.00000000.189801.6693D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFile\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n Found reference to API \"MoveFileTransacted\" (Indicator: \"MoveFile\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n Found reference to API \"MoveFile\" (Indicator: \"MoveFile\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n Found reference to API \"MoveFileEx\" (Indicator: \"MoveFile\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"General","name":"Contains ability to set file attributes (Dotnet)","description":"Observed Namespace \"System.IO.File\" and MemberReference \"SetAttributes\" in \"ScreenConnect.ClientService.dll\"\n Observed Namespace \"System.IO.File\" and MemberReference \"GetAttributes\" in \"Microsoft.Deployment.WindowsInstaller.Package.dll\"\n Observed Namespace \"System.IO.File\" and MemberReference \"SetAttributes\" in \"Microsoft.Deployment.WindowsInstaller.Package.dll\"\n Observed Namespace \"System.IO.File\" and MemberReference \"GetAttributes\" in \"Microsoft.Deployment.Compression.dll\"\n Observed Namespace \"System.IO.FileSystemInfo\" and MemberReference \"get_Attributes\" in \"Microsoft.Deployment.Compression.dll\"\n Observed Namespace \"System.IO.FileSystemInfo\" and MemberReference \"set_Attributes\" in \"Microsoft.Deployment.Compression.dll\"","origin":"Static Parser","mitre_attack_id":"T1222","relevance":1,"id":"static-155","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"file/memory contains long string with (Indicator: \"GetShellWindow\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n file/memory contains long string with (Indicator: \"GetWindowThreadProcessId\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n Found reference to API \"wShowWindow\" (Indicator: \"ShowWindow\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n file/memory contains long string with (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00000684.00000000.189801.6693D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.Start\" in \"ScreenConnect.WindowsFileManager.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$50","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$51","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"General","name":"Creates directory on disk","description":"\"ScreenConnect.ClientSetup.exe3896969975\" with parameter %TEMP%\\ScreenConnect (UID: 00000000-00004284)\n \"ScreenConnect.ClientSetup.exe3896969975\" with parameter %TEMP%\\ScreenConnect\\25.2.4.9229 (UID: 00000000-00004284)\n \"ScreenConnect.ClientSetup.exe3896969975\" with parameter %TEMP%\\ScreenConnect\\25.2.4.9229\\067c8dc33b68b555 (UID: 00000000-00004284)\n \"rundll32.exe\" with parameter %TEMP%\\MSI4F2E.tmp- (UID: 00000000-00007320)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-318","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$52","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to modify/delete registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteSubKey\" in \"ScreenConnect.ClientService.dll\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"CreateSubKey\" in \"ScreenConnect.ClientService.dll\"","origin":"Static Parser","mitre_attack_id":"T1112","relevance":1,"id":"static-139","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$53","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$54","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$55","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"Observed unmanaged function \"FCICreate\" in \"Microsoft.Deployment.Compression.Cab.dll\"\n Observed unmanaged function \"FCIAddFile\" in \"Microsoft.Deployment.Compression.Cab.dll\"\n Observed unmanaged function \"FCIFlushCabinet\" in \"Microsoft.Deployment.Compression.Cab.dll\"\n Observed unmanaged function \"FCIFlushFolder\" in \"Microsoft.Deployment.Compression.Cab.dll\"\n Observed unmanaged function \"FCIDestroy\" in \"Microsoft.Deployment.Compression.Cab.dll\"\n Observed unmanaged function \"FDICreate\" in \"Microsoft.Deployment.Compression.Cab.dll\"\n Observed unmanaged function \"FDICopy\" in \"Microsoft.Deployment.Compression.Cab.dll\"\n Observed unmanaged function \"FDIDestroy\" in \"Microsoft.Deployment.Compression.Cab.dll\"\n Observed unmanaged function \"FDIIsCabinet\" in \"Microsoft.Deployment.Compression.Cab.dll\"\n Observed unmanaged function \"DosDateTimeToFileTime\" in \"Microsoft.Deployment.Compression.dll\"\n Observed unmanaged function \"FileTimeToDosDateTime\" in \"Microsoft.Deployment.Compression.dll\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\Pipe\\TerminalServer\\SystemExecSrvr\\\n Found string - \\\\.\\pipe\\\n Found string - \\.\\pipe\\","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$56","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$57","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"ScreenConnect.ClientSetup.exe3896969975\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 712A0000\n \"rundll32.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 6E130000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"ScreenConnect.ClientSetup.exe3896969975\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 71270000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"k__BackingField\" (Indicator: \"nthash\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n Found string \"k__BackingField\" (Indicator: \"nthash\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n Found string \"get_ScreenshotContentHash\" (Indicator: \"nthash\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n Found string \"set_ScreenshotContentHash\" (Indicator: \"nthash\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n Found string \"get_CurrentScreenshotContentHash\" (Indicator: \"nthash\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n Found string \"set_CurrentScreenshotContentHash\" (Indicator: \"nthash\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")","origin":"File/Memory","mitre_attack_id":"T1003.002","relevance":1,"id":"string-867","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"GetClipboardData\" (File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$6d","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"file/memory contains long string with (Indicator: \"getlogicaldrivestringsw\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n file/memory contains long string with (Indicator: \"getlogicaldrivestringsw\"; Source: \"00000000-00000684.00000000.189801.6693D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"$6e","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: ScreenConnect.WindowsCredentialProvider.dll]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: ScreenConnect.WindowsAuthenticationPackage.dll]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: ScreenConnect.ClientService.exe]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: MSI4F2E.tmp]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: MSI6901.tmp]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to monitor clipboard data (API string)","description":"Found string \"AddClipboardFormatListener\" (File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-925","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$6f","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n Found reference to API \"VkKeyScan\" (Indicator: \"VkKeyScan\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n Found reference to API \"MapVirtualKey\" (Indicator: \"MapVirtualKey\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"ScreenConnect.ClientSetup.exe3896969975\" tries to directly access volume data \"Z:\"","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$70","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\" tE!\"\n \"ScreenConnect.ClientService.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"ScreenConnect.WindowsFileManager.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"Microsoft.Deployment.WindowsInstaller.Package.dll\" was detected as \"Microsoft visual C# / Basic .NET\"\n \"Microsoft.Deployment.Compression.Cab.dll\" was detected as \"Microsoft visual C# / Basic .NET\"\n \"Microsoft.Deployment.Compression.dll\" was detected as \"Microsoft visual C# / Basic .NET\"\n \"ScreenConnect.InstallerActions.dll\" was detected as \"Microsoft visual C# / Basic .NET\"\n \"MSI4F2E.tmp\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"MSI6901.tmp\" was detected as \"Borland Delphi 3.0 (???)\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"ScreenConnect.ClientSetup.exe3896969975\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"ScreenConnect.ClientSetup.exe3896969975\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"ScreenConnect.ClientSetup.exe3896969975\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 4284)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\" has section name .data with entropy \"7.383687272256984\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to enumerate processes on remote desktop session hosts","description":"Observed process enumerate api used in \"kernel32.dll\" [Source: ScreenConnect.WindowsCredentialProvider.dll]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":3,"id":"static-209","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"SELECT ProcessId, ParentProcessId FROM Win32_Process\" (Indicator: \" win32_process\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n \"d, ParentProcessId FROM Win32_Process\" (Indicator: \" win32_process\"; File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"suspicious","category":"Environment Awareness","name":"The input sample contains a known anti-VM trick","description":"Found VM detection artifact \"CPUID trick\" in \"sample.bin\" (Offset: 3879960)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-8","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/26 Antivirus vendors marked sample as malicious (3% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"ScreenConnect.WindowsFileManager.exe\" has resource with unusual entropy \"RT_ICON:7.775119417889156\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"ScreenConnect.ClientSetup.exe3896969975\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"ScreenConnect.ClientSetup.exe3896969975\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"ScreenConnect.ClientSetup.exe3896969975\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"ScreenConnect.ClientSetup.exe3896969975\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"ScreenConnect.ClientSetup.exe3896969975\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"ScreenConnect.ClientSetup.exe3896969975\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"ScreenConnect.ClientSetup.exe3896969975\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$85","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$86","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"SELECT * FROM Win32_UserAccount WHERE Name='\" (Indicator: \" win32_useraccount\"; in File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")\n Found string \"OM Win32_UserAccount WHERE Name='\" (Indicator: \" win32_useraccount\"; in File: \"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Able to retrieve browser cookies using SQL","description":"Found string \"??\\c:\\users\\hapubws\\appdata\\local\\microsoft\\windows\\inetcookies\" (Source: \"00000000-00004284.00000001.190028.035C0000.00000004.mdmp\")\n Found string \"icrosoft\\Windows\\INetCookies\" (Source: \"00000000-00004284.00000001.190028.035C0000.00000004.mdmp\")\n Found string \":\\Users\\HAPUBWS\\AppData\\Local\\Microsoft\\Windows\\INetCookies\" (Source: \"00000000-00004284.00000001.190028.035C0000.00000004.mdmp\")\n Found string \":\\users\\hapubws\\appdata\\local\\microsoft\\windows\\inetcookies\" (Source: \"00000000-00004284.00000001.190028.035C0000.00000004.mdmp\")\n Found string \"rs\\HAPUBWS\\AppData\\Local\\Microsoft\\Windows\\INetCookies\" (Source: \"00000000-00004284.00000001.190028.035C0000.00000004.mdmp\")\n Found string \"USERPROFILE%\\AppData\\Local\\Microsoft\\Windows\\INetCookies\" (Source: \"00000000-00004284.00000001.190028.035C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-692","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$87","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$88","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"ScreenConnect.ClientSetup.exe3896969975\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"ScreenConnect.WindowsCredentialProvider.dll\" claimed CRC 906424 while the actual is CRC 7719468\n \"ScreenConnect.WindowsAuthenticationPackage.dll\" claimed CRC 272565 while the actual is CRC 906424\n \"ScreenConnect.ClientService.exe\" claimed CRC 155781 while the actual is CRC 272565\n \"ScreenConnect.WindowsFileManager.exe\" claimed CRC 138067 while the actual is CRC 155781\n \"ScreenConnect.ClientService.dll\" claimed CRC 94381 while the actual is CRC 138067\n \"Microsoft.Deployment.WindowsInstaller.Package.dll\" claimed CRC 95386 while the actual is CRC 94381\n \"Microsoft.Deployment.Compression.Cab.dll\" claimed CRC 74768 while the actual is CRC 95386\n \"Microsoft.Deployment.Compression.dll\" claimed CRC 66244 while the actual is CRC 74768\n \"ScreenConnect.InstallerActions.dll\" claimed CRC 26343 while the actual is CRC 66244\n \"MSI4F2E.tmp\" claimed CRC 193043 while the actual is CRC 26343","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$89","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc.bin\" claims program is from Thu Jan 1 00:00:00 1970\n \"ScreenConnect.WindowsFileManager.exe\" claims program is from Sat May 5 19:33:16 2063\n \"ScreenConnect.ClientService.dll\" claims program is from Wed Oct 15 00:42:51 2059\n \"ScreenConnect.InstallerActions.dll\" claims program is from Sat Jul 25 08:02:36 2071","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"ScreenConnect.ClientSetup.exe3896969975\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\msiexec.exe\" /i \"%TEMP%\\ScreenConnect\\25.2.4.9229\\067c8dc33b68b555\\ScreenConnect\" - (UID: 00000000-00004284)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Detected Rundll32 process execution","description":"Process \"rundll32.exe\" with commandline \"\"%TEMP%\\\\MSI4F2E.tmp\",zzzzInvokeManagedCustomActionOutOfProc SfxCA_2969640 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments\" (UID: 00000000-00007320)","origin":"Monitored Target","mitre_attack_id":"T1218.011","relevance":10,"id":"target-115","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Script loads executable in memory (Antimalware Scan Interface)","description":"details too long to display","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1055.001","relevance":10,"id":"amsi-3","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (D)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"69b9e55cc334ab84d50653c9"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"