Windows Analysis Report
SecuriteInfo.com.Heur.21832.3236.exe

Overview

General Information

Sample name: SecuriteInfo.com.Heur.21832.3236.exe
Analysis ID: 1428295
MD5: df0daae26fb3f58a6b9ce4d144a81b48
SHA1: 38e41ab0e2712f7762c6d8b56892362cbb1b6744
SHA256: ee9c745ec13fb4389968431701fecabaa3fd85f607e694e0d8747703a60fe0dc
Tags: exe
Infos:

Detection

Score: 5
Range: 0 - 100
Whitelisted: false
Confidence: 20%

Compliance

Score: 34
Range: 0 - 100

Signatures

Binary contains a suspicious time stamp
Contains functionality for read data from the clipboard
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
Contains functionality to shutdown / reboot the system
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
EXE planting / hijacking vulnerabilities found
Enables security privileges
Found dropped PE file which has not been started or loaded
Installs a raw input device (often for capturing keystrokes)
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries keyboard layouts
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Stores files to the Windows start menu directory
Uses 32bit PE files
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

EXE planting / hijacking vulnerabilities found
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe EXE: C:\Users\user\AppData\Local\zentaoclient-updater\installer.exe Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe EXE: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe EXE: C:\Users\user\AppData\Local\Programs\zentaoclient\Uninstall zentaoclient.exe Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe EXE: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\elevate.exe Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe EXE: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\updater.win64.exe Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe EXE: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Jump to behavior

Compliance
barindex
EXE planting / hijacking vulnerabilities found
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe EXE: C:\Users\user\AppData\Local\zentaoclient-updater\installer.exe Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe EXE: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe EXE: C:\Users\user\AppData\Local\Programs\zentaoclient\Uninstall zentaoclient.exe Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe EXE: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\elevate.exe Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe EXE: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\updater.win64.exe Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe EXE: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Jump to behavior
Uses 32bit PE files
Source: SecuriteInfo.com.Heur.21832.3236.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\f3057352-10e3-53a8-8e7d-c7f226474698 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Local\Programs\zentaoclient\LICENSE.electron.txt Jump to behavior
Source: SecuriteInfo.com.Heur.21832.3236.exe Static PE information: certificate valid
Source: SecuriteInfo.com.Heur.21832.3236.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: C:\work\mesa\git\mesa\build\windows-x86\gallium\targets\libgl-gdi\opengl32.pdb source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1925344352.0000000007517000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: electron.exe.pdb source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.000000000780B000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\work\mesa\git\mesa\build\windows-x86\gallium\targets\libgl-gdi\opengl32.pdbj source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1925344352.0000000007517000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: libGLESv2.dll.pdb source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Code function: 0_2_004059CC GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 0_2_004059CC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Code function: 0_2_004065FD FindFirstFileW,FindClose, 0_2_004065FD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Code function: 0_2_00402868 FindFirstFileW, 0_2_00402868
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File opened: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\iconengines Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File opened: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File opened: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\bearer Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File opened: C:\Users\user\AppData\Local\Programs\zentaoclient\resources Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File opened: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File opened: C:\Users\user\AppData\Local\Programs\zentaoclient\locales Jump to behavior
Source: zentaoclient.exe, 00000005.00000000.2033367173.00007FF774CAC000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: a--optimize-for-size--noharmony-shipping--harmony--wasm-staging--future--no-future--liftoff--no-liftoff--wasm-lazy-compilation--no-wasm-lazy-compilation--experimental-wasm-simd--no-experimental-wasm-simd--harmony-import-assertions--harmony-atomics--no-harmony-sharedarraybuffer--wasm-tier-up--no-wasm-tier-up--no-wasm-trap-handler--no-untrusted-code-mitigationsV8.MemoryHeapUsedV8.MemoryHeapCommitted.gmail.docs.plus.inboxcalendar.google.com.calendarwww.youtube.com.youtube.top10sina.com.cnfacebook.combaidu.comqq.comtwitter.comtaobao.comlive.com equals www.youtube.com (Youtube)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000006FE5000.00000004.00001000.00020000.00000000.sdmp, zentaoclient.exe, 00000005.00000000.2033367173.00007FF774CAC000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006C12000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://%s:80../../services/network/public/cpp/network_connection_tracker.ccOnNetworkChangedOnGetConn
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007075000.00000004.00001000.00020000.00000000.sdmp, zentaoclient.exe, 00000005.00000000.2033367173.00007FF774D3C000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: http://.css
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007075000.00000004.00001000.00020000.00000000.sdmp, zentaoclient.exe, 00000005.00000000.2033367173.00007FF774D3C000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: http://.jpg
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.000000000700A000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://127.0.0.1
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://2x.io
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://allyoucanleet.com/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/1085
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/1452
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/1452expand_integer_pow_expressionsThe
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/1512
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/1637
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/1936
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2046
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2152
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2152skip_vs_constant_register_zeroIn
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2162
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2273
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2514
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2517
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2727
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2970
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2978
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3016
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3027
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3045
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3078
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3153
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3205
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3206
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3243
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3246
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3246allow_clear_for_robust_resource_initSome
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3452
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3498
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3502
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3529
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3584
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3623
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3624
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3625
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3682
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3682GL_USES_FRAG_COLORGL_USES_FRAG_DATA_SECONDARY_COLORGL_USES_SECONDARGL_USES_F
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3729
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3859
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3970
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3997
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4214
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4267
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4324
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4339
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4384
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4405
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4428
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4551
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4633
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4646
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/482
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4836
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4901
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4937
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4995
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5055
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5061
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5281
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5375
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5469
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5535
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://api.www.myobfuscate.com/?getsrc=ok
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://blog.izs.me
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://blog.izs.me/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://blogs.msdn.com/b/ieinternals/archive/2010/05/13/xdomainrequest-restrictions-limitations-and-w
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://bugs.jquery.com/ticket/12385.
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000002.2053376524.000000000041E000.00000004.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1925344352.0000000007517000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1895509910.0000000003300000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1968503333.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1968762380.0000000005C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000002.2053376524.000000000041E000.00000004.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1925344352.0000000007517000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1895509910.0000000003300000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1968503333.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1968762380.0000000005C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000002.2053376524.000000000041E000.00000004.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1925344352.0000000007517000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1895509910.0000000003300000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1968503333.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1968762380.0000000005C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://casper.beckman.uiuc.edu/~c-tsai4
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://cgit.freedesktop.org/xorg/xserver/tree/COPYING
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://chasen.aist-nara.ac.jp/chasen/distribution.html
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ci.testling.com/substack/node-concat-map)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ci.testling.com/substack/node-concat-map.png)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://cldr.unicode.org/index/downloads
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://code.google.com/p/closure-compiler/wiki/SourceMaps
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://code.google.com/p/lao-dictionary/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://code.google.com/p/smhasher/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://code.google.com/p/v8
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://code.google.com/p/v8/issues/detail?id=1858).
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/1094869
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/110263
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/1144207
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/1171371
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/308366
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/403957
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/565179
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006DBC000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/619103.
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006DBC000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/619103.Subsequence
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/642227
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/642605
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/644669
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/650547
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/672380
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/709351
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/772651
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/797243
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/809422
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/830046
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/849576
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/883276
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/927470
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/941620
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crbug.com/941620allow_translate_uniform_block_to_structured_bufferThere
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://creativecommons.org/licenses/MIT/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://creativecommons.org/publicdomain/zero/1.0/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.000000000777B000.00000004.00001000.00020000.00000000.sdmp, zentaoclient.exe, 00000005.00000000.2033367173.00007FF775344000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.000000000777B000.00000004.00001000.00020000.00000000.sdmp, zentaoclient.exe, 00000005.00000000.2033367173.00007FF775344000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl0
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.000000000777B000.00000004.00001000.00020000.00000000.sdmp, zentaoclient.exe, 00000005.00000000.2033367173.00007FF775344000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000002.2053376524.000000000041E000.00000004.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1925344352.0000000007517000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1895509910.0000000003300000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1968503333.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1968762380.0000000005C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000002.2053376524.000000000041E000.00000004.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1925344352.0000000007517000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1895509910.0000000003300000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1968503333.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1968762380.0000000005C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000002.2053376524.000000000041E000.00000004.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1925344352.0000000007517000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1895509910.0000000003300000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1968503333.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1968762380.0000000005C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000002.2053376524.000000000041E000.00000004.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1925344352.0000000007517000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1895509910.0000000003300000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1968503333.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1968762380.0000000005C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000002.2053376524.000000000041E000.00000004.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1925344352.0000000007517000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1895509910.0000000003300000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1968503333.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1968762380.0000000005C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://daniel.zelisko.net
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://dev.w3.org/csswg/css-color/#hwb-to-rgb
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://devel.freebsoft.org/speechd
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://developer.android.com/tools/extras/support-library.html
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://developers.google.com/speed/webp
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://dom.spec.whatwg.org/#dom-domimplementation-hasfeature
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://dom.spec.whatwg.org/#dom-node-comparedocumentposition
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://dominictarr.com
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ecma-international.org/ecma-262/7.0/#sec-object.keys)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ecma-international.org/ecma-262/7.0/#sec-object.prototype.tostring)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ecma-international.org/ecma-262/7.0/#sec-patterns).
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ecma-international.org/ecma-262/7.0/#sec-samevaluezero)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ecma-international.org/ecma-262/7.0/#sec-tolength).
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://eev.ee/blog/2015/09/12/dark-corners-of-unicode/).
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://encoding.spec.whatwg.org/#big5-encoder
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://esprima.org)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.0000000007665000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/common
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.0000000007665000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/commonnode-set../../third_party/blink/renderer/core/xml/xslt_extensions.ccxsltNewSe
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://facebook.github.io/react/)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://facebook.github.io/react/docs/error-decoder.html?invariant=
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://fb.me/prop-types-in-prod
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://fb.me/use-check-prop-types
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://fedorahosted.org/lohit>
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://feedic.com
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://feross.org
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ghinda.net/jpeg-blob-ajax-android/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://git.linuxtv.org/v4l-utils.git
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://github.com/Raynos/to-array/raw/master/LICENSE
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://github.com/danielzzz/node-ping
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://github.com/dominictarr/config-chain
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://github.com/gperftools/gperftools
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://github.com/kriskowal/mr)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://github.com/sctplab/usrsctp
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://goo.gl/0ejHHW
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://google.github.io/snappy/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://hertzen.com
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007075000.00000004.00001000.00020000.00000000.sdmp, zentaoclient.exe, 00000005.00000000.2033367173.00007FF774D3C000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: http://html4/loose.dtd
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.0000000007665000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://icl.com/saxon
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.0000000007665000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://icl.com/saxonorg.apache.xalan.xslt.extensions.RedirectxsltDocumentElem:
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://icu-project.org/docs/papers/gb18030.html
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://img.shields.io/npm/dm/socket.io-client.svg?style=flat)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://isrc.ifpi.org/en/isrc-standard/code-syntax
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://issuetracker.google.com/173636783
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://jsperf.com/1-vs-infinity
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://jsperf.com/copy-array-inline
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://jsperf.com/emptying-a-node
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://jsperf.com/hashing-strings
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://jsperf.com/key-exists
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://jsperf.com/key-missing
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://jsperf.com/obj-vs-arr-iteration
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://jsperf.com/uncurrythis
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://juliangruber.com
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://labs.creativecommons.org/licenses/zero-waive/1.0/us/legalcode>
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://lao-dictionary.googlecode.com/git/Lao-Dictionary-LICENSE.txt
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://lao-dictionary.googlecode.com/git/Lao-Dictionary.txt
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1925344352.0000000007517000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://llvm.org/):
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.000000000700A000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://localhosthttp://127.0.0.1object-src
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://marijnhaverbeke.nl/git/acorn
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://mathiasbynens.be/notes/javascript-encoding#surrogate-formulae
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://me.abelcheung.org/articles/research/what-is-cp951/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://modernizr.com/docs/#prefixed)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://moztw.org/docs/big5/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://mxr.mozilla.org/comm-central/source/mozilla/netwerk/base/src/nsURLParsers.cpp
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://n8.io/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://narwhaljs.org)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://npmjs.org)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000000.1732463402.000000000040A000.00000008.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000002.2053376524.000000000040A000.00000004.00000001.01000000.00000003.sdmp String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000002.2053376524.000000000041E000.00000004.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1925344352.0000000007517000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1895509910.0000000003300000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1968503333.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1968762380.0000000005C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0A
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000002.2053376524.000000000041E000.00000004.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1925344352.0000000007517000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1895509910.0000000003300000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1968503333.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1968762380.0000000005C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0C
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000002.2053376524.000000000041E000.00000004.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1925344352.0000000007517000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1895509910.0000000003300000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1968503333.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1968762380.0000000005C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0X
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000002.2053376524.000000000041E000.00000004.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1925344352.0000000007517000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1895509910.0000000003300000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1968503333.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1968762380.0000000005C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ocsp.sectigo.com0
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://opensource.org/licenses/bsd-license.php
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://promises-aplus.github.com/promises-spec/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://schema.org/docs/gs.html
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://scripts.sil.org/OFL
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://slack.socket.io)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://slack.socket.io/badge.svg?)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://source.android.com/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://source.android.com/compatibility)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://source.icu-project.org/repos/icu/data/trunk/charset/data/xml/gb-18030-2000.xml
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://src.chromium.org/viewvc/blink/trunk/Source/devtools/front_end/SourceMap.js
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://src.chromium.org/viewvc/chrome/trunk/deps/third_party/xz/COPYING
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://stackoverflow.com/a/16459606/376773
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://stackoverflow.com/a/398120/376773
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://stackoverflow.com/a/5982798/376773
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://stackoverflow.com/a/9808332/192024).
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://substack.net
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://tanyabrassie.com/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://tools.ietf.org/html/rfc3501#section-5.1.3
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://tools.ietf.org/html/rfc3501#section-5.1.3)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006C12000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://tools.ietf.org/html/rfc3986#section-2.1)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://travis-ci.org/substack/node-concat-map)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://trevp.net/tlslite/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://tukaani.org/xz/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://underscorejs.org/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://underscorejs.org/LICENSE
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://userguide.icu-project.org/strings/properties
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://valgrind.org
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://webkit.org/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://wiki.ecmascript.org/doku.php?id=conventions:safe_meta_programming
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://wiki.ecmascript.org/doku.php?id=strawman:concurrency
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://wiki.ecmascript.org/doku.php?id=strawman:concurrency&rev=1308776521#allfulfilled
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000075F4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://wpad/wpad.dat
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000075F4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://wpad/wpad.dat../../net/proxy_resolution/pac_file_decider.ccDoWaitDoQuickCheck../../net/proxy_
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000075F4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://wpad/wpad.dat../../net/proxy_resolution/win/proxy_config_service_win.cc~ProxyConfigServiceWin
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.3waylabs.com/nw/WWW/products/wizcon/vt220.html
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006CE0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.aiim.org/pdfa/ns/id/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.andismith.com/blog/2012/02/modernizr-prefixed/)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.chromium.org
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006C12000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.color.org
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006C12000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.color.orgRegistryNameCustomOutputConditionIdentifiersRGB
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.dabeaz.com/ply/ply-3.11.tar.gz
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.ecma-international.org/ecma-262/5.1/#sec-7.9.1
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.ecma-international.org/ecma-262/6.0/#sec-array-exotic-objects
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.ecma-international.org/ecma-262/6.0/#sec-toint32
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.ecma-international.org/ecma-262/7.0/#sec-ecmascript-language-types)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.freedesktop.org/wiki/Software/xdg-user-dirs
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.gutenberg.org/ebooks/53).
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.haible.de/bruno/charsets/conversion-tables/Big5.html
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000075F4000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000075F4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3C//DTD
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.000000000777B000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.0000000007665000.00000004.00001000.00020000.00000000.sdmp, zentaoclient.exe, 00000005.00000000.2033367173.00007FF775344000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.0000000007665000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01http://www.webrtc.org/exper
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.0000000007665000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.jclark.com/xt
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.khngai.com/chinese/charmap/tblgbk.php?page=0
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.linux-usb.org/usb-ids.html
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.localeplanet.com/java/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.midnight-commander.org/browser/lib/tty/key.c
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/MPL/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.nonblocking.io/2011/06/windownexttick.html
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.nongnu.org/freebangfont/downloads.html#mukti
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.ogcio.gov.hk/en/business/tech_promotion/ccli/terms/doc/2003cmp_2008.txt
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.ogcio.gov.hk/tc/business/tech_promotion/ccli/terms/doc/hkscs-2008-big5-iso.txt
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.opensource.org/licenses/bsd-license.php
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.opensource.org/licenses/mit-license.html
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.ploscompbiol.org/static/license
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.polymer-project.org
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.pylint.org/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.quirksmode.org/blog/archives/2008/04/delegating_the.html
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.quirksmode.org/blog/archives/2010/09/click_event_del.html
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.quirksmode.org/dom/events/scroll.html
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.quirksmode.org/dom/events/tests/scroll.html
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.quirksmode.org/js/events_properties.html
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.squid-cache.org/Doc/config/half_closed_clients/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.strongtalk.org/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.suitable.com
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.suitable.com/tools/smslib.html
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.suitable.com/tools/smslib.html>
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.thespanner.co.uk/2007/11/26/ultimate-xss-css-injection/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.unicode.org/Public/MAPPINGS/OBSOLETE/EASTASIA/OTHER/BIG5.TXT)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WINDOWS/CP950.TXT
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1841978948.0000000005CB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.unicode.org/copyright.html
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.unicode.org/copyright.html.
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.webmproject.org/code/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.webrtc.org
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.000000000777B000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.0000000007665000.00000004.00001000.00020000.00000000.sdmp, zentaoclient.exe, 00000005.00000000.2033367173.00007FF775344000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/abs-capture-time
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.0000000007665000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/abs-capture-timeurn:3gpp:video-orientationhttp://www.we
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.000000000777B000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.0000000007665000.00000004.00001000.00020000.00000000.sdmp, zentaoclient.exe, 00000005.00000000.2033367173.00007FF775344000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.000000000777B000.00000004.00001000.00020000.00000000.sdmp, zentaoclient.exe, 00000005.00000000.2033367173.00007FF775344000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/abs-send-timehttp://www.ietf.org/id/draft-holmer-rmcat-
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.000000000777B000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.0000000007665000.00000004.00001000.00020000.00000000.sdmp, zentaoclient.exe, 00000005.00000000.2033367173.00007FF775344000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/color-space
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.000000000777B000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.0000000007665000.00000004.00001000.00020000.00000000.sdmp, zentaoclient.exe, 00000005.00000000.2033367173.00007FF775344000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/generic-frame-descriptor-00
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.000000000777B000.00000004.00001000.00020000.00000000.sdmp, zentaoclient.exe, 00000005.00000000.2033367173.00007FF775344000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/inband-cn
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.000000000777B000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.0000000007665000.00000004.00001000.00020000.00000000.sdmp, zentaoclient.exe, 00000005.00000000.2033367173.00007FF775344000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/playout-delay
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.000000000777B000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.0000000007665000.00000004.00001000.00020000.00000000.sdmp, zentaoclient.exe, 00000005.00000000.2033367173.00007FF775344000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/transport-wide-cc-02
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.000000000777B000.00000004.00001000.00020000.00000000.sdmp, zentaoclient.exe, 00000005.00000000.2033367173.00007FF775344000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/transport-wide-cc-02http://www.webrtc.org/experiments/r
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.000000000777B000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.0000000007665000.00000004.00001000.00020000.00000000.sdmp, zentaoclient.exe, 00000005.00000000.2033367173.00007FF775344000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/video-content-type
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.000000000777B000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.0000000007665000.00000004.00001000.00020000.00000000.sdmp, zentaoclient.exe, 00000005.00000000.2033367173.00007FF775344000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/video-frame-tracking-id
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.000000000777B000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.0000000007665000.00000004.00001000.00020000.00000000.sdmp, zentaoclient.exe, 00000005.00000000.2033367173.00007FF775344000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/video-layers-allocation00
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.000000000777B000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.0000000007665000.00000004.00001000.00020000.00000000.sdmp, zentaoclient.exe, 00000005.00000000.2033367173.00007FF775344000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/video-timing
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.whatwg.org/specs/web-apps/current-work/multipage/parsing.html#preprocessing-the-input-str
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.whatwg.org/specs/web-apps/current-work/multipage/the-input-element.html#input-type-attr-s
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.whatwg.org/specs/web-apps/current-work/multipage/tokenization.html#appropriate-end-tag-to
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.whatwg.org/specs/web-apps/current-work/multipage/tokenization.html#tokenizing-character-r
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.whatwg.org/specs/web-apps/current-work/multipage/tree-construction.html#adoptionAgency)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www8.plala.or.jp/tkubota1/unicode-symbols-map2.html
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.0000000007665000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://xmlsoft.org/XSLT/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.0000000007665000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://xmlsoft.org/XSLT/namespace
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.0000000007665000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://xmlsoft.org/XSLT/namespacehttp://www.jclark.com/xtxsl:key
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.0000000007665000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://xmlsoft.org/XSLT/xsltNewExtDef
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://zlib.net/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.000000000777B000.00000004.00001000.00020000.00000000.sdmp, zentaoclient.exe, 00000005.00000000.2033367173.00007FF775344000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: https://android.com/pay
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://android.googlesource.com/platform/external/setupdesign/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/4674
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/4849
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/5140
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.000000000777B000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.0000000007665000.00000004.00001000.00020000.00000000.sdmp, zentaoclient.exe, 00000005.00000000.2033367173.00007FF775344000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: https://aomediacodec.github.io/av1-rtp-spec/#dependency-descriptor-rtp-header-extension
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/add/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/addBack/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/addClass/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/after/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/append/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/appendTo/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/before/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/children/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/clone/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/closest/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/contents/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/each/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/empty/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/end/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/eq/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/find/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/first/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/has/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/hasClass/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/index/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/insertAfter/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/insertBefore/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/is/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/jQuery.contains/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/jQuery.merge/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/last/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/map/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/next/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/nextAll/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/nextUntil/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/not/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/parent/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/parents/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/parentsUntil/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/prepend/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/prependTo/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/prev/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/prevAll/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/prevUntil/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/remove/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/removeAttr/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/removeClass/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/replaceWith/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/serialize/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/serializeArray/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/siblings/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/slice/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/toggleClass/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/unwrap/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/wrap/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/wrapAll/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.jquery.com/wrapInner/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://badge.fury.io/js/socket.io-client.svg)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000075F4000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.0000000007665000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://beacons.gcp.gvt2.com/domainreliability/upload
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.0000000007665000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://beacons.gcp.gvt2.com/domainreliability/uploadhttps://beacons.gvt2.com/domainreliability/uplo
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000075F4000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.0000000007665000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://beacons.gvt2.com/domainreliability/upload
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000075F4000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.0000000007665000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://beacons2.gvt2.com/domainreliability/upload
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000075F4000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.0000000007665000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://beacons3.gvt2.com/domainreliability/upload
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000075F4000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.0000000007665000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://beacons4.gvt2.com/domainreliability/upload
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000075F4000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.0000000007665000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://beacons5.gvt2.com/domainreliability/upload
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000075F4000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.0000000007665000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://beacons5.gvt3.com/domainreliability/upload
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://beautifier.io/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.000000000777B000.00000004.00001000.00020000.00000000.sdmp, zentaoclient.exe, 00000005.00000000.2033367173.00007FF775344000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: https://bit.ly/audio-worklet)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.000000000777B000.00000004.00001000.00020000.00000000.sdmp, zentaoclient.exe, 00000005.00000000.2033367173.00007FF775344000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: https://bit.ly/audio-worklet)ScriptProcessorHandler::ProcessScriptProcessorHandler::Process
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://bitbucket.org/gutworth/six/commits/tag/1.10.0
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.htmlaudio
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://blogs.office.com/2013/04/17/outlook-com-gets-two-step-verification-sign-in-by-alias-and-new-
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=378607
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=449857
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=470258
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=589347
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=608416
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://bugs.chromium.org/p/v8/issues/detail?id=10704
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://bugs.chromium.org/p/v8/issues/detail?id=3056
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://bugs.chromium.org/p/v8/issues/detail?id=4118
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://bugs.chromium.org/p/v8/issues/detail?id=6593
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1925344352.0000000007517000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://bugs.freedesktop.org/enter_bug.cgi?product=Mesa
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://bugs.jquery.com/ticket/12359
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://bugs.jquery.com/ticket/13378
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://bugs.jquery.com/ticket/13393
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://bugs.jquery.com/ticket/4833
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=136851
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=137337
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=29084
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1276240
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=162431
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=208427
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=310299
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=687787
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=745678
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=912470#c31
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000075F4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://c.android.clients.google.com/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000075F4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://c.bigcache.googleapis.com/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000075F4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://c.doc-0-0-sj.sj.googleusercontent.com/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000075F4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://c.docs.google.com/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000075F4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://c.drive.google.com/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000075F4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://c.googlesyndication.com/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000075F4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://c.pack.google.com/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000075F4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://c.play.google.com/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000075F4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://c.youtube.com/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://cheerio.js.org#loading
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://cheerio.js.org/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006CE0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006CE0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstorehttps://clients2.google.com/service/update2/crx/detail/sb-ssl.goog
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006DBC000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://chromestatus.com/feature/4735925877735424
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006DBC000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://chromestatus.com/feature/5436853517811712
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://chromium.googlesource.com/angle/angle/
Source: zentaoclient.exe, 00000005.00000000.2033367173.00007FF775344000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: https://chromium.googlesource.com/chromium/src/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://chromium.googlesource.com/vulkan-deps/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000075F4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000075F4000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.0000000007665000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/domainreliability/upload
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006CE0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://code.google.com/p/chromium/issues/detail?id=25916
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://code.google.com/p/chromium/issues/detail?id=355103
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://code.google.com/p/sctp-refimpl/source/browse/trunk/COPYRIGHT)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://console.spec.whatwg.org/#clear
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://console.spec.whatwg.org/#console-namespace
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://console.spec.whatwg.org/#count
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://console.spec.whatwg.org/#count-map
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://console.spec.whatwg.org/#countreset
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://console.spec.whatwg.org/#table
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/1042393
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/1046462
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.000000000777B000.00000004.00001000.00020000.00000000.sdmp, zentaoclient.exe, 00000005.00000000.2033367173.00007FF775344000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: https://crbug.com/1053756
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.000000000777B000.00000004.00001000.00020000.00000000.sdmp, zentaoclient.exe, 00000005.00000000.2033367173.00007FF775344000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: https://crbug.com/1053756ICE
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/1091824
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/1137851
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.000000000777B000.00000004.00001000.00020000.00000000.sdmp, zentaoclient.exe, 00000005.00000000.2033367173.00007FF775344000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: https://crbug.com/1144908
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.000000000777B000.00000004.00001000.00020000.00000000.sdmp, zentaoclient.exe, 00000005.00000000.2033367173.00007FF775344000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: https://crbug.com/1144908.
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.000000000777B000.00000004.00001000.00020000.00000000.sdmp, zentaoclient.exe, 00000005.00000000.2033367173.00007FF775344000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: https://crbug.com/1144908.The
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.000000000777B000.00000004.00001000.00020000.00000000.sdmp, zentaoclient.exe, 00000005.00000000.2033367173.00007FF775344000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: https://crbug.com/1144908Changing
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000075F4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/1154140
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/593024
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/593024select_view_in_geometry_shaderThe
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/650547
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/650547call_clear_twiceUsing
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/655534
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/655534use_system_memory_for_constant_buffersCopying
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/705865
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/710443
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/811661
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.000000000777B000.00000004.00001000.00020000.00000000.sdmp, zentaoclient.exe, 00000005.00000000.2033367173.00007FF775344000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: https://crbug.com/824383
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.0000000007665000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/824647
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/882238.
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000075F4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/927119
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000075F4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/927119../../third_party/blink/renderer/core/script/script_loader.ccPrepareScriptEx
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/954323
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/981419
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/v8/7848
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://creativecommons.org/licenses/by-sa/4.0/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://creativecommons.org/licenses/by/3.0/
Source: zentaoclient.exe, 00000005.00000000.2033367173.00007FF774CAC000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: https://cs.chromium.org/chromium/src/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://cs.chromium.org/chromium/src/v8/tools/SourceMap.js?rcl=dd10454c1d
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.0000000007665000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://datatracker.ietf.org/doc/draft-ietf-rtcweb-ip-handling.
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://david-dm.org/socketio/socket.io-client#info=devDependencies)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://david-dm.org/socketio/socket.io-client)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://david-dm.org/socketio/socket.io-client.svg)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://david-dm.org/socketio/socket.io-client/dev-status.svg)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://dawn.googlesource.com/tint
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://dejavu-fonts.github.io/Download.html
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006DBC000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developer.chrome.com/blog/enabling-shared-array-buffer/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Object/assign)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/CSS/display
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/JavaScript/Reference/Global_Objects/String/fromCharCode#Get
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/SpiderMonkey/Parser_API
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Tools/Web_Console#Styling_messages
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/AnimationEvent
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/KeyboardEvent#Key_names
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/Node/innerText
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/Node/textContent
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/TransitionEvent
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/CSS/At-rule
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/HTML/Block-level_elements
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/HTML/Element/isindex
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/HTML/Inline_elements
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Equality_comparisons_and_sameness#Loose_equa
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions#Escaping
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Map#Key_equality)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/is
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/is).
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developers.google.com/android/guides/setup
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006DBC000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developers.google.com/web/updates/2016/08/removing-document-write
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006DBC000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developers.google.com/web/updates/2016/08/removing-document-writeDocument.writewritelnDocume
Source: zentaoclient.exe, 00000005.00000000.2033367173.00007FF774CAC000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: https://developers.google.com/web/updates/2019/07/web-components-time-to-upgrade
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://discord.gg/electron
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000075F4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/library/functions.html#range).
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://drafts.csswg.org/cssom/#common-serializing-idioms
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://drafts.csswg.org/cssom/#resolved-values
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://electronjs.org
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://encoding.spec.whatwg.org
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://encoding.spec.whatwg.org/#textdecoder
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://encoding.spec.whatwg.org/#textencoder
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://esdiscuss.org/topic/isconstructor#content-11
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://eslint.org/docs/rules/no-buffer-constructor)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://facebook.github.com/immutable-js
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://facebook.github.io/react/docs/top-level-api.html#react.children.count
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://facebook.github.io/react/docs/top-level-api.html#react.children.foreach
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://facebook.github.io/react/docs/top-level-api.html#react.children.map
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://facebook.github.io/react/docs/top-level-api.html#react.children.only
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://facebook.github.io/react/docs/top-level-api.html#react.children.toarray
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://facebook.github.io/react/docs/top-level-api.html#react.cloneelement
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://facebook.github.io/react/docs/top-level-api.html#react.createclass
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://facebook.github.io/react/docs/top-level-api.html#react.createelement
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://facebook.github.io/react/docs/top-level-api.html#react.createfactory
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://facebook.github.io/react/docs/top-level-api.html#react.isvalidelement
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://facebook.github.io/react/docs/top-level-api.html#reactdom.finddomnode
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://facebook.github.io/react/docs/top-level-api.html#reactdom.render
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://facebook.github.io/react/docs/top-level-api.html#reactdom.unmountcomponentatnode
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://fb.me/react-controlled-components
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://fb.me/react-devtools
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://fb.me/react-event-pooling
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://fb.me/react-invariant-dangerously-set-inner-html
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://fb.me/react-legacyfactory
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://fb.me/react-minification
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://fb.me/react-refs-must-have-owner).
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://fb.me/react-special-props)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://fb.me/react-spread-deprecation
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://fb.me/react-unknown-prop%s
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://fb.me/react-warning-dont-call-proptypes
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://fb.me/react-warning-keys
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://fb.me/react-warning-polyfills
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000075F4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://gcp.gvt2.com/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000075F4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://gcp.gvt6.com/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://gist.github.com/1782808).
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://gist.github.com/XVilka/8346728#gistcomment-2823421
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/Automattic/engine.io-client/pull/217
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/Automattic/has-binary/pull/4
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/Automattic/socket.io-client#readme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/Automattic/socket.io-client.git
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/Automattic/socket.io-parser#readme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/Automattic/socket.io-parser.git
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/ChALkeR
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/ChALkeR/safer-buffer#readme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/ChALkeR/safer-buffer.git
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/Cyan4973/xxHash
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/FB55/domelementtype#readme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/FB55/domutils#readme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/GPUOpen-LibrariesAndSDKs/VulkanMemoryAllocator
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/GoogleChromeLabs/pywebsocket3/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/GoogleChromeLabs/text-fragments-polyfill
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/KhronosGroup/SPIRV-Cross
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/KhronosGroup/SPIRV-Headers.git
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/KhronosGroup/SPIRV-Tools.git
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/KhronosGroup/Vulkan-Headers
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/KhronosGroup/Vulkan-Loader
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/MarshallOfSound/react-electron-web-view
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/MarshallOfSound/react-electron-web-view.git
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/Microsoft/tslib.git
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/Modernizr/Modernizr/blob/master/feature-detects/cors.js
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/NobleJS/setImmediate
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/NobleJS/setImmediate))
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/Qix-/color-convert#readme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/Qix-/color-convert.git
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/Qix-/color-convert/blob/3f0e0d4e92e235796ccb17f6e85c72094a651f49/conversions.js
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/Raynos/after#readme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/Raynos/to-array
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/STRML/async-limiter
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/WICG/construct-stylesheets/issues/119#issuecomment-588352418.
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.000000000777B000.00000004.00001000.00020000.00000000.sdmp, zentaoclient.exe, 00000005.00000000.2033367173.00007FF775344000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: https://github.com/WebBluetoothCG/web-bluetooth/blob/gh-pages/implementation-status.md
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.000000000777B000.00000004.00001000.00020000.00000000.sdmp, zentaoclient.exe, 00000005.00000000.2033367173.00007FF775344000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: https://github.com/WebBluetoothCG/web-bluetooth/blob/gh-pages/implementation-status.mdBluetoothEithe
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/aawc/unrar.git
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/acornjs/acorn/blob/master/acorn/src/identifier.js#L23
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/acornjs/acorn/issues/575
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/amdjs/amdjs-api/wiki/AMD#defineamd-property-
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/antirez/linenoise
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/ariya/phantomjs/issues/11395
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/ashtuchkin/iconv-lite
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/ashtuchkin/iconv-lite/wiki/Javascript-source-file-encodings
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/ashtuchkin/iconv-lite/wiki/Node-v4-compatibility
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/ashtuchkin/iconv-lite/wiki/Use-Buffers-when-decoding
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/benjamingr/RegExp.escape/blob/main/polyfill.js
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/chalk/ansi-regex#readme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/chalk/ansi-regex.git
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/chalk/ansi-regex/blob/master/index.js
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/chalk/ansi-styles#readme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/chalk/ansi-styles.git
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/chalk/ansi-styles?sponsor=1
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/chalk/chalk#readme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/chalk/chalk.git
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/chalk/chalk/pull/92
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/chalk/chalk?sponsor=1
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/chalk/supports-color
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/chalk/supports-color#readme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/chalk/supports-color.git
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/chalker/safer-buffer#why-not-safe-buffer)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/chalker/safer-buffer#why-not-safe-buffer).
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/cheeriojs/cheerio-select#readme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/cheeriojs/cheerio?sponsor=1
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/cheeriojs/dom-renderer#readme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/cheeriojs/dom-serializer?sponsor=1
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/chriso/validator.js
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/chriso/validator.js.git
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/colorjs/color-name
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/component/bind#readme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/component/bind.git
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/component/emitter#readme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/component/emitter.git
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/component/has-cors#readme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/component/inherit#readme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/component/inherit.git
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/da-x/rxvt-unicode/tree/v9.22-with-24bit-color
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/darrachequesne/has-binary/commit/27165d2))
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/darrachequesne/has-binary/commit/2a7b25c))
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/darrachequesne/has-binary/commit/3e88e81))
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/darrachequesne/has-binary/commit/518747d))
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/darrachequesne/has-binary/commit/91aa21e))
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/darrachequesne/has-binary/commit/f9be9b3))
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/darrachequesne/has-binary/compare/0.1.5...0.1.6)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/darrachequesne/has-binary/compare/0.1.6...0.1.7)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/darrachequesne/has-binary/compare/0.1.7...1.0.0)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/darrachequesne/has-binary/compare/1.0.0...1.0.1)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/darrachequesne/has-binary/compare/1.0.1...1.0.2)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/darrachequesne/has-binary/compare/1.0.2...1.0.3)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/darrachequesne/has-binary/issues/3))
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/darrachequesne/has-binary/issues/4))
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/darrachequesne/has-binary/issues/6))
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/darrachequesne/has-binary/issues/7))
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/dominictarr/config-chain.git
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/dpranke/pyjson5
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/dustingetz
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/editorconfig/editorconfig-core-js#readme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/electron/electron/issues
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006CE0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/electron/electron/issues/18397.
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006CE0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/electron/electron/issues/18397.Loading
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006CE0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/electron/electron/issues/18397.Module
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/electron/electron/tree/v$
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/estree/estree/blob/a27003adf4fd7bfad44de9cef372a2eacd527b1c/es5.md#regexpliteral
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/facebook/flow/blob/master/lib/core.js
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/facebook/immutable-js
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/facebook/jest#readme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/facebook/jest.git
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/facebook/react-native/pull/1632
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/facebook/react.git
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/facebook/react/issues/1698
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/facebook/react/issues/3236).
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/facebook/react/issues/6887
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/facebook/react/issues/708.
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/facebook/react/issues/7233
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/facebook/react/issues/7240
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/facebook/react/pull/6896
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/facebook/react/pull/7101
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/facebook/react/pull/7178
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/facebook/react/pull/7232
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/fb55/DomHandler#readme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/fb55/boolbase
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/fb55/boolbase)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/fb55/boolbase.git
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/fb55/css-select#readme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/fb55/css-select/pull/43#issuecomment-225414692
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/fb55/css-what#readme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/fb55/css-what.git
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/fb55/domelementtype#readme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/fb55/domhandler#readme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/fb55/domhandler?sponsor=1
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/fb55/domutils#readme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/fb55/domutils?sponsor=1
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/fb55/entities#readme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/fb55/entities?sponsor=1
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/fb55/htmlparser2#readme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/fb55/htmlparser2?sponsor=1
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/fb55/nth-check
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/fb55/nth-check.git
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/fb55/nth-check?sponsor=1
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/get/parseuri
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/get/parseuri.git
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/get/querystring
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/get/querystring.git
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/gimdongwoo)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/caja/blob/master/src/com/google/caja/ses/repairES5.js
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/caja/blob/master/src/com/google/caja/ses/startSES.js
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/closure-compiler/wiki/Source-Maps
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/desugar_jdk_libs
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/google-api-cpp-client/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/private-join-and-compute
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/protobuf
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/re2
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/ruy
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/securemessage
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/shaderc
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/shell-encryption
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/ukey2
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/woff2
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/wuffs
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/gotwarlost/istanbul/blob/master/ignoring-code-for-coverage.md#ignoring-code-for-c
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/inikulin
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/inikulin)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/inikulin/parse5
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/inikulin/parse5/issues/97#issuecomment-171940774)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/inikulin/parse5/tree/master/scripts/generate-named-entity-data/README.md)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/inikulin/parse5/tree/master/scripts/generate_named_entity_data/README.md
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/inikulin/parse5/tree/master/scripts/generate_named_entity_data/README.md)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/isaacs/abbrev-js#readme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/isaacs/color-support.
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/isaacs/fs.realpath#readme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/isaacs/fs.realpath.git
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/isaacs/inflight
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/isaacs/inherits#readme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/isaacs/ini#readme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/isaacs/minimatch#readme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/isaacs/node-glob#readme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/isaacs/node-glob/issues/167
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/isaacs/node-glob/issues/205
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/isaacs/node-lru-cache#readme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/isaacs/once#readme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/isaacs/proto-list#readme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/isaacs/proto-list.git
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/isaacs/pseudomap#readme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/isaacs/pseudomap.git
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/isaacs/sigmund#readme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/isaacs/yallist#readme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/isaacs/yallist.git
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/joyeecheung/node-dep-codemod#dep005)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/joyent/node/issues/3295.
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/jquery/jquery.git
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/jquery/jquery/blob/2.1.3/src/manipulation/var/rcheckableType.js
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/jquery/jquery/blob/2.1.3/src/serialize.js
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/jquery/jquery/blob/3.6.0/AUTHORS.txt
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/jquery/jquery/pull/557)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/jquery/sizzle
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/jquery/sizzle/blob/master/src/sizzle.js#L139
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/jquery/sizzle/blob/master/src/sizzle.js#L152
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/jquery/sizzle/blob/master/src/sizzle.js#L87
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/jquery/sizzle/pull/225
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/jrburke/requirejs/wiki/Updating-existing-libraries#wiki-anon
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/jrmuizel/qcms/tree/v4
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/jsdevkr/react-chatview#readme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/jsdevkr/react-chatview.git
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/juliangruber/balanced-match
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/juliangruber/brace-expansion
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/juliangruber/isarray
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/kriskowal
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/kriskowal/q
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/kriskowal/q/blob/v1/LICENSE
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/kriskowal/q/wiki/API-Reference
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/leebyron
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/libuv/libuv/pull/1501.
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/lodash/lodash
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/lodash/lodash.git
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/mafintosh/end-of-stream
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/mafintosh/pump
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/marijnh/acorn.git
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/mathiasbynens/he/blob/master/src/he.js#L94-L119
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/mishoo/UglifyJS2/blob/v2.4.20/lib/parse.js#L216
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/mjwwit/node-XMLHttpRequest#readme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/mokesmokes/backo#readme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/mokesmokes/backo.git
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/mysticatea/eslint-plugin-node/blob/master/docs/rules/no-deprecated-api.md)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/niklasvh/base64-arraybuffer
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/niklasvh/base64-arraybuffer.git
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/niklasvh/base64-arraybuffer/blob/master/LICENSE-MIT
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/Release#release-schedule)).
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node-v0.x-archive/issues/2876.
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/blob/b3fcc245fb25539909ef1d5eaa01dbf92e168633/lib/path.js#L56
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/commit/ec2822adaad76b126b5cccdeaa1addf2376c9aa6
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/commit/f7620fb96d339f704932f9bb9a0dceb9952df2d4
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/10673
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/13435
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/19009
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/2006
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/2119
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/32020
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/3392
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/35475
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/35981
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/8871#issuecomment-250915913
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/issues/9006
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/12342
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/12607
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/13870#discussion_r124515293
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/1771#issuecomment-119351671
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/21313
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/26334.
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/30380#issuecomment-552948364
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/30958
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/33661
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/3394
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/34010
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/34103#issuecomment-652002364
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/nodejs/node/pull/34375
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/npm/inflight.git
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/npm/node-semver#readme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/npm/node-semver.git
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/npm/nopt#readme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/npm/nopt.git
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/npm/wrappy
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/npm/wrappy.git
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/promises-aplus/promises-tests
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/protocolbuffers/protobuf/blob/master/java/lite.md
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/rase-/arraybuffer.slice
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/simplejson/simplejson
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/sindresorhus/has-flag#readme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/sindresorhus/has-flag.git
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/sindresorhus/path-is-absolute#readme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/sindresorhus/path-is-absolute.git
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/slevithan/xregexp/blob/95eeebeb8fac8754d54eafe2b4743661ac1cf028/src/xregexp.js#L7
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/socketio/engine.io-client
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/socketio/engine.io-client.git
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/socketio/engine.io-parser
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/socketio/socket.io-client/actions)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/socketio/socket.io-client/workflows/CI/badge.svg)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/spicyj/innerhtml-vs-createelement-vs-clonenode.
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/sponsors/fb55
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/sponsors/isaacs
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/standard-things/esm/issues/821.
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/stiang/remove-markdown
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/stiang/remove-markdown.git
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/substack/node-concat-map#readme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/tc39/ecma262/issues/1209
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/tc39/proposal-ses/blob/e5271cc42a257a05dcae2fd94713ed2f46c08620/shim/src/freeze.j
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/tensorflow/tensorflow
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/tensorflow/text.git
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/tensorflow/tflite-support
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/tj/commander.js#readme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/tj/commander.js.git
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/unshiftio/yeast
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/unshiftio/yeast.git
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/v8/v8/blob/d6ead37d265d7215cf9c5f768f279e21bd170212/src/js/prologue.js#L152-L156
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/visionmedia/debug#readme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/w3c/ServiceWorker/issues/1356.
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.0000000007665000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/w3c/gamepad/pull/112
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.0000000007665000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/w3c/gamepad/pull/120
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.0000000007665000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/w3c/gamepad/pull/120Access
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.0000000007665000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/w3c/webappsec-permissions-policy/blob/master/features.md#sensor-features
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000006FA1000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/w3c/webappsec-trusted-types/wiki/Trusted-Types-for-function-constructor
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/web-animations/web-animations-js
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/webmodules/blob
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/websockets/ws
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/websockets/ws.git
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/websockets/ws/issues/1202
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/websockets/ws/issues/1869.
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/whatwg/html/issues/2369
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/whatwg/html/pull/907/files#r73505877
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/xiph/rnnoise
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/yujiosaka/socke.io-ie8-loading-example
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/zeit/ms#readme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/zeit/ms.git
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/zulhilmizainuddin/nodejs-traceroute#readme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/zulhilmizainuddin/nodejs-traceroute.git
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://gitlab.freedesktop.org/wayland/weston
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://gitlab.freedesktop.org/xdg/xdgmime
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://gitlab.freedesktop.org/xorg/proto/xproto/
Source: zentaoclient.exe, 00000005.00000000.2033367173.00007FF775344000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: https://goo.gl/4NeimX
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.0000000007665000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://goo.gl/7K7WLu
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.0000000007665000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://goo.gl/7K7WLuThe
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.0000000007665000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://goo.gl/7K7WLuWebAudio.AutoplayWebAudio.Autoplay.CrossOriginWebAudio.Autoplay.UnlockType../..
Source: zentaoclient.exe, 00000005.00000000.2033367173.00007FF775344000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: https://goo.gl/EuHzyv
Source: zentaoclient.exe, 00000005.00000000.2033367173.00007FF775344000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: https://goo.gl/HxfxSQ
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.000000000777B000.00000004.00001000.00020000.00000000.sdmp, zentaoclient.exe, 00000005.00000000.2033367173.00007FF775344000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: https://goo.gl/J6ASzs
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://goo.gl/LdLk22
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://goo.gl/LdLk22Empty
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://goo.gl/LdLk22Failed
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006C9A000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://goo.gl/Y0ZkNV).
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.0000000007665000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://goo.gl/rStTGz
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://goo.gl/t5IS6M).
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000075F4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://goo.gl/xX8pDD
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000075F4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://goo.gl/xX8pDDplay()
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000075F4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://goo.gl/ximf56
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000075F4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://goo.gl/ximf56Iframe
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000075F4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://google-analytics.com/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.000000000777B000.00000004.00001000.00020000.00000000.sdmp, zentaoclient.exe, 00000005.00000000.2033367173.00007FF775344000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: https://google.com/pay
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.000000000777B000.00000004.00001000.00020000.00000000.sdmp, zentaoclient.exe, 00000005.00000000.2033367173.00007FF775344000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: https://google.com/payhttps://android.com/paysecure-payment-confirmationAppStoreBillingPlaceHolderZZ
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000075F4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://googlevideo.com/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000075F4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://gvt1.com/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000075F4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://gvt2.com/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000075F4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://gvt6.com/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://heycam.github.io/webidl/#define-the-operations
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://heycam.github.io/webidl/#dfn-class-string
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://heycam.github.io/webidl/#dfn-default-iterator-object
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://heycam.github.io/webidl/#dfn-iterator-prototype-object
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://heycam.github.io/webidl/#es-interfaces
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://heycam.github.io/webidl/#es-iterable
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://heycam.github.io/webidl/#es-iterable-entries
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://heycam.github.io/webidl/#es-iterators
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://heycam.github.io/webidl/#es-namespaces
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://heycam.github.io/webidl/#es-operations
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://heycam.github.io/webidl/#es-stringifier
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/#nonce-attributes
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/#read-text
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/#strip-and-collapse-whitespace
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/browsers.html#ascii-serialisation-of-an-origin
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-opaque
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/comms.html#the-websocket-interface
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/form-elements.html#concept-option-selectedness
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/forms.html#category-listed
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/forms.html#concept-fe-disabled
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/forms.html#concept-option-disabled
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/microdata.html#microdata-dom-api
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/parsing.html#parsing-main-inforeign
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/scripting.html#disabled-elements
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/scripting.html#selector-disabled
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/scripting.html#selector-enabled
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/semantics-other.html#case-sensitivity-of-selectors
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/semantics.html#the-html-element
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/syntax.html#attributes-2
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/syntax.html#generate-implied-end-tags
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/syntax.html#has-an-element-in-button-scope
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/syntax.html#has-an-element-in-scope
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/syntax.html#html-integration-point
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-inbody
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-incaption
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-incolgroup
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-inhead
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-inselect
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-intable
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-intbody
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-intd
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-intr
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/syntax.html#special
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/syntax.html#tag-name-state
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/syntax.html#tag-open-state
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/timers-and-user-prompts.html#dom-setinterval
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/webappapis.html#windoworworkerglobalscope
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://infra.spec.whatwg.org/#strip-and-collapse-ascii-whitespace
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://invisible-island.net/ncurses/terminfo.ti.html#toc-_Specials
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://invisible-island.net/xterm/ctlseqs/ctlseqs.html
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/161903006
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/166809097
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://jquery.com
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://jquery.com/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://jquery.org/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://jquery.org/license
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://js.foundation/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://jsoneditoronline.org
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://jsperf.com/getall-vs-sizzle/2
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://jsperf.com/object-keys-vs-for-in-with-closure/3
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://jsperf.com/thor-indexof-vs-for/5
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://linux.die.net/man/1/dircolors).
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://lodash.com/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://lodash.com/icon.svg
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://lodash.com/license
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://mathiasbynens.be/notes/javascript-encoding
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://mathiasbynens.be/notes/javascript-unicode).
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://mdn.io/Structured_clone_algorithm)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://mths.be/punycode
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://mths.be/utf8js
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://no-color.org/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://nodejs.org/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://nodejs.org/api/cli.html#cli_unhandled_rejections_mode).
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://nodejs.org/api/fs.html
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://nodejs.org/api/stream.html#stream_decoding_buffers_in_a_writable_stream
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.000000000700A000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://nodejs.org/download/release/v14.16.0/node-v14.16.0-headers.tar.gz
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.000000000700A000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://nodejs.org/download/release/v14.16.0/node-v14.16.0.tar.gz
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.000000000700A000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://nodejs.org/download/release/v14.16.0/node-v14.16.0.tar.gzhttps://nodejs.org/download/release
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.000000000700A000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://nodejs.org/download/release/v14.16.0/win-x64/node.lib
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://nodejs.org/en/docs/inspector
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://nodejs.org/en/docs/inspectorFor
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://nodejs.org/static/images/favicons/favicon.ico
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://nodejs.org/static/images/favicons/favicon.icofaviconUrldevtoolsFrontendUrldevtoolsFrontendUr
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://npmjs.org/package/iniparser
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://npmjs.org/package/minimatch
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://openjsf.org/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://pagure.io/lohit
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://people.mozilla.org/~jorendorff/es6-draft.html#sec-tolength
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.000000000777B000.00000004.00001000.00020000.00000000.sdmp, zentaoclient.exe, 00000005.00000000.2033367173.00007FF775344000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: https://play.google.com/billing
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.000000000777B000.00000004.00001000.00020000.00000000.sdmp, zentaoclient.exe, 00000005.00000000.2033367173.00007FF775344000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: https://play.google.com/billingQuota
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://ponyfill.com/)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://promisesaplus.com/#point-48
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://promisesaplus.com/#point-54
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://promisesaplus.com/#point-57
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://promisesaplus.com/#point-59
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://promisesaplus.com/#point-61
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://promisesaplus.com/#point-64
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://promisesaplus.com/#point-75
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://quiche.googlesource.com/quiche
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://raw.githubusercontent.com/dominictarr/config-chain/master/LICENCE
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://reactjs.org/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000002.2053376524.000000000041E000.00000004.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1925344352.0000000007517000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1895509910.0000000003300000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1968503333.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1968762380.0000000005C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sectigo.com/CPS0
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://secure.travis-ci.org/substack/node-concat-map.png)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://semver.org/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1871345709.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sindresorhus.com
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sites.google.com/site/gaviotachessengine/Home/endgame-tablebases-1
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sizzlejs.com/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://skia.org/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/project/?group_id=1519
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sourceforge.net/projects/wtl/files/WTL%2010/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sourcemaps.info/spec.html
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sqlite.org/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000075F4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://ssl.gstatic.com/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/a/5501711/3561
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://swiftshader.googlesource.com/SwiftShader
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tc39.es/ecma262/#sec-IsHTMLDDA-internal-slot
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tc39.github.io/ecma262/#sec-%iteratorprototype%-object
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tc39.github.io/ecma262/#sec-%typedarray%.of
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tc39.github.io/ecma262/#sec-object.prototype.tostring
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc2045
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc2046
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc2152
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc2397#section-2
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc2822#appendix-A.1.2
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc3339#section-5.6
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc3492#section-3.4
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006C12000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc3492)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc3986#section-3.2.2
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc4007#section-11
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006CE0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc5280#section-4.2.1.13
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006CE0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc5280#section-5.2.7.
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc6455#section-9.1
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc6657).
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006CE0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc6960
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc7230#section-3.2.2
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc7230#section-3.2.6
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc7231#section-3.1.1.1
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc7231#section-3.1.1.5
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc7540#section-8.1.2.5
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://underscorejs.org
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://url.spec.whatwg.org/#cannot-have-a-username-password-port
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://url.spec.whatwg.org/#concept-url
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://url.spec.whatwg.org/#concept-url-origin
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://url.spec.whatwg.org/#concept-urlencoded-byte-serializer
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://url.spec.whatwg.org/#concept-urlencoded-parser
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://url.spec.whatwg.org/#concept-urlencoded-serializer
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://url.spec.whatwg.org/#special-scheme
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://url.spec.whatwg.org/#url
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://url.spec.whatwg.org/#urlsearchparams
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://url.spec.whatwg.org/#urlsearchparams-stringification-behavior
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.0000000007665000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://w3c.github.io/manifest/#installability-signals
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.0000000007665000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://w3c.github.io/manifest/#installability-signalsVideoFrameProviderClientImpl::StartRenderingVi
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://w3c.github.io/webappsec-subresource-integrity/#the-integrity-attribute
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://web.archive.org/web/20100324014747/http://blindsignals.com/index.php/2009/07/jquery-delay/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://web.archive.org/web/20141116233347/http://fluidproject.org/blog/2008/01/09/getting-setting-a
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006DBC000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://webrtc.org/web-apis/chrome/unified-plan/.
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://wiki.ecmascript.org/doku.php?id=harmony:egal).
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://wiki.squid-cache.org/SquidFaq/InnerWorkings#What_is_a_half-closed_filedescriptor.3F
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.000000000777B000.00000004.00001000.00020000.00000000.sdmp, zentaoclient.exe, 00000005.00000000.2033367173.00007FF775344000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: https://www.bluetooth.com/specifications/gatt/characteristics
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.000000000777B000.00000004.00001000.00020000.00000000.sdmp, zentaoclient.exe, 00000005.00000000.2033367173.00007FF775344000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: https://www.bluetooth.com/specifications/gatt/descriptors
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.000000000777B000.00000004.00001000.00020000.00000000.sdmp, zentaoclient.exe, 00000005.00000000.2033367173.00007FF775344000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: https://www.bluetooth.com/specifications/gatt/services
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000075F4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/feature/4664843055398912
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006DBC000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/feature/5082396709879808
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006DBC000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/feature/5082396709879808BeforeUnloadNoGestureBlocked
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006DBC000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/feature/5138066234671104
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006DBC000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/feature/5629582019395584.
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.0000000007665000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/feature/5636954674692096
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.000000000777B000.00000004.00001000.00020000.00000000.sdmp, zentaoclient.exe, 00000005.00000000.2033367173.00007FF775344000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: https://www.chromestatus.com/feature/5644273861001216.
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.000000000777B000.00000004.00001000.00020000.00000000.sdmp, zentaoclient.exe, 00000005.00000000.2033367173.00007FF775344000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: https://www.chromestatus.com/feature/5644273861001216.NavigatorVibrate../../third_party/blink/render
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006DBC000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/feature/5654791610957824
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.000000000777B000.00000004.00001000.00020000.00000000.sdmp, zentaoclient.exe, 00000005.00000000.2033367173.00007FF775344000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: https://www.chromestatus.com/feature/5682658461876224.
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.000000000777B000.00000004.00001000.00020000.00000000.sdmp, zentaoclient.exe, 00000005.00000000.2033367173.00007FF775344000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: https://www.chromestatus.com/feature/5682658461876224.Blocked
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006DBC000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/feature/5687444770914304
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006DBC000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/feature/5714245488476160
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.0000000007665000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/feature/5718547946799104
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006DBC000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/feature/5735596811091968
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/feature/5738264052891648
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/feature/5738264052891648DeprecationReportBody
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006DBC000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/feature/5745543795965952
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006DBC000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/feature/5745543795965952blinkAddEventListenerAdded
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006DBC000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/feature/5749447073988608
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006DBC000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/feature/5749447073988608Added
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006DBC000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/feature/6451284559265792
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006DBC000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/features/%s
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.0000000007665000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/features/5093566007214080
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.0000000007665000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/features/50935660072140800
Source: zentaoclient.exe, 00000005.00000000.2033367173.00007FF774CAC000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: https://www.chromestatus.com/features/5144752345317376
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006DBC000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/features/5637885046816768.
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006DBC000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/features/5654810086866944
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006DBC000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/features/5851021045661696.
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006DBC000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/features/5851021045661696.The
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006DBC000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/features/6107495151960064
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000075F4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/features/6662647093133312
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006DBC000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromestatus.com/features/6680566019653632
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006DBC000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromium.org/blink/origin-trials/portals.
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006DBC000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chromium.org/blink/origin-trials/portals.The
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.cl.cam.ac.uk/%7Emgk25/ucs/utf8_check.c
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1872487405.00000000066A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.computerhope.com/jargon/h/html-basefont-tag.htm
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/#sec-line-terminators
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/#sec-promise.all
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/#sec-timeclip
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/5.1/#sec-15.1.3.4
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Alternative
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Atom
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-CharacterClass
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-CharacterClassEscape
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-ClassAtom
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-ClassAtomNoDash
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-ClassRanges
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-ControlEscape
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-ControlLetter
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-DecimalDigits
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-DecimalEscape
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Disjunction
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Hex4Digits
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-HexDigit
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-HexDigits
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-HexEscapeSequence
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-NonemptyClassRanges
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-NonemptyClassRangesNoDash
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-OctalDigit
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Pattern
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-PatternCharacter
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Quantifier
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-QuantifierPrefix
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-RegExpUnicodeEscapeSequence
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-SyntaxCharacter
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-Assertion
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-AtomEscape
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-CharacterEscape
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ClassControlLetter
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ClassEscape
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ExtendedAtom
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ExtendedPatternCharacter
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-IdentityEscape
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-InvalidBracedQuantifier
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-LegacyOctalEscapeSequence
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-Term
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#sec-atomescape
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000074A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#sec-term
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.00000000075F4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.iana.org/assignments/media-types/media-types.xhtml)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.iana.org/assignments/tls-extensiontype-values
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.npmjs.com/package/buffer-alloc)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.npmjs.com/package/buffer-from)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.npmjs.com/package/safe-buffer)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.npmjs.com/package/safer-buffer)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.npmjs.com/package/socket.io-client)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1874475038.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.typescriptlang.org/
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.unicode.org/Public/UNIDATA/EastAsianWidth.txt
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1824499383.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.unicode.org/copyright.html.
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000002.2053376524.000000000041E000.00000004.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1925344352.0000000007517000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1895509910.0000000003300000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1968503333.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1968762380.0000000005C30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.zentao.net/0
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006DBC000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://xhr.spec.whatwg.org/.
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Code function: 0_2_00405461 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,FindCloseChangeNotification,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard, 0_2_00405461
Installs a raw input device (often for capturing keystrokes)
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971322469.00000000066A0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: GetRawInputData memstr_b2c9f445-0
Contains functionality to call native functions
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Code function: 0_2_030910D0 GetVersionExW,LoadLibraryW,GetProcAddress,LocalAlloc,LocalAlloc,NtQuerySystemInformation,LocalFree,LocalAlloc,FreeLibrary,lstrcpynW,lstrcmpiW,LocalFree,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,lstrlenW,lstrlenA,MultiByteToWideChar,lstrcmpiW,CloseHandle,FreeLibrary, 0_2_030910D0
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Code function: 0_2_0040338F EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_0040338F
Detected potential crypto function
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Code function: 0_2_00406B15 0_2_00406B15
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Code function: 0_2_004072EC 0_2_004072EC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Code function: 0_2_00404C9E 0_2_00404C9E
Enables security privileges
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Process token adjusted: Security Jump to behavior
PE file contains more sections than normal
Source: updater.win64.exe.0.dr Static PE information: Number of sections : 11 > 10
Source: zentaoclient.exe.0.dr Static PE information: Number of sections : 12 > 10
Sample file is different than original file name gathered from version info
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameQt5Gui.dll( vs SecuriteInfo.com.Heur.21832.3236.exe
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamelibGLESv2.dllb! vs SecuriteInfo.com.Heur.21832.3236.exe
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilename: vs SecuriteInfo.com.Heur.21832.3236.exe
Uses 32bit PE files
Source: SecuriteInfo.com.Heur.21832.3236.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: classification engine Classification label: clean5.winEXE@12/188@0/0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Code function: 0_2_0040338F EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_0040338F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Code function: 0_2_00404722 GetDlgItem,SetWindowTextW,SHAutoComplete,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceExW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, 0_2_00404722
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Code function: 0_2_00402104 CoCreateInstance, 0_2_00402104
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Local\Programs Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\AtomProcessSingletonStartup!
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Mutant created: NULL
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Mutant created: \Sessions\1\BaseNamedObjects\f3057352-10e3-53a8-8e7d-c7f226474698
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Local\Temp\nsk192.tmp Jump to behavior
Source: SecuriteInfo.com.Heur.21832.3236.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006DBC000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.0000000007665000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: SELECT name FROM sqlite_master WHERE type='table';
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006DBC000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006DBC000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006DBC000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006DBC000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006DBC000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File read: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe "C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe "C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe"
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process created: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe "C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe" --type=gpu-process --field-trial-handle=1604,15735583474717430825,16040306059436304636,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1612 /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process created: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe "C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1604,15735583474717430825,16040306059436304636,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-GB --service-sandbox-type=none --ignore-urlfetcher-cert-requests=true --ignore-certificate-errors=true --enable-experimental-web-platform-features --ignore-certificate-errors=true --mojo-platform-channel-handle=1976 /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process created: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe "C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe" --type=renderer --enable-experimental-web-platform-features --field-trial-handle=1604,15735583474717430825,16040306059436304636,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-GB --app-path="C:\Users\user\AppData\Local\Programs\zentaoclient\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2056 /prefetch:1
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process created: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe "C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe" --type=renderer --enable-experimental-web-platform-features --field-trial-handle=1604,15735583474717430825,16040306059436304636,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-compositing --lang=en-GB --app-user-model-id=com.cnezsoft.zentaoclient --app-path="C:\Users\user\AppData\Local\Programs\zentaoclient\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2336 /prefetch:1
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process created: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process created: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe "C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe" --type=gpu-process --field-trial-handle=1604,15735583474717430825,16040306059436304636,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1612 /prefetch:2 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process created: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe "C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1604,15735583474717430825,16040306059436304636,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-GB --service-sandbox-type=none --ignore-urlfetcher-cert-requests=true --ignore-certificate-errors=true --enable-experimental-web-platform-features --ignore-certificate-errors=true --mojo-platform-channel-handle=1976 /prefetch:8 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process created: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe "C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe" --type=renderer --enable-experimental-web-platform-features --field-trial-handle=1604,15735583474717430825,16040306059436304636,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-GB --app-path="C:\Users\user\AppData\Local\Programs\zentaoclient\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2056 /prefetch:1 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process created: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe "C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe" --type=renderer --enable-experimental-web-platform-features --field-trial-handle=1604,15735583474717430825,16040306059436304636,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-compositing --lang=en-GB --app-user-model-id=com.cnezsoft.zentaoclient --app-path="C:\Users\user\AppData\Local\Programs\zentaoclient\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2336 /prefetch:1 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process created: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Section loaded: iconcodecservice.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Section loaded: riched20.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Section loaded: usp10.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Section loaded: windows.fileexplorer.common.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Section loaded: linkinfo.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Section loaded: ntshrui.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Section loaded: cscapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: ffmpeg.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: uiautomationcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: kbdus.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: windows.ui.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: windowmanagementapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: inputhost.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: mscms.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: coloradapterclient.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: mmdevapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: devobj.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: iconcodecservice.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: dataexchange.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: dcomp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: windows.globalization.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: bcp47mrm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: twinapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: atlthunk.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: directmanipulation.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: msspellcheckingfacility.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: explorerframe.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: ffmpeg.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: uiautomationcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: resourcepolicyclient.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: mf.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: mfplat.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: rtworkq.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: msmpeg2vdec.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: mfperfhelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: dxva2.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: msvproc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: d3dcompiler_47.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: d3dcompiler_47.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: ddraw.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: dciman32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: comppkgsup.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: mfh264enc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: dcomp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: windows.media.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: ffmpeg.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: uiautomationcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: kbdus.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: ffmpeg.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: uiautomationcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: ffmpeg.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: uiautomationcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: qt5widgets.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: qt5gui.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: qt5network.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: qt5core.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: qt5gui.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: qt5core.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: qt5core.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: qt5core.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: libcrypto-1_1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: qt5svg.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: d3d9.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: dataexchange.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: dcomp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 Jump to behavior
Source: ??.lnk.0.dr LNK file: ..\..\..\..\..\Local\Programs\zentaoclient\zentaoclient.exe
Source: ??.lnk0.0.dr LNK file: ..\AppData\Local\Programs\zentaoclient\zentaoclient.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Automated click: Next >
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Automated click: Install
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\f3057352-10e3-53a8-8e7d-c7f226474698 Jump to behavior
Source: SecuriteInfo.com.Heur.21832.3236.exe Static PE information: certificate valid
Source: SecuriteInfo.com.Heur.21832.3236.exe Static file information: File size 86971128 > 1048576
Source: SecuriteInfo.com.Heur.21832.3236.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: C:\work\mesa\git\mesa\build\windows-x86\gallium\targets\libgl-gdi\opengl32.pdb source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1925344352.0000000007517000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: electron.exe.pdb source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972633551.000000000780B000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\work\mesa\git\mesa\build\windows-x86\gallium\targets\libgl-gdi\opengl32.pdbj source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1925344352.0000000007517000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: libGLESv2.dll.pdb source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp
Binary contains a suspicious time stamp
Source: d3dcompiler_47.dll.0.dr Static PE information: 0xF3329C94 [Sat Apr 18 07:26:12 2099 UTC]
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Code function: 0_2_030910D0 GetVersionExW,LoadLibraryW,GetProcAddress,LocalAlloc,LocalAlloc,NtQuerySystemInformation,LocalFree,LocalAlloc,FreeLibrary,lstrcpynW,lstrcmpiW,LocalFree,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,lstrlenW,lstrlenA,MultiByteToWideChar,lstrcmpiW,CloseHandle,FreeLibrary, 0_2_030910D0
PE file contains sections with non-standard names
Source: ffmpeg.dll.0.dr Static PE information: section name: .00cfg
Source: ffmpeg.dll.0.dr Static PE information: section name: _RDATA
Source: libEGL.dll.0.dr Static PE information: section name: .00cfg
Source: libEGL.dll.0.dr Static PE information: section name: _RDATA
Source: libGLESv2.dll.0.dr Static PE information: section name: .00cfg
Source: libGLESv2.dll.0.dr Static PE information: section name: _RDATA
Source: updater.win64.exe.0.dr Static PE information: section name: /4
Source: updater.win64.exe.0.dr Static PE information: section name: /18
Source: updater.win64.exe.0.dr Static PE information: section name: /30
Source: updater.win64.exe.0.dr Static PE information: section name: /43
Source: updater.win64.exe.0.dr Static PE information: section name: /59
Source: updater.win64.exe.0.dr Static PE information: section name: /75
Source: updater.win64.exe.0.dr Static PE information: section name: /90
Source: updater.win64.exe.0.dr Static PE information: section name: .symtab
Source: qgenericbearer.dll.0.dr Static PE information: section name: .qtmetad
Source: qsvgicon.dll.0.dr Static PE information: section name: .qtmetad
Source: qgif.dll.0.dr Static PE information: section name: .qtmetad
Source: qicns.dll.0.dr Static PE information: section name: .qtmetad
Source: qico.dll.0.dr Static PE information: section name: .qtmetad
Source: qjpeg.dll.0.dr Static PE information: section name: .qtmetad
Source: qsvg.dll.0.dr Static PE information: section name: .qtmetad
Source: qtga.dll.0.dr Static PE information: section name: .qtmetad
Source: qtiff.dll.0.dr Static PE information: section name: .qtmetad
Source: qwbmp.dll.0.dr Static PE information: section name: .qtmetad
Source: qwebp.dll.0.dr Static PE information: section name: .qtmetad
Source: qwebp.dll.0.dr Static PE information: section name: _RDATA
Source: libcrypto-1_1.dll.0.dr Static PE information: section name: .00cfg
Source: libssl-1_1.dll.0.dr Static PE information: section name: .00cfg
Source: opengl32sw.dll.0.dr Static PE information: section name: _RDATA
Source: qwindows.dll.0.dr Static PE information: section name: .qtmetad
Source: qwindowsvistastyle.dll.0.dr Static PE information: section name: .qtmetad
Source: libEGL.dll1.0.dr Static PE information: section name: .00cfg
Source: libEGL.dll1.0.dr Static PE information: section name: _RDATA
Source: libGLESv2.dll1.0.dr Static PE information: section name: .00cfg
Source: libGLESv2.dll1.0.dr Static PE information: section name: _RDATA
Source: vk_swiftshader.dll.0.dr Static PE information: section name: .00cfg
Source: vk_swiftshader.dll.0.dr Static PE information: section name: _RDATA
Source: vulkan-1.dll.0.dr Static PE information: section name: .00cfg
Source: vulkan-1.dll.0.dr Static PE information: section name: _RDATA
Source: zentaoclient.exe.0.dr Static PE information: section name: .00cfg
Source: zentaoclient.exe.0.dr Static PE information: section name: .retplne
Source: zentaoclient.exe.0.dr Static PE information: section name: .rodata
Source: zentaoclient.exe.0.dr Static PE information: section name: CPADinfo
Source: zentaoclient.exe.0.dr Static PE information: section name: _RDATA
Drops PE files
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Local\zentaoclient-updater\installer.exe Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\imageformats\qwbmp.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\iconengines\qsvgicon.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\imageformats\qicns.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\Qt5Gui.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Local\Programs\zentaoclient\swiftshader\libGLESv2.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Local\Programs\zentaoclient\vk_swiftshader.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Local\Temp\nsv30A.tmp\nsProcess.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\libEGL.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\libssl-1_1.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\msvcp140.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\imageformats\qwebp.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\Qt5Widgets.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\imageformats\qjpeg.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\elevate.exe Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Local\Programs\zentaoclient\vulkan-1.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Local\Programs\zentaoclient\d3dcompiler_47.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\Qt5Svg.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\Qt5Core.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\imageformats\qico.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Local\Programs\zentaoclient\libEGL.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\D3Dcompiler_47.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Local\Programs\zentaoclient\ffmpeg.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\Qt5Network.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Local\Programs\zentaoclient\swiftshader\libEGL.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\libcrypto-1_1.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\vcruntime140.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Local\Temp\nsv30A.tmp\UAC.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\imageformats\qsvg.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\imageformats\qtiff.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Local\Temp\nsv30A.tmp\nsDialogs.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Local\Programs\zentaoclient\libGLESv2.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\libGLESv2.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Local\Temp\nsv30A.tmp\WinShell.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\opengl32sw.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\platforms\qwindows.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Local\Programs\zentaoclient\Uninstall zentaoclient.exe Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Local\Temp\nsv30A.tmp\System.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\styles\qwindowsvistastyle.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\updater.win64.exe Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\imageformats\qgif.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Local\Temp\nsv30A.tmp\StdUtils.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Local\Temp\nsv30A.tmp\nsis7z.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\imageformats\qtga.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\bearer\qgenericbearer.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Local\Programs\zentaoclient\LICENSE.electron.txt Jump to behavior
Stores files to the Windows start menu directory
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\??.lnk Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\imageformats\qwbmp.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\iconengines\qsvgicon.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\imageformats\qicns.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\zentaoclient\swiftshader\libGLESv2.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\zentaoclient\vk_swiftshader.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsv30A.tmp\nsProcess.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\libEGL.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\libssl-1_1.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\imageformats\qwebp.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\imageformats\qjpeg.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\zentaoclient\vulkan-1.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\elevate.exe Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\imageformats\qico.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\zentaoclient\libEGL.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\zentaoclient\swiftshader\libEGL.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsv30A.tmp\UAC.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\imageformats\qsvg.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\imageformats\qtiff.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsv30A.tmp\nsDialogs.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsv30A.tmp\WinShell.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\zentaoclient\libGLESv2.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\libGLESv2.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\opengl32sw.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\platforms\qwindows.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\zentaoclient\Uninstall zentaoclient.exe Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsv30A.tmp\System.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\styles\qwindowsvistastyle.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\updater.win64.exe Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\imageformats\qgif.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsv30A.tmp\nsis7z.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsv30A.tmp\StdUtils.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\imageformats\qtga.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\bearer\qgenericbearer.dll Jump to dropped file
Queries keyboard layouts
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File Volume queried: C:\Users\user\AppData\Local\Programs FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File Volume queried: C:\Users\user\AppData\Local\Programs FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe File Volume queried: C:\Users\user\AppData\Roaming\zentaoclient\Code Cache\js FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe File Volume queried: C:\Users\user\AppData\Roaming\zentaoclient\Code Cache\wasm FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe File Volume queried: C:\Users\user\AppData\Roaming\zentaoclient\blob_storage\ad052674-6a2b-49a8-9bb3-be27f31603c8 FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Code function: 0_2_004059CC GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 0_2_004059CC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Code function: 0_2_004065FD FindFirstFileW,FindClose, 0_2_004065FD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Code function: 0_2_00402868 FindFirstFileW, 0_2_00402868
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File opened: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\iconengines Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File opened: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File opened: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\bearer Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File opened: C:\Users\user\AppData\Local\Programs\zentaoclient\resources Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File opened: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe File opened: C:\Users\user\AppData\Local\Programs\zentaoclient\locales Jump to behavior
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1925344352.0000000007517000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: invalid PARAM usage_mesa_symbol_table_push_scope_mesa_symbol_table_add_symbol_mesa_symbol_table_add_global_symbolARB_position_invariantARB_fog_expexp2linearprecision_hint_nicestfastestdraw_buffersfragment_program_shadowfragment_coord_origin_upper_leftpixel_center_integerATI_fatal flex scanner internal error--no action foundfatal flex scanner internal error--end of buffer missedfatal error - scanner input buffer overflowinput in flex scanner failedout of dynamic memory in yy_get_next_buffer()flex scanner push-back overflowout of dynamic memory in _mesa_program_lexer__create_buffer()out of dynamic memory in _mesa_program_lexer_ensure_buffer_stack()out of dynamic memory in _mesa_program_lexer__scan_buffer()out of dynamic memory in _mesa_program_lexer__scan_bytes()bad buffer in _mesa_program_lexer__scan_bytes()_mesa_program_lexer_set_lineno called with no buffer_mesa_program_lexer_set_column called with no bufferSOFTPIPE_USE_LLVMVMware, Inc.softpipeUnexpected PIPE_CAP %d query
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006DBC000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: VMware Virtual Webcam
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006C12000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: VMnet
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1925344352.0000000007517000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: VMware, Inc.
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: .?AVQEmulationPaintEngine@@L
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1925344352.0000000007517000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: LLVMX86_FP80TypeKind
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006C12000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: Net.RedirectChainLengthurl_chainload_state_paramdelegate_blocked_byhas_uploadis_pendingDelegateNet.URLRequest.ReferrerPolicyForRequest.SameOriginNet.URLRequest.ReferrerHasInformativePath.SameOriginNet.URLRequest.ReferrerPolicyForRequest.CrossOriginNet.URLRequest.ReferrerHasInformativePath.CrossOriginURLRequestContextnet/url_request_context/%s/0x%llx../../net/url_request/url_request_job.ccOnDonenum_failuresrelease_after_msThrottling.RequestThrottled%08x: %02x ../../net/base/network_interfaces_win.ccWlanApiwlanapi.dllWlanQueryInterfaceWlanSetInterfaceVMnetGetAdaptersAddresses failed: ../../net/cert/x509_util_win.ccerror parsing intermediate
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: (IsLinux() && isVMWare) || (IsAndroid() && isNvidia) || (IsAndroid() && GetAndroidSdkLevel() < 27 && IsAdreno5xxOrOlder(functions)) || (IsAndroid() && IsMaliT8xxOrOlder(functions)) || (IsAndroid() && IsMaliG31OrOlder(functions))
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006DBC000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: eb1a:2860eb1a:28201ce6:282012ab:03801943:22530c45:64d00c45:64d21bcf:298504ca:704704ca:704804f2:b3ed04f2:b3ca05c8:035d05c8:036904ca:709513d3:52570bda:57f2VMware Virtual WebcamMedia.VideoCapture.BlacklistedDeviceGoogle Camera AdapterIP Camera [JPEG/MJPEG]CyberLink Webcam SplitterEpocCam../../media/capture/video/video_capture_metrics.ccDevice supports Media.VideoCapture.Device.SupportedPixelFormatMedia.VideoCapture.Device.SupportedResolution
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1972304883.000000000700A000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: lgnW2/4/PEZB31jiVg88O8EckzXZOFKs7sjsLjBOlDW0JB9LeGna8gI4zJVSk/BwJVmcIGfE
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1925344352.0000000007517000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: t1t0t3t2dst1dst0dst3dst2LLVMFloatTypeKindLLVMVoidTypeKindLLVMX86_FP80TypeKindLLVMDoubleTypeKindLLVMPPC_FP128TypeKindLLVMFP128TypeKindLLVMIntegerTypeKindLLVMLabelTypeKindLLVMStructTypeKindLLVMFunctionTypeKindLLVMPointerTypeKindLLVMArrayTypeKindLLVMMetadataTypeKindLLVMVectorTypeKindVector [%u] of %u-bit Integer
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: .?AVQEmulationPaintEngine@@
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1913362084.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: Adreno (TM) 418Adreno (TM) 530Adreno (TM) 540GL_EXT_texture_lod_biasARB_draw_buffersGL_ARB_texture_swizzleGL_EXT_texture_swizzleGL_ARB_pixel_buffer_objectGL_EXT_pixel_buffer_objectGL_EXT_draw_buffers2GL_ARB_fragment_shaderGL_NV_texture_border_clampGL_ARB_robust_buffer_access_behaviorGL_EXT_framebuffer_sRGBGL_ARB_framebuffer_sRGBfunctions->standard == STANDARD_GL_DESKTOP && isAMDfunctions->standard == STANDARD_GL_DESKTOP && isIntelisIntel && !IsSandyBridge(device) && !IsIvyBridge(device) && !IsHaswell(device)IsApple() && isIntelisIntel && IsApple() && IsSkylake(device) && GetMacOSVersion() < OSVersion(10, 13, 2)functions->standard == STANDARD_GL_DESKTOP && (isIntel || isAMD)IsLinux() && functions->standard == STANDARD_GL_DESKTOP && isAMD(IsApple() && functions->standard == STANDARD_GL_DESKTOP) || (IsLinux() && isAMD)IsApple() && functions->standard == STANDARD_GL_DESKTOP && GetMacOSVersion() < OSVersion(10, 11, 0)IsApple() && isIntel && GetMacOSVersion() < OSVersion(10, 12, 0)IsApple() && isAMDIsAndroid() && isQualcommfunctions->standard == STANDARD_GL_DESKTOP && isNvidiaIsApple() || isNvidiafunctions->isAtMostGL(gl::Version(4, 1)) || (functions->standard == STANDARD_GL_DESKTOP && isAMD)isAMD || IsAndroid()IsAndroid() || isNvidia(IsAndroid() && isQualcomm) || (isIntel && IsApple())isAMD || isIntelIsNexus5X(vendor, device)IsAndroid() || (IsWindows() && isIntel)(IsWindows() && (isIntel || isAMD)) || (IsLinux() && isNvidia) || IsIOS() || IsAndroidEmulator(functions)IsAndroid() || limitMaxTextureSizeIsAndroid() || (IsApple() && (isIntel || isAMD || isNvidia))limitMaxTextureSizeIsApple()IsAndroid() || isAMD || !functions->hasExtension("GL_KHR_robust_buffer_access_behavior")IsApple() && isIntel && GetMacOSVersion() >= OSVersion(10, 12, 4)IsApple() && isIntel && GetMacOSVersion() < OSVersion(10, 12, 6)IsLinux() || (IsAndroid() && isNvidia) || (IsWindows() && isNvidia) || (IsApple() && functions->standard == STANDARD_GL_ES)IsApple() || (IsLinux() && isAMD)IsApple() || (IsWindows() && isAMD)functions->standard == STANDARD_GL_DESKTOP && functions->isAtLeastGL(gl::Version(3, 1)) && !functions->isAtLeastGL(gl::Version(4, 3))features->emulatePrimitiveRestartFixedIndex.enabled && IsApple() && isIntelIsApple() || IsAndroid() || IsWindows()functions->standard == STANDARD_GL_ES && functions->isAtLeastGLES(gl::Version(3, 1)) && functions->hasGLESExtension("GL_EXT_texture_norm16")IsWindows() && isAMDIsLinux() && isAMD && isMesa && mesaVersion < (std::array<int, 3>{19, 3, 5})(IsLinux() && isVMWare) || (IsAndroid() && isNvidia) || (IsAndroid() && GetAndroidSdkLevel() < 27 && IsAdreno5xxOrOlder(functions)) || (IsAndroid() && IsMaliT8xxOrOlder(functions)) || (IsAndroid() && IsMaliG31OrOlder(functions))IsApple() && functions->standard == STANDARD_GL_ES && !(isAMD && IsWindows())isDualGPUMacWithNVIDIAisTSANBuild && IsLinux() && isNvidiaIsApple() && (isAMD || isIntel || isNvidia)IsLinux() && IsWayland()!CanMapBufferForRead(functions)IsApple() && hasAMDIsAdreno42xOr3xx(func
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Code function: 0_2_030910D0 GetVersionExW,LoadLibraryW,GetProcAddress,LocalAlloc,LocalAlloc,NtQuerySystemInformation,LocalFree,LocalAlloc,FreeLibrary,lstrcpynW,lstrcmpiW,LocalFree,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,lstrlenW,lstrlenA,MultiByteToWideChar,lstrcmpiW,CloseHandle,FreeLibrary, 0_2_030910D0
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process created: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe "C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe" --type=gpu-process --field-trial-handle=1604,15735583474717430825,16040306059436304636,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1612 /prefetch:2 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process created: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe "C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1604,15735583474717430825,16040306059436304636,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-GB --service-sandbox-type=none --ignore-urlfetcher-cert-requests=true --ignore-certificate-errors=true --enable-experimental-web-platform-features --ignore-certificate-errors=true --mojo-platform-channel-handle=1976 /prefetch:8 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process created: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe "C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe" --type=renderer --enable-experimental-web-platform-features --field-trial-handle=1604,15735583474717430825,16040306059436304636,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-GB --app-path="C:\Users\user\AppData\Local\Programs\zentaoclient\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2056 /prefetch:1 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process created: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe "C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe" --type=renderer --enable-experimental-web-platform-features --field-trial-handle=1604,15735583474717430825,16040306059436304636,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-compositing --lang=en-GB --app-user-model-id=com.cnezsoft.zentaoclient --app-path="C:\Users\user\AppData\Local\Programs\zentaoclient\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2336 /prefetch:1 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process created: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Jump to behavior
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process created: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe "c:\users\user\appdata\local\programs\zentaoclient\zentaoclient.exe" --type=gpu-process --field-trial-handle=1604,15735583474717430825,16040306059436304636,131072 --disable-features=cookieswithoutsamesitemustbesecure,samesitebydefaultcookies,sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand --gpu-preferences=saaaaaaaaadgaaawaaaaaaaaaaaaaaaaaabgaaaaaaaoaaaaaaaaaaaaaaaaaaaaaaaaaaaaaab4aaaaaaaaahgaaaaaaaaakaaaaaqaaaagaaaaaaaaacgaaaaaaaaamaaaaaaaaaa4aaaaaaaaabaaaaaaaaaaaaaaaauaaaaqaaaaaaaaaaaaaaagaaaaeaaaaaaaaaabaaaabqaaabaaaaaaaaaaaqaaaayaaaaiaaaaaaaaaagaaaaaaaaa --mojo-platform-channel-handle=1612 /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process created: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe "c:\users\user\appdata\local\programs\zentaoclient\zentaoclient.exe" --type=utility --utility-sub-type=network.mojom.networkservice --field-trial-handle=1604,15735583474717430825,16040306059436304636,131072 --disable-features=cookieswithoutsamesitemustbesecure,samesitebydefaultcookies,sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand --lang=en-gb --service-sandbox-type=none --ignore-urlfetcher-cert-requests=true --ignore-certificate-errors=true --enable-experimental-web-platform-features --ignore-certificate-errors=true --mojo-platform-channel-handle=1976 /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process created: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe "c:\users\user\appdata\local\programs\zentaoclient\zentaoclient.exe" --type=renderer --enable-experimental-web-platform-features --field-trial-handle=1604,15735583474717430825,16040306059436304636,131072 --disable-features=cookieswithoutsamesitemustbesecure,samesitebydefaultcookies,sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand --lang=en-gb --app-path="c:\users\user\appdata\local\programs\zentaoclient\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2056 /prefetch:1
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process created: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe "c:\users\user\appdata\local\programs\zentaoclient\zentaoclient.exe" --type=renderer --enable-experimental-web-platform-features --field-trial-handle=1604,15735583474717430825,16040306059436304636,131072 --disable-features=cookieswithoutsamesitemustbesecure,samesitebydefaultcookies,sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand --disable-gpu-compositing --lang=en-gb --app-user-model-id=com.cnezsoft.zentaoclient --app-path="c:\users\user\appdata\local\programs\zentaoclient\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2336 /prefetch:1
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process created: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe "c:\users\user\appdata\local\programs\zentaoclient\zentaoclient.exe" --type=gpu-process --field-trial-handle=1604,15735583474717430825,16040306059436304636,131072 --disable-features=cookieswithoutsamesitemustbesecure,samesitebydefaultcookies,sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand --gpu-preferences=saaaaaaaaadgaaawaaaaaaaaaaaaaaaaaabgaaaaaaaoaaaaaaaaaaaaaaaaaaaaaaaaaaaaaab4aaaaaaaaahgaaaaaaaaakaaaaaqaaaagaaaaaaaaacgaaaaaaaaamaaaaaaaaaa4aaaaaaaaabaaaaaaaaaaaaaaaauaaaaqaaaaaaaaaaaaaaagaaaaeaaaaaaaaaabaaaabqaaabaaaaaaaaaaaqaaaayaaaaiaaaaaaaaaagaaaaaaaaa --mojo-platform-channel-handle=1612 /prefetch:2 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process created: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe "c:\users\user\appdata\local\programs\zentaoclient\zentaoclient.exe" --type=utility --utility-sub-type=network.mojom.networkservice --field-trial-handle=1604,15735583474717430825,16040306059436304636,131072 --disable-features=cookieswithoutsamesitemustbesecure,samesitebydefaultcookies,sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand --lang=en-gb --service-sandbox-type=none --ignore-urlfetcher-cert-requests=true --ignore-certificate-errors=true --enable-experimental-web-platform-features --ignore-certificate-errors=true --mojo-platform-channel-handle=1976 /prefetch:8 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process created: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe "c:\users\user\appdata\local\programs\zentaoclient\zentaoclient.exe" --type=renderer --enable-experimental-web-platform-features --field-trial-handle=1604,15735583474717430825,16040306059436304636,131072 --disable-features=cookieswithoutsamesitemustbesecure,samesitebydefaultcookies,sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand --lang=en-gb --app-path="c:\users\user\appdata\local\programs\zentaoclient\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2056 /prefetch:1 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Process created: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe "c:\users\user\appdata\local\programs\zentaoclient\zentaoclient.exe" --type=renderer --enable-experimental-web-platform-features --field-trial-handle=1604,15735583474717430825,16040306059436304636,131072 --disable-features=cookieswithoutsamesitemustbesecure,samesitebydefaultcookies,sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand --disable-gpu-compositing --lang=en-gb --app-user-model-id=com.cnezsoft.zentaoclient --app-path="c:\users\user\appdata\local\programs\zentaoclient\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2336 /prefetch:1 Jump to behavior
Source: SecuriteInfo.com.Heur.21832.3236.exe, 00000000.00000003.1971925723.0000000006CE0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: ../../third_party/webrtc/modules/desktop_capture/win/window_capture_utils.ccFail to create instance of VirtualDesktopManagerChrome_WidgetWin_Progmanffff:%hx%n%4hx%n../../third_party/webrtc/modules/desktop_capture/win/dxgi_frame.ccDxgiFrame cannot create a new DesktopFrame.../../third_party/webrtc/modules/desktop_capture/win/dxgi_adapter_duplicator.ccIDXGIAdapter::EnumOutputs returned NOT_CURRENTLY_AVAILABLE. This may happen when running in session 0.IDXGIAdapter::EnumOutputs returned an unexpected result: Failed to convert IDXGIOutput to IDXGIOutput1, this usually means the system does not support DirectX 11Failed to initialize DxgiOutputDuplicator on output AttachedDetached output ) - () is ignored.Failed to get output description of device , ignore.Cannot initialize any DxgiOutputDuplicator instance.
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Queries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Queries volume information: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\lang\en.json VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\zentaoclient.exe Queries volume information: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\build-in\extensions.json VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Queries volume information: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\platforms\qwindows.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Queries volume information: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\styles\qwindowsvistastyle.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Queries volume information: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\imageformats\qgif.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Queries volume information: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\imageformats\qicns.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Queries volume information: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\imageformats\qico.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Queries volume information: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\imageformats\qjpeg.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.21832.3236.exe Code function: 0_2_0040338F EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_0040338F
Source: C:\Users\user\AppData\Local\Programs\zentaoclient\resources\bin\zenshot\zenshot.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1428295 Sample: SecuriteInfo.com.Heur.21832... Startdate: 18/04/2024 Architecture: WINDOWS Score: 5 5 SecuriteInfo.com.Heur.21832.3236.exe 13 236 2->5         started        8 zentaoclient.exe 46 2->8         started        file3 18 C:\Users\user\AppData\Local\...\installer.exe, PE32 5->18 dropped 20 C:\Users\user\AppData\Local\...\nsis7z.dll, PE32 5->20 dropped 22 C:\Users\user\AppData\Local\...\nsProcess.dll, PE32 5->22 dropped 24 44 other files (none is malicious) 5->24 dropped 10 zentaoclient.exe 1 8->10         started        12 zentaoclient.exe 1 8->12         started        14 zentaoclient.exe 1 8->14         started        16 2 other processes 8->16 process4
⊘No contacted IP infos