Edit tour

Windows Analysis Report
URGENT REQUEST FOR QUOTATION.exe

Overview

General Information

Sample name:	URGENT REQUEST FOR QUOTATION.exe
Analysis ID:	1634099
MD5:	0b04a2d692e0679243660865879628b2
SHA1:	9c8f684547e4bab4458160fb963fe92dba5ec9ee
SHA256:	3aa6510b5cd734042afde77fce92ce73aac28de0928a37b651a915df342b1c10
Tags:	exeuser-threatcat_ch
Infos:

Detection

FormBook

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected FormBook

.NET source code contains potential unpacker

Adds a directory exclusion to Windows Defender

Allocates memory in foreign processes

Found direct / indirect Syscall (likely to bypass EDR)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Performs DNS queries to domains with low reputation

Queues an APC in another process (thread injection)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

URGENT REQUEST FOR QUOTATION.exe (PID: 7092 cmdline: "C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe" MD5: 0B04A2D692E0679243660865879628B2)

powershell.exe (PID: 6168 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegSvcs.exe (PID: 6260 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

RegSvcs.exe (PID: 6332 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

H792vWLf9Fx1Mp7TRJ.exe (PID: 5320 cmdline: "C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\DpJwx4KB9n.exe" MD5: 9C98D1A23EFAF1B156A130CEA7D2EE3A)

PresentationHost.exe (PID: 796 cmdline: "C:\Windows\SysWOW64\PresentationHost.exe" MD5: C6671F8B9F073785FD617661AD1F1C45)

H792vWLf9Fx1Mp7TRJ.exe (PID: 5040 cmdline: "C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\YbSQGnezJ0Cpzn.exe" MD5: 9C98D1A23EFAF1B156A130CEA7D2EE3A)

firefox.exe (PID: 3700 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

svchost.exe (PID: 5768 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://0xmrmagnezi.github.io/malware%20analysis/FormBook/ https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.1373353315.0000000001050000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000004.00000002.1372904719.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000F.00000002.3372784799.0000000005400000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000D.00000002.3370961609.0000000002C90000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000004.00000002.1374655242.00000000014F0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
Process Memory Space: URGENT REQUEST FOR QUOTATION.exe PID: 7092	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
4.2.RegSvcs.exe.400000.0.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe", ParentImage: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe, ParentProcessId: 7092, ParentProcessName: URGENT REQUEST FOR QUOTATION.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe", ProcessId: 6168, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe", ParentImage: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe, ParentProcessId: 7092, ParentProcessName: URGENT REQUEST FOR QUOTATION.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe", ProcessId: 6168, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 628, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5768, ProcessName: svchost.exe

Suricata Signatures

ET MALWARE FormBook CnC Checkin (GET) M5

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-10T19:39:39.541005+0100	2050745	1	Malware Command and Control Activity Detected	192.168.2.7	49691	77.95.113.182	80	TCP
2025-03-10T19:40:02.928610+0100	2050745	1	Malware Command and Control Activity Detected	192.168.2.7	49695	51.222.255.207	80	TCP
2025-03-10T19:40:16.404167+0100	2050745	1	Malware Command and Control Activity Detected	192.168.2.7	49699	104.21.18.45	80	TCP
2025-03-10T19:40:29.855458+0100	2050745	1	Malware Command and Control Activity Detected	192.168.2.7	49703	203.161.42.73	80	TCP
2025-03-10T19:40:44.112136+0100	2050745	1	Malware Command and Control Activity Detected	192.168.2.7	49707	142.0.133.149	80	TCP
2025-03-10T19:40:57.314441+0100	2050745	1	Malware Command and Control Activity Detected	192.168.2.7	49712	13.248.169.48	80	TCP
2025-03-10T19:41:10.480915+0100	2050745	1	Malware Command and Control Activity Detected	192.168.2.7	49716	3.33.130.190	80	TCP
2025-03-10T19:41:32.227363+0100	2050745	1	Malware Command and Control Activity Detected	192.168.2.7	49721	199.59.243.228	80	TCP
2025-03-10T19:41:45.614300+0100	2050745	1	Malware Command and Control Activity Detected	192.168.2.7	49725	13.248.169.48	80	TCP
2025-03-10T19:42:01.575179+0100	2050745	1	Malware Command and Control Activity Detected	192.168.2.7	49729	43.251.56.78	80	TCP
2025-03-10T19:42:14.770594+0100	2050745	1	Malware Command and Control Activity Detected	192.168.2.7	49733	13.248.169.48	80	TCP
2025-03-10T19:42:27.963281+0100	2050745	1	Malware Command and Control Activity Detected	192.168.2.7	49739	3.33.130.190	80	TCP
2025-03-10T19:42:41.579670+0100	2050745	1	Malware Command and Control Activity Detected	192.168.2.7	49743	85.159.66.93	80	TCP

ETPRO MALWARE FormBook CnC Checkin (POST) M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-10T19:39:55.260609+0100	2855464	1	A Network Trojan was detected	192.168.2.7	49692	51.222.255.207	80	TCP
2025-03-10T19:39:57.780050+0100	2855464	1	A Network Trojan was detected	192.168.2.7	49693	51.222.255.207	80	TCP
2025-03-10T19:40:00.349519+0100	2855464	1	A Network Trojan was detected	192.168.2.7	49694	51.222.255.207	80	TCP
2025-03-10T19:40:08.657132+0100	2855464	1	A Network Trojan was detected	192.168.2.7	49696	104.21.18.45	80	TCP
2025-03-10T19:40:11.193306+0100	2855464	1	A Network Trojan was detected	192.168.2.7	49697	104.21.18.45	80	TCP
2025-03-10T19:40:13.766509+0100	2855464	1	A Network Trojan was detected	192.168.2.7	49698	104.21.18.45	80	TCP
2025-03-10T19:40:22.057441+0100	2855464	1	A Network Trojan was detected	192.168.2.7	49700	203.161.42.73	80	TCP
2025-03-10T19:40:24.601180+0100	2855464	1	A Network Trojan was detected	192.168.2.7	49701	203.161.42.73	80	TCP
2025-03-10T19:40:27.151281+0100	2855464	1	A Network Trojan was detected	192.168.2.7	49702	203.161.42.73	80	TCP
2025-03-10T19:40:36.263879+0100	2855464	1	A Network Trojan was detected	192.168.2.7	49704	142.0.133.149	80	TCP
2025-03-10T19:40:38.810130+0100	2855464	1	A Network Trojan was detected	192.168.2.7	49705	142.0.133.149	80	TCP
2025-03-10T19:40:41.368292+0100	2855464	1	A Network Trojan was detected	192.168.2.7	49706	142.0.133.149	80	TCP
2025-03-10T19:40:49.639559+0100	2855464	1	A Network Trojan was detected	192.168.2.7	49708	13.248.169.48	80	TCP
2025-03-10T19:40:52.193201+0100	2855464	1	A Network Trojan was detected	192.168.2.7	49709	13.248.169.48	80	TCP
2025-03-10T19:40:54.718023+0100	2855464	1	A Network Trojan was detected	192.168.2.7	49710	13.248.169.48	80	TCP
2025-03-10T19:41:02.881977+0100	2855464	1	A Network Trojan was detected	192.168.2.7	49713	3.33.130.190	80	TCP
2025-03-10T19:41:05.424796+0100	2855464	1	A Network Trojan was detected	192.168.2.7	49714	3.33.130.190	80	TCP
2025-03-10T19:41:07.930490+0100	2855464	1	A Network Trojan was detected	192.168.2.7	49715	3.33.130.190	80	TCP
2025-03-10T19:41:24.263952+0100	2855464	1	A Network Trojan was detected	192.168.2.7	49718	199.59.243.228	80	TCP
2025-03-10T19:41:27.138879+0100	2855464	1	A Network Trojan was detected	192.168.2.7	49719	199.59.243.228	80	TCP
2025-03-10T19:41:29.707386+0100	2855464	1	A Network Trojan was detected	192.168.2.7	49720	199.59.243.228	80	TCP
2025-03-10T19:41:38.955871+0100	2855464	1	A Network Trojan was detected	192.168.2.7	49722	13.248.169.48	80	TCP
2025-03-10T19:41:40.478797+0100	2855464	1	A Network Trojan was detected	192.168.2.7	49723	13.248.169.48	80	TCP
2025-03-10T19:41:43.074668+0100	2855464	1	A Network Trojan was detected	192.168.2.7	49724	13.248.169.48	80	TCP
2025-03-10T19:41:53.059498+0100	2855464	1	A Network Trojan was detected	192.168.2.7	49726	43.251.56.78	80	TCP
2025-03-10T19:41:55.638941+0100	2855464	1	A Network Trojan was detected	192.168.2.7	49727	43.251.56.78	80	TCP
2025-03-10T19:41:58.469458+0100	2855464	1	A Network Trojan was detected	192.168.2.7	49728	43.251.56.78	80	TCP
2025-03-10T19:42:07.131255+0100	2855464	1	A Network Trojan was detected	192.168.2.7	49730	13.248.169.48	80	TCP
2025-03-10T19:42:09.675207+0100	2855464	1	A Network Trojan was detected	192.168.2.7	49731	13.248.169.48	80	TCP
2025-03-10T19:42:12.234736+0100	2855464	1	A Network Trojan was detected	192.168.2.7	49732	13.248.169.48	80	TCP
2025-03-10T19:42:20.320857+0100	2855464	1	A Network Trojan was detected	192.168.2.7	49735	3.33.130.190	80	TCP
2025-03-10T19:42:22.873560+0100	2855464	1	A Network Trojan was detected	192.168.2.7	49736	3.33.130.190	80	TCP
2025-03-10T19:42:25.407206+0100	2855464	1	A Network Trojan was detected	192.168.2.7	49737	3.33.130.190	80	TCP
2025-03-10T19:42:34.659098+0100	2855464	1	A Network Trojan was detected	192.168.2.7	49740	85.159.66.93	80	TCP
2025-03-10T19:42:37.205823+0100	2855464	1	A Network Trojan was detected	192.168.2.7	49741	85.159.66.93	80	TCP
2025-03-10T19:42:39.768288+0100	2855464	1	A Network Trojan was detected	192.168.2.7	49742	85.159.66.93	80	TCP
2025-03-10T19:42:48.464917+0100	2855464	1	A Network Trojan was detected	192.168.2.7	49744	162.43.104.171	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: URGENT REQUEST FOR QUOTATION.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://www.quo1ybjmkhdqljoz.top/is6o/	Avira URL Cloud: Label: malware
Source: http://www.quo1ybjmkhdqljoz.top/is6o/?-xTT=j0lPqzQXq&Efgt_=BzQ9YNBxKh8dSSaiD5i7iIOB263e8CQAxf5JFiCTYVmLK080aBrOX/K0gKC4sHOntWbFJC0oYFvYzCzjPtDwHsrqWssUKlT7PjR4QI7T6LhUhgoBwCFSWBzMdTQd0Y/QIsDuxyB4C/Of	Avira URL Cloud: Label: malware

Multi AV Scanner detection for submitted file

Source: URGENT REQUEST FOR QUOTATION.exe	Virustotal: Detection: 58%			Perma Link
Source: URGENT REQUEST FOR QUOTATION.exe	ReversingLabs: Detection: 57%

Yara detected FormBook

Source: Yara match	File source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1373353315.0000000001050000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1372904719.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3372784799.0000000005400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3370961609.0000000002C90000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1374655242.00000000014F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: URGENT REQUEST FOR QUOTATION.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: URGENT REQUEST FOR QUOTATION.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: PresentationHost.pdbGCTL source: H792vWLf9Fx1Mp7TRJ.exe, 0000000D.00000003.1318998743.0000000001114000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: RegSvcs.pdb, source: PresentationHost.exe, 0000000E.00000002.3373669212.000000000550C000.00000004.10000000.00040000.00000000.sdmp, PresentationHost.exe, 0000000E.00000002.3369398408.00000000031DE000.00000004.00000020.00020000.00000000.sdmp, H792vWLf9Fx1Mp7TRJ.exe, 0000000F.00000000.1449460739.0000000002FCC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.1665018757.00000000342EC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: RegSvcs.exe, 00000004.00000002.1373459199.00000000010A0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: RegSvcs.exe, RegSvcs.exe, 00000004.00000002.1373459199.00000000010A0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: PresentationHost.pdb source: H792vWLf9Fx1Mp7TRJ.exe, 0000000D.00000003.1318998743.0000000001114000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: RegSvcs.pdb source: PresentationHost.exe, 0000000E.00000002.3373669212.000000000550C000.00000004.10000000.00040000.00000000.sdmp, PresentationHost.exe, 0000000E.00000002.3369398408.00000000031DE000.00000004.00000020.00020000.00000000.sdmp, H792vWLf9Fx1Mp7TRJ.exe, 0000000F.00000000.1449460739.0000000002FCC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.1665018757.00000000342EC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: C:\Work\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: H792vWLf9Fx1Mp7TRJ.exe, 0000000D.00000002.3368633324.000000000030F000.00000002.00000001.01000000.0000000E.sdmp, H792vWLf9Fx1Mp7TRJ.exe, 0000000F.00000000.1448551228.000000000030F000.00000002.00000001.01000000.0000000E.sdmp

Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 4x nop then mov ebx, dword ptr [ebp+08h]	14_2_02DB4179
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 4x nop then pop edi	14_2_02D9E980
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	Code function: 4x nop then mov esp, ebp	15_2_05406082
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	Code function: 4x nop then mov esp, ebp	15_2_0540616D
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	Code function: 4x nop then pop edi	15_2_05406821
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	Code function: 4x nop then xor eax, eax	15_2_0540C082
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	Code function: 4x nop then pop edi	15_2_05408897
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 4x nop then mov ebx, 00000004h	16_2_00000200740EC4DE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.7:49695 -> 51.222.255.207:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49705 -> 142.0.133.149:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49696 -> 104.21.18.45:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49698 -> 104.21.18.45:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49701 -> 203.161.42.73:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.7:49691 -> 77.95.113.182:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.7:49703 -> 203.161.42.73:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49694 -> 51.222.255.207:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.7:49716 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49706 -> 142.0.133.149:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49719 -> 199.59.243.228:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49730 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49728 -> 43.251.56.78:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.7:49707 -> 142.0.133.149:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.7:49699 -> 104.21.18.45:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49724 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.7:49725 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49727 -> 43.251.56.78:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.7:49721 -> 199.59.243.228:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49702 -> 203.161.42.73:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.7:49729 -> 43.251.56.78:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49692 -> 51.222.255.207:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49693 -> 51.222.255.207:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49722 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49718 -> 199.59.243.228:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49713 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49697 -> 104.21.18.45:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.7:49739 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49704 -> 142.0.133.149:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49710 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49732 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.7:49712 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49723 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49741 -> 85.159.66.93:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49708 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49731 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49715 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49737 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49700 -> 203.161.42.73:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49709 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49744 -> 162.43.104.171:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.7:49733 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49736 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49740 -> 85.159.66.93:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49742 -> 85.159.66.93:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49714 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49726 -> 43.251.56.78:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.7:49743 -> 85.159.66.93:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49720 -> 199.59.243.228:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49735 -> 3.33.130.190:80

Performs DNS queries to domains with low reputation

Source:	DNS query: www.79456217.xyz
Source:	DNS query: www.quantumeditor.xyz
Source:	DNS query: www.otonix.xyz
Source:	DNS query: www.espuna.xyz
Source:	DNS query: www.setrala.xyz

Source: Joe Sandbox View	IP Address: 142.0.133.149 142.0.133.149
Source: Joe Sandbox View	IP Address: 13.248.169.48 13.248.169.48

Source: Joe Sandbox View

ASN Name: VNPT-AS-VNVNPTCorpVN VNPT-AS-VNVNPTCorpVN

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /aoc3/?-xTT=j0lPqzQXq&Efgt_=ENVuXSwqVK4LLJ4YJlZlMeYHrEcDnrku0UDTRKKNf697foRm0cYEZ1DAoMd0qHiAIGHFieBWVgv/TRDvXeOlw4G9Opm8ggwo/DoDpEL4mvHpxJobBgWxb1sUG01nChEAO+Nranm6WoRc HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-usHost: www.sixfiguredigital.groupConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:35.0) Gecko/20100101 Firefox/35.0
Source: global traffic	HTTP traffic detected: GET /d70e/?Efgt_=l5xQA5K4b7aqfogvgthhEW2Kij6uBj4yo6Xr1d/5ybb5OsrKimt0hea7nMwmYGsyz9DiR+F2IdsEY8sqakHWFDZUIVUtyxsn/h6x9Up8uxf1vL5lgDICZZH9HwT/RWpiYmScg0tnqT+H&-xTT=j0lPqzQXq HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-usHost: www.playav.mobiConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:35.0) Gecko/20100101 Firefox/35.0
Source: global traffic	HTTP traffic detected: GET /i449/?-xTT=j0lPqzQXq&Efgt_=o6aNrPJ8Vgz7qr0kqZZ8+M9WN1LfFZsA5dfKdpZrkUJWipFpw/MtjZu4OErTJsSr7rDGASsMPw9ZK2KHHuFx5ABVnGW1c4pSTmK7TDtuBvC880dWppuzai5TVpdZiG0Vsj1922hjZtTc HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-usHost: www.eedpisalgenius.shopConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:35.0) Gecko/20100101 Firefox/35.0
Source: global traffic	HTTP traffic detected: GET /04t4/?Efgt_=z3mRD9CpBO+9TEsB8KeFK07qchdgYy0KFRU8DceMFbMfFgTaDd0hbIYWywfeaTrgjghZEseGMRK0IE2XxKDTe4F/aHdB7NO/vWJ7U+JegsPPu9KEbLbjLPfxY645l2WRAuOafAbmqZon&-xTT=j0lPqzQXq HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-usHost: www.thrivay.websiteConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:35.0) Gecko/20100101 Firefox/35.0
Source: global traffic	HTTP traffic detected: GET /q7ap/?Efgt_=2QcLCv3cch7dZL7s4iq4P0BahgiXnmhT267zkT/xic4HTOjDb+i+cbqxNFfPkyyXEtlXhdON3BxQ/RTEtYdDVzNO1QRT2ZN+uvkSNQdSXA7Btp6V87d/9qU/ekr1HuHU2pxaPDeGkUac&-xTT=j0lPqzQXq HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-usHost: www.79456217.xyzConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:35.0) Gecko/20100101 Firefox/35.0
Source: global traffic	HTTP traffic detected: GET /twh5/?Efgt_=VNpmgVL8zztOUbgFg9Ftn4NFS1YLlIGOUABJqsL8a9/ZVZyI9pmuikEHmmF/lXXKyNrQMbjIObZNg2ZsjMoRV/WmnnVoLnfIEDAN8UJx5JG8PKHjR1xZYn9tmvdsa9RNg1QHrDfuaTRc&-xTT=j0lPqzQXq HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-usHost: www.quantumeditor.xyzConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:35.0) Gecko/20100101 Firefox/35.0
Source: global traffic	HTTP traffic detected: GET /x6tl/?-xTT=j0lPqzQXq&Efgt_=EsQLp0lSjrnUQUgriR5/q4Ijg7i3lRfcTGMaceGVIHAu2C5GuL5Da4IDJhxoGeH6WEwepDk4QE4uzXSXMLW/tAdxo8YgHERPoprBqmV5wGw45GwsJDCmVICKddqQ+RotCmh0taaz6K+q HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-usHost: www.valorpackaging.shopConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:35.0) Gecko/20100101 Firefox/35.0
Source: global traffic	HTTP traffic detected: GET /7nfd/?-xTT=j0lPqzQXq&Efgt_=t0iMLGZXRyzjbtJpEBERwS1dc8TFHGKLLPb1weqEE74JLntR+dCrlLHKB6/FXAnnSRI7IZYuDSoOCm40oE4c6A2aV6Z9r0bh+IlNDqFm5e+hsdKMN9xNJHp9Td96G1+bmZNRGhU5xuyj HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-usHost: www.scottish.cafeConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:35.0) Gecko/20100101 Firefox/35.0
Source: global traffic	HTTP traffic detected: GET /8o59/?Efgt_=0cmo3Tm81IW2+X+BLyjB3kLSVSsysYXv7d+8I3B89oh/1yC7Aa7uHRVoxd1HW8YUp66By70CJ4M5XGzZECK73QqAw8Z//qRUVAMWwdlbcRxRixk44zkYKi7PFKa6LbHIM2Whu6eC1+cQ&-xTT=j0lPqzQXq HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-usHost: www.otonix.xyzConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:35.0) Gecko/20100101 Firefox/35.0
Source: global traffic	HTTP traffic detected: GET /is6o/?-xTT=j0lPqzQXq&Efgt_=BzQ9YNBxKh8dSSaiD5i7iIOB263e8CQAxf5JFiCTYVmLK080aBrOX/K0gKC4sHOntWbFJC0oYFvYzCzjPtDwHsrqWssUKlT7PjR4QI7T6LhUhgoBwCFSWBzMdTQd0Y/QIsDuxyB4C/Of HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-usHost: www.quo1ybjmkhdqljoz.topConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:35.0) Gecko/20100101 Firefox/35.0
Source: global traffic	HTTP traffic detected: GET /mzf9/?Efgt_=VwMzyVeI3W9yOBnRaR+LF9uY360A1Ix6ZCcujSeHwM8iEp8lEQ16OTI6knDZMFNitbZGXG3dIXdMrPnIQS/ezuQrinfPOqRcNMPhWKdR0YvVt2hrovA9VjoMv8z6kw4zhwdQ1qr9kBA/&-xTT=j0lPqzQXq HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-usHost: www.espuna.xyzConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:35.0) Gecko/20100101 Firefox/35.0
Source: global traffic	HTTP traffic detected: GET /om19/?Efgt_=sr0MsLXI63IYsoWNjP5cm7PKhF4cUJBFVF34E9rvFfpa9gg3EUzSHXQ0cC0ua0VhnfugJ0Um4HyVQVVXkSzNZHGuxGrfxkuOzKgmGlTFgi+u+7yEmQOH43Hb38zNPzIrc6mRthWbm2aA&-xTT=j0lPqzQXq HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-usHost: www.sirens94.netConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:35.0) Gecko/20100101 Firefox/35.0
Source: global traffic	HTTP traffic detected: GET /woe3/?Efgt_=h1plLNJH8IdDntEr7zEFt458DzTI5R01lP+jXnBAzwvaS6f9N/G3ZDnPYtaTOkgSqo1lvS+gir6y/uMgKrrPz7sAWPQzfYgSP0JMdtC+gVbbMB+fAyqt8PaAl7mYOCPsJTg9NSJzQkoW&-xTT=j0lPqzQXq HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-usHost: www.setrala.xyzConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:35.0) Gecko/20100101 Firefox/35.0

Source: global traffic	DNS traffic detected: DNS query: www.sixfiguredigital.group
Source: global traffic	DNS traffic detected: DNS query: www.playav.mobi
Source: global traffic	DNS traffic detected: DNS query: www.eedpisalgenius.shop
Source: global traffic	DNS traffic detected: DNS query: www.thrivay.website
Source: global traffic	DNS traffic detected: DNS query: www.79456217.xyz
Source: global traffic	DNS traffic detected: DNS query: www.quantumeditor.xyz
Source: global traffic	DNS traffic detected: DNS query: www.valorpackaging.shop
Source: global traffic	DNS traffic detected: DNS query: www.theinitiative.click
Source: global traffic	DNS traffic detected: DNS query: www.scottish.cafe
Source: global traffic	DNS traffic detected: DNS query: www.otonix.xyz
Source: global traffic	DNS traffic detected: DNS query: www.quo1ybjmkhdqljoz.top
Source: global traffic	DNS traffic detected: DNS query: www.espuna.xyz
Source: global traffic	DNS traffic detected: DNS query: www.sirens94.net
Source: global traffic	DNS traffic detected: DNS query: www.setrala.xyz
Source: global traffic	DNS traffic detected: DNS query: www.nexstep.live

Source: unknown

HTTP traffic detected: POST /d70e/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-usAccept-Encoding: gzip, deflate, brHost: www.playav.mobiContent-Length: 218Cache-Control: max-age=0Connection: closeContent-Type: application/x-www-form-urlencodedOrigin: http://www.playav.mobiReferer: http://www.playav.mobi/d70e/User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:35.0) Gecko/20100101 Firefox/35.0Data Raw: 45 66 67 74 5f 3d 6f 37 5a 77 44 4e 47 6f 64 4d 75 53 53 73 73 35 70 59 74 31 44 42 6e 42 71 51 32 54 50 47 39 4a 74 5a 36 41 32 63 4c 41 79 5a 71 65 4f 39 32 6b 7a 47 51 6b 71 49 4b 6f 67 63 30 4b 53 58 73 70 32 74 48 67 41 4f 52 2f 43 4d 41 46 63 4d 59 49 46 52 75 4a 65 6b 49 77 55 51 5a 36 78 7a 49 49 33 78 2b 75 39 57 31 76 78 67 48 39 6b 66 52 43 67 44 34 68 53 61 2b 70 4a 68 43 33 63 6e 70 31 58 78 61 68 76 54 5a 56 6f 57 57 4b 72 58 30 66 50 5a 77 72 65 35 57 58 4d 45 6f 4c 54 6b 7a 30 4e 74 42 50 36 4d 4d 56 34 44 32 42 7a 61 43 73 74 54 2b 2b 65 63 6f 62 73 46 50 7a 6e 54 4a 77 2f 57 58 6a 37 4f 65 54 65 79 78 51 38 6c 62 49 4c 67 3d 3d Data Ascii: Efgt_=o7ZwDNGodMuSSss5pYt1DBnBqQ2TPG9JtZ6A2cLAyZqeO92kzGQkqIKogc0KSXsp2tHgAOR/CMAFcMYIFRuJekIwUQZ6xzII3x+u9W1vxgH9kfRCgD4hSa+pJhC3cnp1XxahvTZVoWWKrX0fPZwre5WXMEoLTkz0NtBP6MMV4D2BzaCstT++ecobsFPznTJw/WXj7OeTeyxQ8lbILg==

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1238date: Mon, 10 Mar 2025 18:39:39 GMTserver: LiteSpeedvary: User-AgentData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 34 37 34 37 34 37 3b 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 31 35 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 10 Mar 2025 18:39:55 GMTServer: ApacheConnection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 63 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 20 73 72 63 3d 22 2f 45 6e 74 72 79 50 6f 69 6e 74 2f 6c 69 62 2f 62 6c 75 65 62 69 72 64 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 20 73 72 63 3d 22 2f 45 6e 74 72 79 50 6f 69 6e 74 2f 6c 69 62 2f 74 73 6c 69 62 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 20 73 72 63 3d 22 2f 45 6e 74 72 79 50 6f 69 6e 74 2f 6c 69 62 2f 6d 61 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 20 73 72 63 3d 22 2f 45 6e 74 72 79 50 6f 69 6e 74 2f 6c 69 62 2f 6d 6f 6d 65 6e 74 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 50 6c 75 67 69 6e 2f 4c 4f 47 4f 53 65 74 74 69 6e 67 2e 6a 73 22 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 20 73 72 63 3d 22 2f 45 6e 74 72 79 50 6f 69 6e 74 2f 61 70 70 5f 34 30 35 34 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 3c 2f 64 69 76 3e 0a 3c 2f 62 6f 64 79 3e 0a 0a 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 1cf<!DOCTYPE html><html><head> <meta charset="utf-8"> <script src="/EntryPoint/lib/bluebird.min.js"></script> <script src="/EntryPoint/lib/tslib.js"></script> <script src="/EntryPoint/lib/main.js"></script> <script src="/EntryPoint/lib/moment.js"></script> <script src="/Plugin/LOGOSetting.js" charset="utf-8"></script> <script src="/EntryPoint/app_4054.js"></script></head><body> <div id="content"></div></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 10 Mar 2025 18:39:57 GMTServer: ApacheConnection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 63 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 20 73 72 63 3d 22 2f 45 6e 74 72 79 50 6f 69 6e 74 2f 6c 69 62 2f 62 6c 75 65 62 69 72 64 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 20 73 72 63 3d 22 2f 45 6e 74 72 79 50 6f 69 6e 74 2f 6c 69 62 2f 74 73 6c 69 62 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 20 73 72 63 3d 22 2f 45 6e 74 72 79 50 6f 69 6e 74 2f 6c 69 62 2f 6d 61 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 20 73 72 63 3d 22 2f 45 6e 74 72 79 50 6f 69 6e 74 2f 6c 69 62 2f 6d 6f 6d 65 6e 74 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 50 6c 75 67 69 6e 2f 4c 4f 47 4f 53 65 74 74 69 6e 67 2e 6a 73 22 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 20 73 72 63 3d 22 2f 45 6e 74 72 79 50 6f 69 6e 74 2f 61 70 70 5f 34 30 35 34 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 3c 2f 64 69 76 3e 0a 3c 2f 62 6f 64 79 3e 0a 0a 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 1cf<!DOCTYPE html><html><head> <meta charset="utf-8"> <script src="/EntryPoint/lib/bluebird.min.js"></script> <script src="/EntryPoint/lib/tslib.js"></script> <script src="/EntryPoint/lib/main.js"></script> <script src="/EntryPoint/lib/moment.js"></script> <script src="/Plugin/LOGOSetting.js" charset="utf-8"></script> <script src="/EntryPoint/app_4054.js"></script></head><body> <div id="content"></div></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 10 Mar 2025 18:40:00 GMTServer: ApacheConnection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 63 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 20 73 72 63 3d 22 2f 45 6e 74 72 79 50 6f 69 6e 74 2f 6c 69 62 2f 62 6c 75 65 62 69 72 64 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 20 73 72 63 3d 22 2f 45 6e 74 72 79 50 6f 69 6e 74 2f 6c 69 62 2f 74 73 6c 69 62 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 20 73 72 63 3d 22 2f 45 6e 74 72 79 50 6f 69 6e 74 2f 6c 69 62 2f 6d 61 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 20 73 72 63 3d 22 2f 45 6e 74 72 79 50 6f 69 6e 74 2f 6c 69 62 2f 6d 6f 6d 65 6e 74 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 50 6c 75 67 69 6e 2f 4c 4f 47 4f 53 65 74 74 69 6e 67 2e 6a 73 22 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 20 73 72 63 3d 22 2f 45 6e 74 72 79 50 6f 69 6e 74 2f 61 70 70 5f 34 30 35 34 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 3c 2f 64 69 76 3e 0a 3c 2f 62 6f 64 79 3e 0a 0a 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 1cf<!DOCTYPE html><html><head> <meta charset="utf-8"> <script src="/EntryPoint/lib/bluebird.min.js"></script> <script src="/EntryPoint/lib/tslib.js"></script> <script src="/EntryPoint/lib/main.js"></script> <script src="/EntryPoint/lib/moment.js"></script> <script src="/Plugin/LOGOSetting.js" charset="utf-8"></script> <script src="/EntryPoint/app_4054.js"></script></head><body> <div id="content"></div></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 10 Mar 2025 18:40:02 GMTServer: ApacheConnection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 63 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 20 73 72 63 3d 22 2f 45 6e 74 72 79 50 6f 69 6e 74 2f 6c 69 62 2f 62 6c 75 65 62 69 72 64 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 20 73 72 63 3d 22 2f 45 6e 74 72 79 50 6f 69 6e 74 2f 6c 69 62 2f 74 73 6c 69 62 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 20 73 72 63 3d 22 2f 45 6e 74 72 79 50 6f 69 6e 74 2f 6c 69 62 2f 6d 61 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 20 73 72 63 3d 22 2f 45 6e 74 72 79 50 6f 69 6e 74 2f 6c 69 62 2f 6d 6f 6d 65 6e 74 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 50 6c 75 67 69 6e 2f 4c 4f 47 4f 53 65 74 74 69 6e 67 2e 6a 73 22 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 20 73 72 63 3d 22 2f 45 6e 74 72 79 50 6f 69 6e 74 2f 61 70 70 5f 34 30 35 34 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 3c 2f 64 69 76 3e 0a 3c 2f 62 6f 64 79 3e 0a 0a 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 1cf<!DOCTYPE html><html><head> <meta charset="utf-8"> <script src="/EntryPoint/lib/bluebird.min.js"></script> <script src="/EntryPoint/lib/tslib.js"></script> <script src="/EntryPoint/lib/main.js"></script> <script src="/EntryPoint/lib/moment.js"></script> <script src="/Plugin/LOGOSetting.js" charset="utf-8"></script> <script src="/EntryPoint/app_4054.js"></script></head><body> <div id="content"></div></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 10 Mar 2025 18:40:21 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36 30 39 36 22 3e
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 10 Mar 2025 18:40:24 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36 30 39 36 22 3e
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 10 Mar 2025 18:40:27 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36 30 39 36 22 3e
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 10 Mar 2025 18:40:29 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 10 Mar 2025 18:40:36 GMTServer: ApacheContent-Length: 262Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 37 39 34 35 36 32 31 37 2e 78 79 7a 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at www.79456217.xyz Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 10 Mar 2025 18:40:38 GMTServer: ApacheContent-Length: 262Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 37 39 34 35 36 32 31 37 2e 78 79 7a 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at www.79456217.xyz Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 10 Mar 2025 18:40:41 GMTServer: ApacheContent-Length: 262Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 37 39 34 35 36 32 31 37 2e 78 79 7a 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at www.79456217.xyz Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 10 Mar 2025 18:40:44 GMTServer: ApacheContent-Length: 262Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 37 39 34 35 36 32 31 37 2e 78 79 7a 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at www.79456217.xyz Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.1Date: Mon, 10 Mar 2025 18:42:41 GMTContent-Length: 0Connection: closeX-Rate-Limit-Limit: 5sX-Rate-Limit-Remaining: 19X-Rate-Limit-Reset: 2025-03-10T18:42:46.4573642Z

Source: URGENT REQUEST FOR QUOTATION.exe	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: URGENT REQUEST FOR QUOTATION.exe	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.6.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: URGENT REQUEST FOR QUOTATION.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: URGENT REQUEST FOR QUOTATION.exe, 00000000.00000002.998995023.0000000002933000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: PresentationHost.exe, 0000000E.00000002.3373669212.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, H792vWLf9Fx1Mp7TRJ.exe, 0000000F.00000002.3370825596.00000000033B4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.1665018757.00000000346D4000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.litespeedtech.com/error-page
Source: H792vWLf9Fx1Mp7TRJ.exe, 0000000F.00000002.3372784799.0000000005452000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.setrala.xyz
Source: H792vWLf9Fx1Mp7TRJ.exe, 0000000F.00000002.3372784799.0000000005452000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.setrala.xyz/woe3/
Source: PresentationHost.exe, 0000000E.00000002.3377050709.00000000081CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org?q=
Source: PresentationHost.exe, 0000000E.00000002.3377050709.00000000081CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: PresentationHost.exe, 0000000E.00000002.3373669212.0000000005DAA000.00000004.10000000.00040000.00000000.sdmp, H792vWLf9Fx1Mp7TRJ.exe, 0000000F.00000002.3370825596.000000000386A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css
Source: PresentationHost.exe, 0000000E.00000002.3377050709.00000000081CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: PresentationHost.exe, 0000000E.00000002.3377050709.00000000081CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: PresentationHost.exe, 0000000E.00000002.3377050709.00000000081CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=
Source: PresentationHost.exe, 0000000E.00000002.3377050709.00000000081CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: PresentationHost.exe, 0000000E.00000002.3377050709.00000000081CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabv20
Source: PresentationHost.exe, 0000000E.00000002.3373669212.00000000068A8000.00000004.10000000.00040000.00000000.sdmp, H792vWLf9Fx1Mp7TRJ.exe, 0000000F.00000002.3370825596.0000000004368000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://error.skycloud.tw/system/error?code=400
Source: edb.log.6.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000006.00000003.1204257794.0000029DF8D90000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.6.dr, edb.log.6.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: PresentationHost.exe, 0000000E.00000002.3377050709.00000000081CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/app?q=
Source: PresentationHost.exe, 0000000E.00000002.3369398408.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.co
Source: PresentationHost.exe, 0000000E.00000002.3369398408.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: PresentationHost.exe, 0000000E.00000002.3369398408.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: PresentationHost.exe, 0000000E.00000002.3369398408.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: PresentationHost.exe, 0000000E.00000002.3369398408.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033t
Source: PresentationHost.exe, 0000000E.00000002.3369398408.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: PresentationHost.exe, 0000000E.00000002.3369398408.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: qmgr.db.6.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: URGENT REQUEST FOR QUOTATION.exe	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0
Source: PresentationHost.exe, 0000000E.00000002.3377050709.00000000081CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/v20
Source: PresentationHost.exe, 0000000E.00000002.3373669212.0000000006584000.00000004.10000000.00040000.00000000.sdmp, PresentationHost.exe, 0000000E.00000002.3376879702.0000000007EE0000.00000004.00000800.00020000.00000000.sdmp, H792vWLf9Fx1Mp7TRJ.exe, 0000000F.00000002.3370825596.0000000004044000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: PresentationHost.exe, 0000000E.00000002.3377050709.00000000081CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1373353315.0000000001050000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1372904719.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3372784799.0000000005400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3370961609.0000000002C90000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1374655242.00000000014F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: URGENT REQUEST FOR QUOTATION.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0042CE83 NtClose,	4_2_0042CE83
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01112B60 NtClose,LdrInitializeThunk,	4_2_01112B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01112DF0 NtQuerySystemInformation,LdrInitializeThunk,	4_2_01112DF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01112C70 NtFreeVirtualMemory,LdrInitializeThunk,	4_2_01112C70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_011135C0 NtCreateMutant,LdrInitializeThunk,	4_2_011135C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01114340 NtSetContextThread,	4_2_01114340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01114650 NtSuspendThread,	4_2_01114650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01112B80 NtQueryInformationFile,	4_2_01112B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01112BA0 NtEnumerateValueKey,	4_2_01112BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01112BF0 NtAllocateVirtualMemory,	4_2_01112BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01112BE0 NtQueryValueKey,	4_2_01112BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01112AB0 NtWaitForSingleObject,	4_2_01112AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01112AD0 NtReadFile,	4_2_01112AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01112AF0 NtWriteFile,	4_2_01112AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01112D10 NtMapViewOfSection,	4_2_01112D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01112D00 NtSetInformationFile,	4_2_01112D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01112D30 NtUnmapViewOfSection,	4_2_01112D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01112DB0 NtEnumerateKey,	4_2_01112DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01112DD0 NtDelayExecution,	4_2_01112DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01112C00 NtQueryInformationProcess,	4_2_01112C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01112C60 NtCreateKey,	4_2_01112C60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01112CA0 NtQueryInformationToken,	4_2_01112CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01112CC0 NtQueryVirtualMemory,	4_2_01112CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01112CF0 NtOpenProcess,	4_2_01112CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01112F30 NtCreateSection,	4_2_01112F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01112F60 NtCreateProcessEx,	4_2_01112F60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01112F90 NtProtectVirtualMemory,	4_2_01112F90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01112FB0 NtResumeThread,	4_2_01112FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01112FA0 NtQuerySection,	4_2_01112FA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01112FE0 NtCreateFile,	4_2_01112FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01112E30 NtWriteVirtualMemory,	4_2_01112E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01112E80 NtReadVirtualMemory,	4_2_01112E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01112EA0 NtAdjustPrivilegesToken,	4_2_01112EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01112EE0 NtQueueApcThread,	4_2_01112EE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01113010 NtOpenDirectoryObject,	4_2_01113010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01113090 NtSetValueKey,	4_2_01113090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_011139B0 NtGetContextThread,	4_2_011139B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01113D10 NtOpenProcessToken,	4_2_01113D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01113D70 NtOpenThread,	4_2_01113D70

Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Code function: 0_2_028B3E40	0_2_028B3E40
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Code function: 0_2_028BD6FC	0_2_028BD6FC
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Code function: 0_2_06BC9A30	0_2_06BC9A30
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Code function: 0_2_06BC153F	0_2_06BC153F
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Code function: 0_2_06BC3560	0_2_06BC3560
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Code function: 0_2_06BC3550	0_2_06BC3550
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Code function: 0_2_06BC2C38	0_2_06BC2C38
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Code function: 0_2_06BC3998	0_2_06BC3998
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Code function: 0_2_06BC1998	0_2_06BC1998
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Code function: 0_2_06BC3989	0_2_06BC3989
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Code function: 0_2_08360040	0_2_08360040
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Code function: 0_2_083634F8	0_2_083634F8
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Code function: 0_2_0836FB69	0_2_0836FB69
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Code function: 0_2_08365310	0_2_08365310
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Code function: 0_2_083634E9	0_2_083634E9
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Code function: 0_2_08366518	0_2_08366518
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00418D53	4_2_00418D53
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0040E803	4_2_0040E803
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00401120	4_2_00401120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0040421E	4_2_0040421E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0042F463	4_2_0042F463
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00402420	4_2_00402420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_004104B3	4_2_004104B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_004026C0	4_2_004026C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_004106D3	4_2_004106D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_004026F9	4_2_004026F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00402EB0	4_2_00402EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0040E6B3	4_2_0040E6B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00416F50	4_2_00416F50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00416F53	4_2_00416F53
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0040E7F9	4_2_0040E7F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_010D0100	4_2_010D0100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0117A118	4_2_0117A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01168158	4_2_01168158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_011A01AA	4_2_011A01AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_011981CC	4_2_011981CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01172000	4_2_01172000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0119A352	4_2_0119A352
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_011A03E6	4_2_011A03E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_010EE3F0	4_2_010EE3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01180274	4_2_01180274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_011602C0	4_2_011602C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_010E0535	4_2_010E0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_011A0591	4_2_011A0591
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01192446	4_2_01192446
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0118E4F6	4_2_0118E4F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01104750	4_2_01104750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_010E0770	4_2_010E0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_010DC7C0	4_2_010DC7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_010FC6E0	4_2_010FC6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_010F6962	4_2_010F6962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_010E29A0	4_2_010E29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_011AA9A6	4_2_011AA9A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_010E2840	4_2_010E2840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_010EA840	4_2_010EA840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_010C68B8	4_2_010C68B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0110E8F0	4_2_0110E8F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0119AB40	4_2_0119AB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01196BD7	4_2_01196BD7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_010DEA80	4_2_010DEA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_010EAD00	4_2_010EAD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_010F8DBF	4_2_010F8DBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_010DADE0	4_2_010DADE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_010E0C00	4_2_010E0C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01180CB5	4_2_01180CB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_010D0CF2	4_2_010D0CF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01100F30	4_2_01100F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01122F28	4_2_01122F28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01154F40	4_2_01154F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0115EFA0	4_2_0115EFA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_010D2FC8	4_2_010D2FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_010ECFE0	4_2_010ECFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0119EE26	4_2_0119EE26
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_010E0E59	4_2_010E0E59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0119CE93	4_2_0119CE93
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_010F2E90	4_2_010F2E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0119EEDB	4_2_0119EEDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_011AB16B	4_2_011AB16B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0111516C	4_2_0111516C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_010CF172	4_2_010CF172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_010EB1B0	4_2_010EB1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_010E70C0	4_2_010E70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0118F0CC	4_2_0118F0CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_011970E9	4_2_011970E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0119F0E0	4_2_0119F0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0119132D	4_2_0119132D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_010CD34C	4_2_010CD34C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0112739A	4_2_0112739A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_010E52A0	4_2_010E52A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_010FB2C0	4_2_010FB2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_011812ED	4_2_011812ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01197571	4_2_01197571
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0117D5B0	4_2_0117D5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0119F43F	4_2_0119F43F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_010D1460	4_2_010D1460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0119F7B0	4_2_0119F7B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_011916CC	4_2_011916CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01175910	4_2_01175910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_010E9950	4_2_010E9950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_010FB950	4_2_010FB950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0114D800	4_2_0114D800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_010E38E0	4_2_010E38E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0119FB76	4_2_0119FB76
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_010FFB80	4_2_010FFB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01155BF0	4_2_01155BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0111DBF9	4_2_0111DBF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0119FA49	4_2_0119FA49
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01197A46	4_2_01197A46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01153A6C	4_2_01153A6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01125AA0	4_2_01125AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0117DAAC	4_2_0117DAAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0118DAC6	4_2_0118DAC6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01191D5A	4_2_01191D5A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_010E3D40	4_2_010E3D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01197D73	4_2_01197D73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_010FFDC0	4_2_010FFDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01159C32	4_2_01159C32
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0119FCF2	4_2_0119FCF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0119FF09	4_2_0119FF09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_010E1F92	4_2_010E1F92
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0119FFB1	4_2_0119FFB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_010E9EB0	4_2_010E9EB0
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F765D0	14_2_04F765D0
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F765B2	14_2_04F765B2
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F20535	14_2_04F20535
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F3C6E0	14_2_04F3C6E0
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F20770	14_2_04F20770
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F44750	14_2_04F44750
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F66000	14_2_04F66000
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F10100	14_2_04F10100
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04FA02C0	14_2_04FA02C0
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F2E3F0	14_2_04F2E3F0
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F10CF2	14_2_04F10CF2
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F20C00	14_2_04F20C00
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F28DC0	14_2_04F28DC0
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F38DBF	14_2_04F38DBF
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F2ED7A	14_2_04F2ED7A
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F2AD00	14_2_04F2AD00
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F32ED9	14_2_04F32ED9
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F20E59	14_2_04F20E59
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F12FC8	14_2_04F12FC8
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F9EFA0	14_2_04F9EFA0
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F94F40	14_2_04F94F40
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F40F30	14_2_04F40F30
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F62F28	14_2_04F62F28
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F128F0	14_2_04F128F0
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F068F1	14_2_04F068F1
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F4E8F0	14_2_04F4E8F0
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F58890	14_2_04F58890
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F2A840	14_2_04F2A840
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F36962	14_2_04F36962
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F1EA80	14_2_04F1EA80
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F22A45	14_2_04F22A45
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F674E0	14_2_04F674E0
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F23497	14_2_04F23497
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F2B730	14_2_04F2B730
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F2B1B0	14_2_04F2B1B0
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F0F172	14_2_04F0F172
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F5516C	14_2_04F5516C
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F3D2F0	14_2_04F3D2F0
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F252A0	14_2_04F252A0
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F233F3	14_2_04F233F3
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F99C32	14_2_04F99C32
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F39C20	14_2_04F39C20
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F3FDC0	14_2_04F3FDC0
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F23D40	14_2_04F23D40
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F29EB0	14_2_04F29EB0
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F21F92	14_2_04F21F92
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F238E0	14_2_04F238E0
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F8D800	14_2_04F8D800
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F259DA	14_2_04F259DA
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F11979	14_2_04F11979
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F29950	14_2_04F29950
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F3B950	14_2_04F3B950
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F93A6C	14_2_04F93A6C
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F95BF0	14_2_04F95BF0
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F5DBF9	14_2_04F5DBF9
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F3FB80	14_2_04F3FB80
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_02DA2510	14_2_02DA2510
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_02D9D340	14_2_02D9D340
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_02D9D337	14_2_02D9D337
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_02D9D560	14_2_02D9D560
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	Code function: 15_2_0542E562	15_2_0542E562
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	Code function: 15_2_0540F5B2	15_2_0540F5B2
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	Code function: 15_2_0540F7D2	15_2_0540F7D2
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	Code function: 15_2_05414782	15_2_05414782
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	Code function: 15_2_0540D7B2	15_2_0540D7B2
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	Code function: 15_2_05417E52	15_2_05417E52
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	Code function: 15_2_0540D902	15_2_0540D902
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	Code function: 15_2_0541604F	15_2_0541604F
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	Code function: 15_2_05416052	15_2_05416052
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	Code function: 15_2_0540D8F8	15_2_0540D8F8
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	Code function: 15_2_0540331D	15_2_0540331D
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 16_2_00000200740FA2A7	16_2_00000200740FA2A7
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 16_2_00000200740FA75C	16_2_00000200740FA75C
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 16_2_00000200740FA3C4	16_2_00000200740FA3C4
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 16_2_00000200740F9828	16_2_00000200740F9828

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 010CB970 appears 275 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 01127E54 appears 100 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 0114EA12 appears 86 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 0115F290 appears 105 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 01115130 appears 57 times
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: String function: 04F67E54 appears 97 times
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: String function: 04F8EA12 appears 37 times

Source: URGENT REQUEST FOR QUOTATION.exe

Static PE information: invalid certificate

Source: URGENT REQUEST FOR QUOTATION.exe, 00000000.00000002.998995023.0000000002944000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTL.dll" vs URGENT REQUEST FOR QUOTATION.exe
Source: URGENT REQUEST FOR QUOTATION.exe, 00000000.00000002.1013055915.0000000006EB0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs URGENT REQUEST FOR QUOTATION.exe
Source: URGENT REQUEST FOR QUOTATION.exe, 00000000.00000002.1008152362.00000000051E0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTL.dll" vs URGENT REQUEST FOR QUOTATION.exe
Source: URGENT REQUEST FOR QUOTATION.exe, 00000000.00000002.1015454791.00000000083FF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePowerShell.EXE.MUIj% vs URGENT REQUEST FOR QUOTATION.exe
Source: URGENT REQUEST FOR QUOTATION.exe, 00000000.00000002.1015454791.00000000083FF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePowerShell.EXEj% vs URGENT REQUEST FOR QUOTATION.exe
Source: URGENT REQUEST FOR QUOTATION.exe, 00000000.00000002.998166623.0000000000C9E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs URGENT REQUEST FOR QUOTATION.exe
Source: URGENT REQUEST FOR QUOTATION.exe	Binary or memory string: OriginalFilenamekQZo.exe. vs URGENT REQUEST FOR QUOTATION.exe

Source: URGENT REQUEST FOR QUOTATION.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: URGENT REQUEST FOR QUOTATION.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.URGENT REQUEST FOR QUOTATION.exe.6eb0000.5.raw.unpack, NBTWliVixP5LrfaYVa.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.URGENT REQUEST FOR QUOTATION.exe.6eb0000.5.raw.unpack, NBTWliVixP5LrfaYVa.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.URGENT REQUEST FOR QUOTATION.exe.6eb0000.5.raw.unpack, NBTWliVixP5LrfaYVa.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.URGENT REQUEST FOR QUOTATION.exe.6eb0000.5.raw.unpack, EBDIbTw4pY7I2rxOyU.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.URGENT REQUEST FOR QUOTATION.exe.6eb0000.5.raw.unpack, EBDIbTw4pY7I2rxOyU.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@13/10@16/11

Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\URGENT REQUEST FOR QUOTATION.exe.log

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6320:120:WilError_03

Source: unknown	Process created: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe "C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe"
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe"
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	Process created: C:\Windows\SysWOW64\PresentationHost.exe "C:\Windows\SysWOW64\PresentationHost.exe"
Source: C:\Windows\SysWOW64\PresentationHost.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe"	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	Process created: C:\Windows\SysWOW64\PresentationHost.exe "C:\Windows\SysWOW64\PresentationHost.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00418871 push eax; iretd	4_2_00418872
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0041F834 push ss; iretd	4_2_0041F835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_004120A7 push 3563E107h; iretd	4_2_004120AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0040216F push ss; iretd	4_2_00402170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00403170 push eax; ret	4_2_00403172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0040D1AD push es; iretd	4_2_0040D1C1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00413A53 push ebx; iretd	4_2_00413A5F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00401A1E push ss; iretd	4_2_00401A51
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_004082C5 push edi; iretd	4_2_004082C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00401AE8 push ss; retf	4_2_00401AEA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00401A86 push ss; iretd	4_2_00401A51
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00414B20 push 6BF5C304h; retf	4_2_00414B3E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00401576 push ss; iretd	4_2_0040158F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0040166C push ss; retf	4_2_00401672
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_004017E6 push ss; iretd	4_2_004017EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_004197AC push 00000037h; retf	4_2_004197E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_010D09AD push ecx; mov dword ptr [esp], ecx	4_2_010D09B6
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F109AD push ecx; mov dword ptr [esp], ecx	14_2_04F109B6
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04F67E99 push ecx; ret	14_2_04F67EAC
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_04EE1FEC push eax; iretd	14_2_04EE1FED
Source: C:\Windows\SysWOW64\PresentationHost.exe	Code function: 14_2_02D9EF34 push 3563E107h; iretd	14_2_02D9EF39
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	Code function: 15_2_05413C1F push 6BF5C304h; retf	15_2_05413C3D
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	Code function: 15_2_05412F92 push ds; iretd	15_2_05413007
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	Code function: 15_2_054111A6 push 3563E107h; iretd	15_2_054111AB
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	Code function: 15_2_05400002 push ss; retf	15_2_0540000D
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	Code function: 15_2_0540902A push edx; retf	15_2_0540902D
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	Code function: 15_2_05409090 push esp; ret	15_2_05409092
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	Code function: 15_2_054188AF push 00000037h; retf	15_2_054188DF
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	Code function: 15_2_0540735B pushad ; iretd	15_2_05407365

Source: 0.2.URGENT REQUEST FOR QUOTATION.exe.6eb0000.5.raw.unpack, zvN87Kt09WDLmfTb9p.cs	High entropy of concatenated method names: 'eqfY8A5bF7', 'PoCYOHKgOK', 'FiSYC0O5WA', 'gwHYemK0ET', 'OqCYj4OoF9', 'd1hYDVPlnw', 'DEpYrZUuNh', 'DtxYwSnlC1', 'YobY1r1UcK', 'zusYSFxYFu'
Source: 0.2.URGENT REQUEST FOR QUOTATION.exe.6eb0000.5.raw.unpack, EBDIbTw4pY7I2rxOyU.cs	High entropy of concatenated method names: 'VXRaqtYpqR', 'W1EacTmYoA', 'URxad7JHeY', 'DbMapiC2Ji', 'kdUavaJ0ce', 'EfvamhqJtv', 'tW1aAx0QUA', 'nfiaRbJEXm', 'li0aTSFtRk', 'xW5a6xLcFd'
Source: 0.2.URGENT REQUEST FOR QUOTATION.exe.6eb0000.5.raw.unpack, AKnucSSMLnnp9Lmdx4.cs	High entropy of concatenated method names: 'd3x5jTAHcE', 'GDv5rJ61Mg', 'fbcXy5a0ha', 'B88X7wedeb', 'oBAXGTCcV4', 'iZBX053Ept', 'Cb7XiKhlit', 'piVXs3vAZ0', 'vswXtOdZa1', 'VWIXuHyVVs'
Source: 0.2.URGENT REQUEST FOR QUOTATION.exe.6eb0000.5.raw.unpack, jGmtiBAXhkdTpPB4AY.cs	High entropy of concatenated method names: 'pv6FgFyNjd', 'fIsFlxf0i2', 'AnNFFMWanN', 'B3iF2D5hiG', 'wO9FEMZsww', 'ynQFxJrhov', 'Dispose', 'L3VKf7BNAI', 'ydfKa6eBIN', 'DqAKXdGylY'
Source: 0.2.URGENT REQUEST FOR QUOTATION.exe.6eb0000.5.raw.unpack, LZ1dCTiSrQyVD57FXb.cs	High entropy of concatenated method names: 'fdfYf8UBOm', 'xIvYXpymaX', 'L6BYkT0iTQ', 'ebsk6x3YrB', 'QBwkzG8PMb', 'wt9YbopfQg', 'ytxY4hGBhp', 'vOcYo2XreN', 'Ct1YUiCrtF', 'fBJYIdPulm'
Source: 0.2.URGENT REQUEST FOR QUOTATION.exe.6eb0000.5.raw.unpack, lSa3Q2asufZCLbHKWn.cs	High entropy of concatenated method names: 'Dispose', 'jdT4TpPB4A', 'bpyoZN0TjW', 'z5IQ7EPDbs', 'jbt46MdJZg', 'OVq4z9lT1B', 'ProcessDialogKey', 'T2oobQZieX', 'coGo4UHrKS', 'ULuooNxCBh'
Source: 0.2.URGENT REQUEST FOR QUOTATION.exe.6eb0000.5.raw.unpack, lrA8ZPJYjaUrDe01qC.cs	High entropy of concatenated method names: 'CxMkNDfhL2', 'YW5kaZN35l', 'Lnxk58UfAV', 'OcPkYc0Lrp', 'SjbkVkgQKI', 'O3L5vHlQga', 'MFC5mC2kkj', 'ufV5AriRLM', 'I0c5Rkuge8', 'GHa5Tj94Qo'
Source: 0.2.URGENT REQUEST FOR QUOTATION.exe.6eb0000.5.raw.unpack, NBTWliVixP5LrfaYVa.cs	High entropy of concatenated method names: 'ajQUNRvQYw', 'vbJUfSFGrK', 'vGeUavJsCK', 'R7oUX89SZU', 'hLgU5kHNH3', 'H32UkJA7MF', 'hgCUYRDDxY', 'vSOUVkS2XN', 'LenUHMONKh', 'otKUhIAVGg'
Source: 0.2.URGENT REQUEST FOR QUOTATION.exe.6eb0000.5.raw.unpack, bQZieXTUoGUHrKSmLu.cs	High entropy of concatenated method names: 'JJJFJLAcXE', 'vFEFZSaVZJ', 'aIKFyIKDHe', 'wh1F7k4d6N', 'dtHFGCseYO', 'NT5F0hgtfB', 'JGFFihQDHY', 'jo9FsYnIfs', 'JVqFtoE8lV', 'SVIFuWpp9M'
Source: 0.2.URGENT REQUEST FOR QUOTATION.exe.6eb0000.5.raw.unpack, LP8qy8Ipmakp2orFrc.cs	High entropy of concatenated method names: 'C714YBDIbT', 'bpY4V7I2rx', 'Om84hFEKE2', 'sAP4WSjKnu', 'Qmd4gx4HrA', 'yZP4QYjaUr', 'lLftsNVGCwEwnggLvM', 'C9dZLQZ0ZX2aX6x9wX', 'rRa44u6iso', 'wCS4UBKvEn'
Source: 0.2.URGENT REQUEST FOR QUOTATION.exe.6eb0000.5.raw.unpack, wUFGvqpadXLyYtXa07.cs	High entropy of concatenated method names: 'th2lhnWul4', 'CpclWybwK5', 'ToString', 'E54lfM2yLQ', 'awulaqKr4M', 'bVglXsro0k', 'Ubml5WZ0U5', 'DewlkYeUJB', 'zDVlY3Zn1w', 'FfIlV2xa5E'
Source: 0.2.URGENT REQUEST FOR QUOTATION.exe.6eb0000.5.raw.unpack, D3f0Xd44x8lhhxOKAHQ.cs	High entropy of concatenated method names: 'KsX96ekwJp', 'tbD9zQJYe1', 'Ord2bXYFaH', 'Atj249uVYO', 'sKn2o8sbXb', 'Xcm2UaFxmx', 'Oda2IycaHN', 'eZj2NNWWeS', 'A432fqgZZq', 'hLT2aMhnkC'
Source: 0.2.URGENT REQUEST FOR QUOTATION.exe.6eb0000.5.raw.unpack, ecKDkvolKskuJkYfZx.cs	High entropy of concatenated method names: 'f6bCIlAdK', 'Pu7eCtSFo', 'PnkDAX2T1', 'exZrmSahX', 'yuO1bUdip', 'z07SkOQQJ', 'NL4tQshUGCJHq1PTWV', 'Qqr0UaqjvQT113S1wW', 'id5KrGCYy', 'om79NlWP3'
Source: 0.2.URGENT REQUEST FOR QUOTATION.exe.6eb0000.5.raw.unpack, C8rJXB1m8FEKE2FAPS.cs	High entropy of concatenated method names: 'YyhXe90Bh6', 'guuXD9JA7j', 'MpZXwFBGZN', 'q3UX1Tgl9j', 'paqXg76qbI', 'GkGXQ3SMxP', 'aqyXlxNLx1', 'tmbXKxsSjF', 'NQ7XFEsXSp', 'rsZX9qdcak'
Source: 0.2.URGENT REQUEST FOR QUOTATION.exe.6eb0000.5.raw.unpack, S5u7PHqfKxdChB8hT1.cs	High entropy of concatenated method names: 'UiRguXtcmK', 'yWngPSiNE5', 'fWMgqfyPwu', 'JcTgcrpCuW', 'GWTgZNFN2i', 'bMigyVgxXt', 'Gw1g7Ograe', 'MyCgG65n2h', 'UlIg0C0o5L', 'sDjgiesKL3'
Source: 0.2.URGENT REQUEST FOR QUOTATION.exe.6eb0000.5.raw.unpack, exCBhN6lAkGPsDEKit.cs	High entropy of concatenated method names: 'gvZ9XH0N29', 'E7Y95B37Ie', 'ziu9k29pYQ', 'B949YOOAVO', 'tbC9FhkA5u', 'lsv9Vpc4cX', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.URGENT REQUEST FOR QUOTATION.exe.6eb0000.5.raw.unpack, LbasNM4bYoATQ68vVYf.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'n619BSYrso', 'syQ9P219cE', 'ijP9L17tWp', 'LHG9qGq1Vb', 'WFA9cfskAM', 'laX9d4Ogub', 'zSe9pk0MZb'
Source: 0.2.URGENT REQUEST FOR QUOTATION.exe.6eb0000.5.raw.unpack, Wxuhy64IpH8pef2SR6Y.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'i173FIQZgo', 's0k39GGNgn', 'N4Y32hC8h3', 'saw33QqB2C', 'xvX3E5CmqM', 'CgK3nIsS1s', 'IGb3xpfGuU'
Source: 0.2.URGENT REQUEST FOR QUOTATION.exe.6eb0000.5.raw.unpack, jcZUsgXLv6qVqH8AmD.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'eNQoTSkiPZ', 'KuAo6jGvXE', 'L5gozAHXLl', 'FIuUbMKa00', 'v2MU4jqQpx', 'emOUoxmJNr', 'O8JUUs3NSF', 'qAvZYMoRFh0JhSaViLF'
Source: 0.2.URGENT REQUEST FOR QUOTATION.exe.6eb0000.5.raw.unpack, ammuoQ4U6pVCANNEsx0.cs	High entropy of concatenated method names: 'JkS26Qx2Ur', 's1D2zcJyCX', 'bxs3bEIIZp', 'Dbus73RugE88mycFcQp', 'chZ14eRGiWDOxhAM4mN', 'awET9xRVCFkuY1w3UaS', 'dco5PfRZUOqOacnnWOb'
Source: 0.2.URGENT REQUEST FOR QUOTATION.exe.6eb0000.5.raw.unpack, UEM3NsztOoABrM4VII.cs	High entropy of concatenated method names: 'B7H9DHGNv4', 'pA89wOHEJv', 'wMs91CuWoc', 'KDx9JSZnwg', 'Dqd9ZYBXH7', 'rvt97hyEQV', 'qPf9Grotn4', 'UD19xso2Xd', 'yf998RUH1I', 'yVp9Ov8vEm'
Source: 0.2.URGENT REQUEST FOR QUOTATION.exe.6eb0000.5.raw.unpack, zpgQiOmYGoACbSgC01.cs	High entropy of concatenated method names: 'HRQlRs7n5p', 'uX1l6VQOma', 'WA1KbrjIFt', 'i3FK41ODbi', 'aSBlBrYAtH', 'L2ClPcBhyy', 'JQrlL9Itn2', 'vUVlqmX3wg', 'SALlcYiSll', 'taQld3Sj4I'
Source: 0.2.URGENT REQUEST FOR QUOTATION.exe.6eb0000.5.raw.unpack, LIhflyLyObfy55mLim.cs	High entropy of concatenated method names: 'oSYMwWOcHX', 'zlOM10HNjk', 'mTuMJrg59f', 'c4HMZoxGYk', 'KJKM7oQ4Om', 'mnqMGWFRB6', 'iWmMiIU6rj', 'n08Ms8tZgu', 'hPKMuRL6lN', 's3pMBDdbav'

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\PresentationHost.exe	API/Special instruction interceptor: Address: 7FFC1B60D324
Source: C:\Windows\SysWOW64\PresentationHost.exe	API/Special instruction interceptor: Address: 7FFC1B60D7E4
Source: C:\Windows\SysWOW64\PresentationHost.exe	API/Special instruction interceptor: Address: 7FFC1B60D944
Source: C:\Windows\SysWOW64\PresentationHost.exe	API/Special instruction interceptor: Address: 7FFC1B60D504
Source: C:\Windows\SysWOW64\PresentationHost.exe	API/Special instruction interceptor: Address: 7FFC1B60D544
Source: C:\Windows\SysWOW64\PresentationHost.exe	API/Special instruction interceptor: Address: 7FFC1B60D1E4
Source: C:\Windows\SysWOW64\PresentationHost.exe	API/Special instruction interceptor: Address: 7FFC1B610154
Source: C:\Windows\SysWOW64\PresentationHost.exe	API/Special instruction interceptor: Address: 7FFC1B60DA44

Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Memory allocated: F30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Memory allocated: 28E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Memory allocated: 2700000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Memory allocated: 85F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Memory allocated: 95F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Memory allocated: 97E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Memory allocated: A7E0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4173	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Window / User API: threadDelayed 984	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Window / User API: threadDelayed 8986	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	API coverage: 0.7 %
Source: C:\Windows\SysWOW64\PresentationHost.exe	API coverage: 2.2 %

Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe TID: 7112	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6608	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6568	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6072	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe TID: 4544	Thread sleep count: 984 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe TID: 4544	Thread sleep time: -1968000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe TID: 4544	Thread sleep count: 8986 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe TID: 4544	Thread sleep time: -17972000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe TID: 5804	Thread sleep time: -70000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe TID: 5804	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe TID: 5804	Thread sleep time: -51000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe TID: 5804	Thread sleep count: 39 > 30	Jump to behavior
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe TID: 5804	Thread sleep time: -39000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\PresentationHost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PresentationHost.exe	Last function: Thread delayed

Source: PresentationHost.exe, 0000000E.00000002.3377050709.000000000822D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: omVMwareV
Source: PresentationHost.exe, 0000000E.00000002.3377050709.000000000822D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware20,11696492231n
Source: 8510T71-3.14.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: 8510T71-3.14.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: 8510T71-3.14.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: PresentationHost.exe, 0000000E.00000002.3377050709.000000000822D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware20,1169649
Source: PresentationHost.exe, 0000000E.00000002.3377050709.000000000822D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware20,11696492231t
Source: 8510T71-3.14.dr	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: 8510T71-3.14.dr	Binary or memory string: AMC password management pageVMware20,11696492231
Source: 8510T71-3.14.dr	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: 8510T71-3.14.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: svchost.exe, 00000006.00000002.3373465534.0000029DF9058000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.3370692100.0000029DF382B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 8510T71-3.14.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: 8510T71-3.14.dr	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: PresentationHost.exe, 0000000E.00000002.3377050709.000000000822D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .co.inVMware20,11696492231d
Source: PresentationHost.exe, 0000000E.00000002.3377050709.000000000822D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,116
Source: 8510T71-3.14.dr	Binary or memory string: discord.comVMware20,11696492231f
Source: firefox.exe, 00000010.00000002.1666346216.000002007434C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllII
Source: 8510T71-3.14.dr	Binary or memory string: global block list test formVMware20,11696492231
Source: 8510T71-3.14.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: 8510T71-3.14.dr	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: PresentationHost.exe, 0000000E.00000002.3377050709.000000000822D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware20F
Source: 8510T71-3.14.dr	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: 8510T71-3.14.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: 8510T71-3.14.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: 8510T71-3.14.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: URGENT REQUEST FOR QUOTATION.exe, 00000000.00000002.1014757554.0000000008390000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}p
Source: 8510T71-3.14.dr	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: 8510T71-3.14.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: 8510T71-3.14.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]
Source: 8510T71-3.14.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: 8510T71-3.14.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: 8510T71-3.14.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: PresentationHost.exe, 0000000E.00000002.3377050709.000000000822D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,1169649223g
Source: 8510T71-3.14.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: 8510T71-3.14.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: PresentationHost.exe, 0000000E.00000002.3377050709.000000000822D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: n PasswordVMware20,11696492231x
Source: 8510T71-3.14.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: PresentationHost.exe, 0000000E.00000002.3369398408.00000000031DE000.00000004.00000020.00020000.00000000.sdmp, H792vWLf9Fx1Mp7TRJ.exe, 0000000F.00000002.3369821001.0000000000FC9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 8510T71-3.14.dr	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: 8510T71-3.14.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: 8510T71-3.14.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: PresentationHost.exe, 0000000E.00000002.3377050709.000000000822D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware20z
Source: PresentationHost.exe, 0000000E.00000002.3377050709.000000000822D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rokers - COM.HKVMware20,11696492231
Source: PresentationHost.exe, 0000000E.00000002.3377050709.000000000822D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware20
Source: 8510T71-3.14.dr	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: PresentationHost.exe, 0000000E.00000002.3377050709.000000000822D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ist test formVMware20,11%
Source: 8510T71-3.14.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	NtQueryVolumeInformationFile: Direct from: 0x776D2F2C	Jump to behavior
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	NtQuerySystemInformation: Direct from: 0x776D48CC	Jump to behavior
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	NtAllocateVirtualMemory: Direct from: 0x776D48EC	Jump to behavior
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	NtOpenSection: Direct from: 0x776D2E0C	Jump to behavior
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	NtDeviceIoControlFile: Direct from: 0x776D2AEC	Jump to behavior
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	NtAllocateVirtualMemory: Direct from: 0x776D2BEC	Jump to behavior
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	NtQueryInformationProcess: Direct from: 0x776D2C26	Jump to behavior
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	NtResumeThread: Direct from: 0x776D2FBC	Jump to behavior
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	NtWriteVirtualMemory: Direct from: 0x776D490C	Jump to behavior
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	NtCreateUserProcess: Direct from: 0x776D371C	Jump to behavior
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	NtClose: Direct from: 0x776D2B6C
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	NtAllocateVirtualMemory: Direct from: 0x776D3C9C	Jump to behavior
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	NtSetInformationThread: Direct from: 0x776C63F9	Jump to behavior
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	NtQueryAttributesFile: Direct from: 0x776D2E6C	Jump to behavior
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	NtSetInformationThread: Direct from: 0x776D2B4C	Jump to behavior
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	NtReadVirtualMemory: Direct from: 0x776D2E8C	Jump to behavior
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	NtCreateKey: Direct from: 0x776D2C6C	Jump to behavior
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	NtResumeThread: Direct from: 0x776D36AC	Jump to behavior
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	NtMapViewOfSection: Direct from: 0x776D2D1C	Jump to behavior
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	NtWriteVirtualMemory: Direct from: 0x776D2E3C	Jump to behavior
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	NtUnmapViewOfSection: Direct from: 0x776D2D3C	Jump to behavior
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	NtCreateMutant: Direct from: 0x776D35CC	Jump to behavior
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	NtAllocateVirtualMemory: Direct from: 0x776D2BFC	Jump to behavior
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	NtDelayExecution: Direct from: 0x776D2DDC	Jump to behavior
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	NtQuerySystemInformation: Direct from: 0x776D2DFC	Jump to behavior
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	NtReadFile: Direct from: 0x776D2ADC	Jump to behavior
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	NtTerminateThread: Direct from: 0x776D2FCC	Jump to behavior
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	NtQueryInformationToken: Direct from: 0x776D2CAC	Jump to behavior
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	NtCreateFile: Direct from: 0x776D2FEC	Jump to behavior
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	NtOpenFile: Direct from: 0x776D2DCC	Jump to behavior
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	NtOpenKeyEx: Direct from: 0x776D2B9C	Jump to behavior
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	NtNotifyChangeKey: Direct from: 0x776D3C2C	Jump to behavior
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	NtSetInformationProcess: Direct from: 0x776D2C5C	Jump to behavior
Source: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe	NtProtectVirtualMemory: Direct from: 0x776D2F9C	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Section loaded: NULL target: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Section loaded: NULL target: C:\Windows\SysWOW64\PresentationHost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: NULL target: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: NULL target: C:\Program Files (x86)\ZeWGGsKmIuKixNxFZZaTHWCuaQvoeemqsPjxHscsBCGnB\H792vWLf9Fx1Mp7TRJ.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 844008	Jump to behavior

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report URGENT REQUEST FOR QUOTATION.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
URGENT REQUEST FOR QUOTATION.exe

Source: H792vWLf9Fx1Mp7TRJ.exe, 0000000D.00000000.1299318899.0000000001680000.00000002.00000001.00040000.00000000.sdmp, H792vWLf9Fx1Mp7TRJ.exe, 0000000D.00000002.3370644270.0000000001680000.00000002.00000001.00040000.00000000.sdmp, H792vWLf9Fx1Mp7TRJ.exe, 0000000F.00000002.3370333574.0000000001670000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: H792vWLf9Fx1Mp7TRJ.exe, 0000000D.00000000.1299318899.0000000001680000.00000002.00000001.00040000.00000000.sdmp, H792vWLf9Fx1Mp7TRJ.exe, 0000000D.00000002.3370644270.0000000001680000.00000002.00000001.00040000.00000000.sdmp, H792vWLf9Fx1Mp7TRJ.exe, 0000000F.00000002.3370333574.0000000001670000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: H792vWLf9Fx1Mp7TRJ.exe, 0000000D.00000000.1299318899.0000000001680000.00000002.00000001.00040000.00000000.sdmp, H792vWLf9Fx1Mp7TRJ.exe, 0000000D.00000002.3370644270.0000000001680000.00000002.00000001.00040000.00000000.sdmp, H792vWLf9Fx1Mp7TRJ.exe, 0000000F.00000002.3370333574.0000000001670000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: H792vWLf9Fx1Mp7TRJ.exe, 0000000D.00000000.1299318899.0000000001680000.00000002.00000001.00040000.00000000.sdmp, H792vWLf9Fx1Mp7TRJ.exe, 0000000D.00000002.3370644270.0000000001680000.00000002.00000001.00040000.00000000.sdmp, H792vWLf9Fx1Mp7TRJ.exe, 0000000F.00000002.3370333574.0000000001670000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Queries volume information: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\PresentationHost.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	612 Process Injection	1 Masquerading	1 OS Credential Dumping	131 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	11 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	51 Virtualization/Sandbox Evasion	Security Account Manager	51 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	612 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Abuse Elevation Control Mechanism	Cached Domain Credentials	123 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	4 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	12 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Timestomp	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 DLL Side-Loading	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement