Play interactive tour

Edit tour

Analysis Report SilaeClient.application

Overview

General Information

Sample Name:	SilaeClient.application
Analysis ID:	304904
MD5:	3fbe7ae7cfa0393659c853d6782d5d3e
SHA1:	d65435d5f3cc474a30374b58a389b7c289731bde
SHA256:	e0fc784801a7bcdecae032cbaef575d32bba278dd0559f27dab7148d6d5de62f
Most interesting Screenshot:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Adds / modifies Windows certificates

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops certificate files (DER)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

Queries disk information (often used to detect virtual machines)

Queries information about the installed CPU (vendor, model number etc)

Queries the installation date of Windows

Queries the volume information (name, serial number etc) of a device

Stores large binary data to the registry

Tries to load missing DLLs

Classification

Startup

System is w10x64

dfsvc.exe (PID: 6672 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe MD5: 48FD4DD682051712E3E7757C525DED71)

SilaeClient.exe (PID: 7080 cmdline: C:\Users\user\AppData\Local\Apps\2.0\LPXCVOAB.EL6\HLP17DZ7.VHN\sila...app_a698a498bfdfbd33_0001.04eb_cb6a484e7a863a2b\SilaeClient.exe MD5: 2ED394688008A71EC9737CB112140EC2)

dw20.exe (PID: 5396 cmdline: dw20.exe -x -s 1524 MD5: 9B2D2AE232F2D0EFAEF9D5EB2509BE79)

cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

Source: C:\Users\user\AppData\Local\Apps\2.0\LPXCVOAB.EL6\HLP17DZ7.VHN\sila...app_a698a498bfdfbd33_0001.04eb_cb6a484e7a863a2b\SilaeClient.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\LPXCVOAB.EL6\HLP17DZ7.VHN\sila...app_a698a498bfdfbd33_0001.04eb_cb6a484e7a863a2b\SilaeClient.exe	File opened: C:\Users\user\AppData\Local\Apps\2.0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\LPXCVOAB.EL6\HLP17DZ7.VHN\sila...app_a698a498bfdfbd33_0001.04eb_cb6a484e7a863a2b\SilaeClient.exe	File opened: C:\Users\user\AppData\Local\Apps\	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\LPXCVOAB.EL6\HLP17DZ7.VHN\sila...app_a698a498bfdfbd33_0001.04eb_cb6a484e7a863a2b\SilaeClient.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\LPXCVOAB.EL6\HLP17DZ7.VHN\sila...app_a698a498bfdfbd33_0001.04eb_cb6a484e7a863a2b\SilaeClient.exe	File opened: C:\Users\user\AppData\Local\Apps\2.0\LPXCVOAB.EL6\	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\LPXCVOAB.EL6\HLP17DZ7.VHN\sila...app_a698a498bfdfbd33_0001.04eb_cb6a484e7a863a2b\SilaeClient.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2570 WEB-MISC Invalid HTTP Version String 192.168.2.3:49715 -> 31.7.255.66:80
Source: Traffic	Snort IDS: 2067 WEB-MISC Lotus Notes .exe script source download attempt 192.168.2.3:49715 -> 31.7.255.66:80

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Type: application/x-msdownloadLast-Modified: Mon, 28 Sep 2009 15:03:22 GMTAccept-Ranges: bytesETag: "09918d24c40ca1:0"Server: Microsoft-IIS/8.5X-Powered-By: ASP.NETDate: Mon, 26 Oct 2020 11:51:38 GMTContent-Length: 3506176Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 d9 cf c0 4a 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 08 00 00 50 35 00 00 20 00 00 00 00 00 00 1e 68 35 00 00 20 00 00 00 80 35 00 00 00 40 00 00 20 00 00 00 10 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 c0 35 00 00 10 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 cc 67 35 00 4f 00 00 00 00 80 35 00 80 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 35 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 24 48 35 00 00 20 00 00 00 50 35 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 80 04 00 00 00 80 35 00 00 10 00 00 00 60 35 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 a0 35 00 00 10 00 00 00 70 35 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Type: application/x-msdownloadLast-Modified: Wed, 09 Aug 2017 11:32:24 GMTAccept-Ranges: bytesETag: "014b92b311d31:0"Server: Microsoft-IIS/8.5X-Powered-By: ASP.NETDate: Mon, 26 Oct 2020 11:51:40 GMTContent-Length: 119808Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 c7 f2 8a 59 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 08 00 00 cc 01 00 00 06 00 00 00 00 00 00 7e ea 01 00 00 20 00 00 00 00 02 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 02 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 28 ea 01 00 53 00 00 00 00 00 02 00 d8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 02 00 0c 00 00 00 ac e9 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 ca 01 00 00 20 00 00 00 cc 01 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 d8 03 00 00 00 00 02 00 00 04 00 00 00 ce 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 02 00 00 02 00 00 00 d2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 ea 01 00 00 00 00 00 48 00 00 00 02 00 05 00 b4 ed 00 00 f8 fb 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13 30 02 00 ee 02 00 00 01 00 00 11 02 28 06 00 00 06 0a 06 7b 02 00 00 04 0b 07 20 92 00 00 00 42 ae 00 00 00 07 1f 31 35 47 07 1f 0d 35 25 07 1c 3b 1a 02 00 00 07 1f 0a 59 45 04 00 00 00 40 02 00 00 a9 02 00 00 bb 01 00 00 c2 01 00 00 38 a4 02 00 00 07 1f 22 3b 10 02 00 00 07 1f 29 3b 98 01 00 00 07 1f 31 3b 69 02 00 00 38 87 02 00 00 07 1f 5d 35 3a 07 1f 3c 59 45 07 00 00 00 ae 01 00 00 2c 02 00 00 5d 02 00 00 5d 02 00 00 4c 01 00 00 5d 02 00 00 7d 01 00 00 07 1f 55 3b 4e 02 00 00 07 1f 5d 3b ba 01 00 00 38 48 02 00 00 07 1f 7d 3b 24 02 00 00 07 20 85 00 00 00 3b 40 01 00 00 07 20 92 00 00 00 3b 15 02 00 00 38 25 02 00 00 07 20 ed 00 00 00 35 7c 07 20 be 00 00 00 35 24 07 20 99 00 00 00 3b fc 01 00 00 07 20 bd 00 00 00 59 45 02 00 00 00 2b 01 00 00 24 01 00 00 38 f1 01 00 00 07 20 d6 00 00 00 59 45 05 00 00 00 14 01 00 00 92 01 00 00 d1 01 00 00 d1 01 00 00 ce 00 00 00 07 20 e0 00 00 00 3b 25 01 00 00 07 20 e9 00 00 00 59 45 05 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Type: application/octet-streamLast-Modified: Fri, 16 Oct 2020 15:46:56 GMTAccept-Ranges: bytesETag: "0586093d3a3d61:0"Server: Microsoft-IIS/8.5X-Powered-By: ASP.NETDate: Mon, 26 Oct 2020 11:51:40 GMTContent-Length: 22283664Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 55 c0 89 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 08 00 00 c4 51 01 00 1e 02 00 00 00 00 00 7e e3 51 01 00 20 00 00 00 00 52 01 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 54 01 00 02 00 00 36 2c 54 01 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 2c e3 51 01 4f 00 00 00 00 00 52 01 50 1a 02 00 00 00 00 00 00 00 00 00 00 e4 53 01 90 21 00 00 00 20 54 01 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 c3 51 01 00 20 00 00 00 c4 51 01 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 50 1a 02 00 00 00 52 01 00 1c 02 00 00 c6 51 01 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 54 01 00 02 00 00 00 e2 53 01 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 e3 51 01 00 00 00 00 48 00 00 00 02 00 05 00 b4 d0 ea 00 78 12 67 00 01 00 00 00 5e b6 00 06 40 96 ab 00 74 3a 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 02 16 28 02 00 00 06 2a 00 00 00 13 30 05 00 93 00 00 00 01 00 00 11 02 7b 05 00 00 04 2c 2d 02 7b 05 00 00 04 02 7b 03 00 00 04 17 8d 01 00 00 01 0a 06 16 03 8c 1f 01 00 01 a2 06 6f 2b 00 00 0a 26 03 2d 07 02 14 7d 05 00 00 04 03 2d 25 02 7b 03 00 00 04 2c 07 02 14 7d 03 00 00 04 02 7b 04 00 00 04 2c 07 02 14 7d 04 00 00 04 02 16 7d 02 00 00 04 7e 08 00 00 04 2c 10 7e 08 00 00 04 6f 2c 00 00 0a 14 80 08 00 00 04 02 7b 06 00 00 04 2c 07 02 14 7d 06 00 00 04 02 7b 07 00 00 04 2c 07 02 14 7d 07 00 00 04 2a 00 1b 30 09 00 d4 07 00 00 02 00 00 11 14 0a 14 0b 72 01 00 00 70 0c 7e 01 00 00 04 25 13 11 28 2d 00 00 0a 28 1b 30 00 06 de 08 11 11 28 2e 00 00 0a dc 03 28 04 00 00 06 28 eb 2f 00 06 6f ee 2f 00 06 72 03 00 00 70 28 2f 00 00 0a 0c 28 eb 2f 00 06 7b 68 6f 00 04 13 12 11 12 17 59 45 04 00 00 00 05 00 00 00 9b 01 00 00 8b 04 00 00 21 06 00 00 38 61 07 00 00 14 0d 7e 01 00 00 04 25 13 13 28 2d 00 00 0a 7e 08 00 00 04 2d 0a 73 30 00 00

Source: global traffic	HTTP traffic detected: GET /silae/_deploy/http/paie.groupe-fiba.fr/80/SilaeClient.application HTTP/1.1Host: paie.groupe-fiba.frAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /silae/_deploy/http/paie.groupe-fiba.fr/80/SilaeClient_1_1259_0_2/SilaeClient.exe.manifest HTTP/1.1Host: paie.groupe-fiba.frAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /silae/_deploy/http/paie.groupe-fiba.fr/80/SilaeClient_1_1259_0_2/DevComponents.DotNetBar.dll HTTP/1.1Host: paie.groupe-fiba.frAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /silae/_deploy/http/paie.groupe-fiba.fr/80/SilaeClient_1_1259_0_2/ExcelLibrary.dll HTTP/1.1Host: paie.groupe-fiba.frAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /silae/_deploy/http/paie.groupe-fiba.fr/80/SilaeClient_1_1259_0_2/SilaeClient.exe HTTP/1.1Host: paie.groupe-fiba.frAccept-Encoding: gzip

Source: global traffic	HTTP traffic detected: GET /silae/_deploy/http/paie.groupe-fiba.fr/80/SilaeClient.application HTTP/1.1Host: paie.groupe-fiba.frAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /silae/_deploy/http/paie.groupe-fiba.fr/80/SilaeClient_1_1259_0_2/SilaeClient.exe.manifest HTTP/1.1Host: paie.groupe-fiba.frAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /silae/_deploy/http/paie.groupe-fiba.fr/80/SilaeClient_1_1259_0_2/DevComponents.DotNetBar.dll HTTP/1.1Host: paie.groupe-fiba.frAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /silae/_deploy/http/paie.groupe-fiba.fr/80/SilaeClient_1_1259_0_2/ExcelLibrary.dll HTTP/1.1Host: paie.groupe-fiba.frAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /silae/_deploy/http/paie.groupe-fiba.fr/80/SilaeClient_1_1259_0_2/SilaeClient.exe HTTP/1.1Host: paie.groupe-fiba.frAccept-Encoding: gzip

Source: unknown

DNS traffic detected: queries for: paie.groupe-fiba.fr

Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://10.1.1.184/wsflux/wsflux.asmx
Source: dfsvc.exe, 00000001.00000003.274033616.000001F5C1207000.00000004.00000001.sdmp	String found in binary or memory: http://ac.economia.gob.mx/cps.html0
Source: dfsvc.exe, 00000001.00000003.274033616.000001F5C1207000.00000004.00000001.sdmp	String found in binary or memory: http://ac.economia.gob.mx/last.crl0G
Source: dfsvc.exe, 00000001.00000003.274059011.000001F5C1224000.00000004.00000001.sdmp	String found in binary or memory: http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0?
Source: dfsvc.exe, 00000001.00000003.273840100.000001F5C12E6000.00000004.00000001.sdmp	String found in binary or memory: http://acraiz.icpbrasil.gov.br/LCRacraizv1.crl0
Source: dfsvc.exe, 00000001.00000003.274059011.000001F5C1224000.00000004.00000001.sdmp	String found in binary or memory: http://acraiz.icpbrasil.gov.br/LCRacraizv2.crl0
Source: SilaeClient.exe, 0000000D.00000000.321067456.0000000000AF2000.00000002.00020000.sdmp	String found in binary or memory: http://art.gnome.org/2
Source: dfsvc.exe, 00000001.00000003.274001585.000001F5C12D4000.00000004.00000001.sdmp	String found in binary or memory: http://ca.disig.sk/ca/crl/ca_disig.crl0
Source: dfsvc.exe, 00000001.00000003.273892998.000001F5C11EC000.00000004.00000001.sdmp	String found in binary or memory: http://ca.mtin.es/mtin/DPCyPoliticas0
Source: dfsvc.exe, 00000001.00000003.273892998.000001F5C11EC000.00000004.00000001.sdmp	String found in binary or memory: http://ca.mtin.es/mtin/DPCyPoliticas0g
Source: dfsvc.exe, 00000001.00000003.273892998.000001F5C11EC000.00000004.00000001.sdmp	String found in binary or memory: http://ca.mtin.es/mtin/crl/MTINAutoridadRaiz03
Source: dfsvc.exe, 00000001.00000003.273892998.000001F5C11EC000.00000004.00000001.sdmp	String found in binary or memory: http://ca.mtin.es/mtin/ocsp0
Source: dfsvc.exe, 00000001.00000003.273892998.000001F5C11EC000.00000004.00000001.sdmp	String found in binary or memory: http://ca2.mtin.es/mtin/crl/MTINAutoridadRaiz0
Source: dfsvc.exe, 00000001.00000003.273892998.000001F5C11EC000.00000004.00000001.sdmp	String found in binary or memory: http://certificates.starfieldtech.com/repository/1604
Source: dfsvc.exe, 00000001.00000003.274101045.000001F5C11FD000.00000004.00000001.sdmp	String found in binary or memory: http://certs.oati.net/repository/OATICA2.crl0
Source: dfsvc.exe, 00000001.00000003.274101045.000001F5C11FD000.00000004.00000001.sdmp	String found in binary or memory: http://certs.oati.net/repository/OATICA2.crt0
Source: dfsvc.exe, 00000001.00000003.274101045.000001F5C11FD000.00000004.00000001.sdmp	String found in binary or memory: http://certs.oaticerts.com/repository/OATICA2.crl
Source: dfsvc.exe, 00000001.00000003.274101045.000001F5C11FD000.00000004.00000001.sdmp	String found in binary or memory: http://certs.oaticerts.com/repository/OATICA2.crt08
Source: dfsvc.exe, 00000001.00000003.274033616.000001F5C1207000.00000004.00000001.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersignroot.html0
Source: dfsvc.exe, 00000001.00000003.273892998.000001F5C11EC000.00000004.00000001.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html0
Source: dfsvc.exe, 00000001.00000003.273892998.000001F5C11EC000.00000004.00000001.sdmp	String found in binary or memory: http://cps.siths.se/sithsrootcav1.html0
Source: SilaeClient.exe, 0000000D.00000000.321067456.0000000000AF2000.00000002.00020000.sdmp	String found in binary or memory: http://creativecommons.org/licenses/GPL/2.0/lj
Source: SilaeClient.exe, 0000000D.00000000.321067456.0000000000AF2000.00000002.00020000.sdmp	String found in binary or memory: http://creativecommons.org/licenses/LGPL/2.1/
Source: SilaeClient.exe, 0000000D.00000000.321067456.0000000000AF2000.00000002.00020000.sdmp	String found in binary or memory: http://creativecommons.org/licenses/by-sa/3.0/
Source: dfsvc.exe, 00000001.00000003.274033616.000001F5C1207000.00000004.00000001.sdmp	String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: dfsvc.exe, 00000001.00000003.274033616.000001F5C1207000.00000004.00000001.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersignroot.crl0
Source: dfsvc.exe, 00000001.00000003.273892998.000001F5C11EC000.00000004.00000001.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersroot.crl0
Source: SilaeClient.exe, 0000000D.00000002.424616992.0000000001B3C000.00000004.00000020.sdmp, 74FBF93595CFC8459196065CE54AD9280.1.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: dfsvc.exe, 00000001.00000003.273992778.000001F5C1263000.00000004.00000001.sdmp, SilaeClient.exe, 0000000D.00000002.424616992.0000000001B3C000.00000004.00000020.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: SilaeClient.exe, 0000000D.00000003.329719497.000000001C994000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: SilaeClient.exe, 0000000D.00000003.331803520.000000001C98B000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: dfsvc.exe, 00000001.00000003.274059011.000001F5C1224000.00000004.00000001.sdmp	String found in binary or memory: http://crl.defence.gov.au/pki0
Source: dfsvc.exe, 00000001.00000003.274033616.000001F5C1207000.00000004.00000001.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl0
Source: dfsvc.exe, 00000001.00000003.273840100.000001F5C12E6000.00000004.00000001.sdmp, SilaeClient.exe, 0000000D.00000002.424616992.0000000001B3C000.00000004.00000020.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: dfsvc.exe, 00000001.00000003.274059011.000001F5C1224000.00000004.00000001.sdmp	String found in binary or memory: http://crl.miJ9
Source: dfsvc.exe, 00000001.00000003.274059011.000001F5C1224000.00000004.00000001.sdmp	String found in binary or memory: http://crl.micro
Source: dfsvc.exe, 00000001.00000003.273892998.000001F5C11EC000.00000004.00000001.sdmp	String found in binary or memory: http://crl.oces.trust2408.com/oces.crl0
Source: dfsvc.exe, 00000001.00000003.273840100.000001F5C12E6000.00000004.00000001.sdmp	String found in binary or memory: http://crl.pki.wellsfargo.com/wsprca.crl0
Source: SilaeClient.exe, 0000000D.00000003.331803520.000000001C98B000.00000004.00000001.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: dfsvc.exe, 00000001.00000003.274033616.000001F5C1207000.00000004.00000001.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: dfsvc.exe, 00000001.00000003.273840100.000001F5C12E6000.00000004.00000001.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: dfsvc.exe, 00000001.00000003.273892998.000001F5C11EC000.00000004.00000001.sdmp	String found in binary or memory: http://crl.ssc.lt/root-a/cacrl.crl0
Source: dfsvc.exe, 00000001.00000003.274101045.000001F5C11FD000.00000004.00000001.sdmp	String found in binary or memory: http://crl.ssc.lt/root-b/cacrl.crl0
Source: dfsvc.exe, 00000001.00000003.274112378.000001F5C1213000.00000004.00000001.sdmp	String found in binary or memory: http://crl.ssc.lt/root-c/cacrl.crl0
Source: dfsvc.exe, 00000001.00000003.274059011.000001F5C1224000.00000004.00000001.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: SilaeClient.exe, 0000000D.00000003.331803520.000000001C98B000.00000004.00000001.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: dfsvc.exe, 00000001.00000003.273576250.000001F5C11C9000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: dfsvc.exe, 00000001.00000003.273840100.000001F5C12E6000.00000004.00000001.sdmp	String found in binary or memory: http://eca.hinet.net/repository/CRL2/CA.crl0
Source: dfsvc.exe, 00000001.00000003.273840100.000001F5C12E6000.00000004.00000001.sdmp	String found in binary or memory: http://eca.hinet.net/repository/Certs/IssuedToThisCA.p7b05
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://experian.com/communicationV2/schemas
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://experian.com/communicationV2/schemasV
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://experian.com/communicationV2/schemasW
Source: dfsvc.exe, 00000001.00000003.273840100.000001F5C12E6000.00000004.00000001.sdmp	String found in binary or memory: http://fedir.comsign.co.il/cacert/ComSignAdvancedSecurityCA.crt0
Source: dfsvc.exe, 00000001.00000003.273840100.000001F5C12E6000.00000004.00000001.sdmp	String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignAdvancedSecurityCA.crl0
Source: dfsvc.exe, 00000001.00000003.273840100.000001F5C12E6000.00000004.00000001.sdmp	String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignCA.crl0
Source: dfsvc.exe, 00000001.00000003.274059011.000001F5C1224000.00000004.00000001.sdmp	String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignSecuredCA.crl0
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://gi.silae.fr/silae9http://silaexpert01.fr/silae7Echec
Source: dfsvc.exe, 00000001.00000003.274059011.000001F5C1224000.00000004.00000001.sdmp	String found in binary or memory: http://http.fpki.gov/fcpca/caCertsIssuedByfcpca.p7c0
Source: dfsvc.exe, 00000001.00000003.274059011.000001F5C1224000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.accv.es0
Source: SilaeClient.exe, 0000000D.00000003.331803520.000000001C98B000.00000004.00000001.sdmp, 74FBF93595CFC8459196065CE54AD9280.1.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: dfsvc.exe, 00000001.00000003.273840100.000001F5C12E6000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.eca.hinet.net/OCSP/ocspG2sha20
Source: dfsvc.exe, 00000001.00000003.273840100.000001F5C12E6000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.ncdc.gov.sa0
Source: dfsvc.exe, 00000001.00000003.274059011.000001F5C1224000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.pki.gva.es0
Source: SilaeClient.exe, 0000000D.00000003.329687009.000000001C98E000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: dfsvc.exe, 00000001.00000003.273840100.000001F5C12E6000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.suscerte.gob.ve0
Source: SilaeClient.exe, 0000000D.00000003.331733589.0000000001BB8000.00000004.00000001.sdmp, SilaeClient.exe, 0000000D.00000002.425860541.0000000003B6E000.00000004.00000001.sdmp, SilaeClient.exe, 0000000D.00000002.427122833.000000001C9FB000.00000004.00000001.sdmp	String found in binary or memory: http://paie.groupe-fiba.fr/silae/_deploy/http/paie.groupe-fiba.fr/80/SilaeClient.application
Source: SilaeClient.exe, 0000000D.00000002.427122833.000000001C9FB000.00000004.00000001.sdmp	String found in binary or memory: http://paie.groupe-fiba.fr/silae/_deploy/http/paie.groupe-fiba.fr/80/SilaeClient.application#
Source: SilaeClient.exe, 0000000D.00000002.425860541.0000000003B6E000.00000004.00000001.sdmp, SilaeClient.exe, 0000000D.00000003.334407436.000000001C984000.00000004.00000001.sdmp, SilaeClient.exe, 0000000D.00000002.426725605.000000001C950000.00000004.00000001.sdmp, SilaeClient.exe, 0000000D.00000002.425194903.0000000001EE4000.00000004.00000040.sdmp, SilaeClient.exe, 0000000D.00000002.425180334.0000000001EE0000.00000004.00000040.sdmp, SilaeClient.exe, 0000000D.00000002.425030835.0000000001D90000.00000004.00000040.sdmp, SilaeClient.exe, 0000000D.00000002.424535701.0000000001AED000.00000004.00000020.sdmp	String found in binary or memory: http://paie.groupe-fiba.fr/silae/_deploy/http/paie.groupe-fiba.fr/80/SilaeClient.application#SilaeCl
Source: SilaeClient.exe, 0000000D.00000002.425845594.0000000003B61000.00000004.00000001.sdmp	String found in binary or memory: http://paie.groupe-fiba.fr/silae/_deploy/http/paie.groupe-fiba.fr/80/SilaeClient.application(b
Source: SilaeClient.exe, 0000000D.00000003.331733589.0000000001BB8000.00000004.00000001.sdmp	String found in binary or memory: http://paie.groupe-fiba.fr/silae/_deploy/http/paie.groupe-fiba.fr/80/SilaeClient.application.exe_a69
Source: SilaeClient.exe, 0000000D.00000002.424616992.0000000001B3C000.00000004.00000020.sdmp	String found in binary or memory: http://paie.groupe-fiba.fr/silae/_deploy/http/paie.groupe-fiba.fr/80/SilaeClient.application7
Source: SilaeClient.exe, 0000000D.00000002.424616992.0000000001B3C000.00000004.00000020.sdmp	String found in binary or memory: http://paie.groupe-fiba.fr/silae/_deploy/http/paie.groupe-fiba.fr/80/SilaeClient.applicationA
Source: SilaeClient.exe, 0000000D.00000002.427122833.000000001C9FB000.00000004.00000001.sdmp	String found in binary or memory: http://paie.groupe-fiba.fr/silae/_deploy/http/paie.groupe-fiba.fr/80/SilaeClient.applicationK
Source: SilaeClient.exe, 0000000D.00000002.425860541.0000000003B6E000.00000004.00000001.sdmp	String found in binary or memory: http://paie.groupe-fiba.fr/silae/_deploy/http/paie.groupe-fiba.fr/80/SilaeClient.applicationP
Source: SilaeClient.exe, 0000000D.00000002.427122833.000000001C9FB000.00000004.00000001.sdmp	String found in binary or memory: http://paie.groupe-fiba.fr/silae/_deploy/http/paie.groupe-fiba.fr/80/SilaeClient.applicationV
Source: SilaeClient.exe, 0000000D.00000002.425860541.0000000003B6E000.00000004.00000001.sdmp	String found in binary or memory: http://paie.groupe-fiba.fr/silae/_deploy/http/paie.groupe-fiba.fr/80/SilaeClient.applicationXa
Source: SilaeClient.exe, 0000000D.00000002.426901371.000000001C97C000.00000004.00000001.sdmp	String found in binary or memory: http://paie.groupe-fiba.fr/silae/_deploy/http/paie.groupe-fiba.fr/80/SilaeClient.applicationa
Source: SilaeClient.exe, 0000000D.00000002.427122833.000000001C9FB000.00000004.00000001.sdmp	String found in binary or memory: http://paie.groupe-fiba.fr/silae/_deploy/http/paie.groupe-fiba.fr/80/SilaeClient.applicationation
Source: SilaeClient.exe, 0000000D.00000002.427122833.000000001C9FB000.00000004.00000001.sdmp	String found in binary or memory: http://paie.groupe-fiba.fr/silae/_deploy/http/paie.groupe-fiba.fr/80/SilaeClient.applicationcal
Source: SilaeClient.exe, 0000000D.00000003.331733589.0000000001BB8000.00000004.00000001.sdmp	String found in binary or memory: http://paie.groupe-fiba.fr/silae/_deploy/http/paie.groupe-fiba.fr/80/SilaeClient.applicationes.04e
Source: SilaeClient.exe, 0000000D.00000002.424616992.0000000001B3C000.00000004.00000020.sdmp	String found in binary or memory: http://paie.groupe-fiba.fr/silae/_deploy/http/paie.groupe-fiba.fr/80/SilaeClient.applicationes;
Source: SilaeClient.exe, 0000000D.00000003.331733589.0000000001BB8000.00000004.00000001.sdmp	String found in binary or memory: http://paie.groupe-fiba.fr/silae/_deploy/http/paie.groupe-fiba.fr/80/SilaeClient.applicationies
Source: SilaeClient.exe, 0000000D.00000002.424775712.0000000001BB8000.00000004.00000020.sdmp	String found in binary or memory: http://paie.groupe-fiba.fr/silae/_deploy/http/paie.groupe-fiba.fr/80/SilaeClient.applicationity
Source: SilaeClient.exe, 0000000D.00000003.331733589.0000000001BB8000.00000004.00000001.sdmp	String found in binary or memory: http://paie.groupe-fiba.fr/silae/_deploy/http/paie.groupe-fiba.fr/80/SilaeClient.applicationityture=
Source: SilaeClient.exe, 0000000D.00000002.427122833.000000001C9FB000.00000004.00000001.sdmp	String found in binary or memory: http://paie.groupe-fiba.fr/silae/_deploy/http/paie.groupe-fiba.fr/80/SilaeClient.applicationm
Source: SilaeClient.exe, 0000000D.00000003.331733589.0000000001BB8000.00000004.00000001.sdmp	String found in binary or memory: http://paie.groupe-fiba.fr/silae/_deploy/http/paie.groupe-fiba.fr/80/SilaeClient.applicationnts
Source: SilaeClient.exe, 0000000D.00000002.424616992.0000000001B3C000.00000004.00000020.sdmp	String found in binary or memory: http://paie.groupe-fiba.fr/silae/_deploy/http/paie.groupe-fiba.fr/80/SilaeClient.applicationts
Source: SilaeClient.exe, 0000000D.00000002.424616992.0000000001B3C000.00000004.00000020.sdmp	String found in binary or memory: http://paie.groupe-fiba.fr/silae/_deploy/http/paie.groupe-fiba.fr/80/SilaeClient.applicationtsk
Source: SilaeClient.exe, 0000000D.00000003.331733589.0000000001BB8000.00000004.00000001.sdmp	String found in binary or memory: http://paie.groupe-fiba.fr/silae/_deploy/http/paie.groupe-fiba.fr/80/SilaeClient.applicationty
Source: SilaeClient.exe, 0000000D.00000002.425860541.0000000003B6E000.00000004.00000001.sdmp	String found in binary or memory: http://paie.groupe-fiba.fr/silae/_deploy/http/paie.groupe-fiba.fr/80/SilaeClient.applicationx
Source: SilaeClient.exe, 0000000D.00000002.425860541.0000000003B6E000.00000004.00000001.sdmp, SilaeClient.exe, 0000000D.00000002.426901371.000000001C97C000.00000004.00000001.sdmp	String found in binary or memory: http://paie.groupe-fiba.fr/silae/_deploy/http/paie.groupe-fiba.fr/80/SilaeClient_1_1259_0_2/SilaeCli
Source: SilaeClient.exe, 0000000D.00000002.427122833.000000001C9FB000.00000004.00000001.sdmp, SilaeClient.application	String found in binary or memory: http://paie.groupe-fiba.fr:80/silae/_deploy/http/paie.groupe-fiba.fr/80/SilaeClient.application
Source: dfsvc.exe, 00000001.00000003.232796388.000001F5BF6B7000.00000004.00000001.sdmp, SilaeClient.exe, 0000000D.00000002.427122833.000000001C9FB000.00000004.00000001.sdmp	String found in binary or memory: http://paie.groupe-fiba.fr:80/silae/_deploy/http/paie.groupe-fiba.fr/80/SilaeClient.application%
Source: dfsvc.exe, 00000001.00000003.232813726.000001F5BF6AD000.00000004.00000001.sdmp	String found in binary or memory: http://paie.groupe-fiba.fr:80/silae/_deploy/http/paie.groupe-fiba.fr/80/SilaeClient.applicationR
Source: dfsvc.exe, 00000001.00000003.232813726.000001F5BF6AD000.00000004.00000001.sdmp	String found in binary or memory: http://paie.groupe-fiba.fr:80/silae/_deploy/http/paie.groupe-fiba.fr/80/SilaeClient.applicationrg/20
Source: dfsvc.exe, 00000001.00000003.228081556.000001F5BF666000.00000004.00000001.sdmp	String found in binary or memory: http://paie.groupe-fiba.fr:80/silae/_deploy/http/paie.groupe-fiba.fr/80/SilaeClient.applicationx
Source: dfsvc.exe, 00000001.00000003.273840100.000001F5C12E6000.00000004.00000001.sdmp	String found in binary or memory: http://pki.digidentity.eu/validatie0
Source: dfsvc.exe, 00000001.00000003.274112378.000001F5C1213000.00000004.00000001.sdmp	String found in binary or memory: http://pki.registradores.org/normativa/index.htm0
Source: dfsvc.exe, 00000001.00000003.274101045.000001F5C11FD000.00000004.00000001.sdmp	String found in binary or memory: http://policy.camerfirma.com0
Source: dfsvc.exe, 00000001.00000003.274059011.000001F5C1224000.00000004.00000001.sdmp	String found in binary or memory: http://postsignum.ttc.cz/crl/psrootqca2.crl0
Source: SilaeClient.exe, 0000000D.00000003.331733589.0000000001BB8000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.micro
Source: dfsvc.exe, 00000001.00000003.274059011.000001F5C1224000.00000004.00000001.sdmp	String found in binary or memory: http://sertifikati.ca.posta.rs/crl/PostaCARoot.crl0
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://tempuri.org/
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://tempuri.org/ConfirmerObtentionFichier
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://tempuri.org/ControlerFichier
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://tempuri.org/DemanderConsultPortail
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://tempuri.org/DeposerFichier
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://tempuri.org/DeposerFichierCollab
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://tempuri.org/DeposerFichierSansControle
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://tempuri.org/EmettreOrdreEnvoiLiasse
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://tempuri.org/FluxWSAutorise
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://tempuri.org/GetDateDerniereReponse
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://tempuri.org/GetDemandeLocaux
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://tempuri.org/GetEtatRetourFluxChrono
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://tempuri.org/GetEtatRetourFluxDossier
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://tempuri.org/GetFicheParametrageOC
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://tempuri.org/GetFicheParametrageOCAvecDateFin
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://tempuri.org/GetHostName
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://tempuri.org/GetListeChronoReponse
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://tempuri.org/GetTailleLimiteDonnees
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://tempuri.org/GetUrlFluxChrono
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://tempuri.org/GetXmlRetourFlux
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://tempuri.org/IsWSFonctionnel
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://tempuri.org/ReemettreFluxEdiPaiementVersOAG
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://tempuri.org/SetEtatFluxChrono
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://tempuri.org/T
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://tempuri.org/TU
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://tempuri.org/test
Source: dfsvc.exe, 00000001.00000003.274059011.000001F5C1224000.00000004.00000001.sdmp	String found in binary or memory: http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl0
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://vws2k8/SILAE/IWS/IWS.asmx
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://vws2k8/SILAE/IWS/IWS.asmxO
Source: dfsvc.exe, 00000001.00000003.273840100.000001F5C12E6000.00000004.00000001.sdmp	String found in binary or memory: http://web.ncdc.gov.sa/crl/nrcacomb1.crl0
Source: dfsvc.exe, 00000001.00000003.273840100.000001F5C12E6000.00000004.00000001.sdmp	String found in binary or memory: http://web.ncdc.gov.sa/crl/nrcaparta1.crl
Source: SilaeClient.exe, 0000000D.00000003.334407436.000000001C984000.00000004.00000001.sdmp	String found in binary or memory: http://ww3.org/2001/1xl-exc-c14n#
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www...iIndiquez
Source: dfsvc.exe, 00000001.00000003.274059011.000001F5C1224000.00000004.00000001.sdmp, dfsvc.exe, 00000001.00000003.273840100.000001F5C12E6000.00000004.00000001.sdmp	String found in binary or memory: http://www.acabogacia.org/doc0
Source: dfsvc.exe, 00000001.00000003.273840100.000001F5C12E6000.00000004.00000001.sdmp	String found in binary or memory: http://www.acabogacia.org0
Source: dfsvc.exe, 00000001.00000003.274059011.000001F5C1224000.00000004.00000001.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: dfsvc.exe, 00000001.00000003.274059011.000001F5C1224000.00000004.00000001.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: dfsvc.exe, 00000001.00000003.274059011.000001F5C1224000.00000004.00000001.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: dfsvc.exe, 00000001.00000003.274059011.000001F5C1224000.00000004.00000001.sdmp	String found in binary or memory: http://www.accv.es00
Source: dfsvc.exe, 00000001.00000003.273840100.000001F5C12E6000.00000004.00000001.sdmp	String found in binary or memory: http://www.agesic.gub.uy/acrn/acrn.crl0)
Source: dfsvc.exe, 00000001.00000003.273840100.000001F5C12E6000.00000004.00000001.sdmp	String found in binary or memory: http://www.agesic.gub.uy/acrn/cps_acrn.pdf0
Source: dfsvc.exe, 00000001.00000003.274059011.000001F5C1224000.00000004.00000001.sdmp	String found in binary or memory: http://www.ancert.com/cps0
Source: dfsvc.exe, 00000001.00000003.273892998.000001F5C11EC000.00000004.00000001.sdmp	String found in binary or memory: http://www.anf.es
Source: dfsvc.exe, 00000001.00000003.274059011.000001F5C1224000.00000004.00000001.sdmp	String found in binary or memory: http://www.anf.es/AC/RC/ocsp0c
Source: dfsvc.exe, 00000001.00000003.273892998.000001F5C11EC000.00000004.00000001.sdmp	String found in binary or memory: http://www.anf.es/es/address-direccion.html
Source: dfsvc.exe, 00000001.00000003.232500926.000001F5BF839000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: dfsvc.exe, 00000001.00000003.274059011.000001F5C1224000.00000004.00000001.sdmp	String found in binary or memory: http://www.ca.posta.rs/dokumentacija0h
Source: dfsvc.exe, 00000001.00000003.274059011.000001F5C1224000.00000004.00000001.sdmp	String found in binary or memory: http://www.certeurope.fr/reference/pc-root2.pdf0
Source: dfsvc.exe, 00000001.00000003.274059011.000001F5C1224000.00000004.00000001.sdmp	String found in binary or memory: http://www.certeurope.fr/reference/root2.crl0
Source: dfsvc.exe, 00000001.00000003.274059011.000001F5C1224000.00000004.00000001.sdmp	String found in binary or memory: http://www.certicamara.com/dpc/0Z
Source: dfsvc.exe, 00000001.00000003.273892998.000001F5C11EC000.00000004.00000001.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class1.crl0
Source: dfsvc.exe, 00000001.00000003.273840100.000001F5C12E6000.00000004.00000001.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class2.crl0
Source: dfsvc.exe, 00000001.00000003.274059011.000001F5C1224000.00000004.00000001.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class3.crl0
Source: dfsvc.exe, 00000001.00000003.274112378.000001F5C1213000.00000004.00000001.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class3P.crl0
Source: dfsvc.exe, 00000001.00000003.274033616.000001F5C1207000.00000004.00000001.sdmp	String found in binary or memory: http://www.chambersign.org1
Source: dfsvc.exe, 00000001.00000003.273840100.000001F5C12E6000.00000004.00000001.sdmp	String found in binary or memory: http://www.comsign.co.il/cps0
Source: dfsvc.exe, 00000001.00000003.274059011.000001F5C1224000.00000004.00000001.sdmp	String found in binary or memory: http://www.correo.com.uy/correocert/cps.pdf0
Source: dfsvc.exe, 00000001.00000003.273840100.000001F5C12E6000.00000004.00000001.sdmp	String found in binary or memory: http://www.datev.de/zertifikat-policy-bt0
Source: dfsvc.exe, 00000001.00000003.274001585.000001F5C12D4000.00000004.00000001.sdmp	String found in binary or memory: http://www.datev.de/zertifikat-policy-int0
Source: dfsvc.exe, 00000001.00000003.274013361.000001F5C12E4000.00000004.00000001.sdmp	String found in binary or memory: http://www.datev.de/zertifikat-policy-std0
Source: SilaeClient.exe, 0000000D.00000002.428584168.000000001CDF2000.00000002.00020000.sdmp, DevComponents.DotNetBar.dll.1.dr	String found in binary or memory: http://www.devcomponents.com
Source: SilaeClient.exe, 0000000D.00000002.428584168.000000001CDF2000.00000002.00020000.sdmp, DevComponents.DotNetBar.dll.1.dr	String found in binary or memory: http://www.devcomponents.com/dotnetbar/order.html
Source: SilaeClient.exe, 0000000D.00000002.428584168.000000001CDF2000.00000002.00020000.sdmp, DevComponents.DotNetBar.dll.1.dr	String found in binary or memory: http://www.devcomponents.com/kb/questions.php?questionid=37&vs
Source: SilaeClient.exe, 0000000D.00000002.428584168.000000001CDF2000.00000002.00020000.sdmp, DevComponents.DotNetBar.dll.1.dr	String found in binary or memory: http://www.devcomponents.com/kb/questions.php?questionid=5&vs
Source: SilaeClient.exe, 0000000D.00000002.428584168.000000001CDF2000.00000002.00020000.sdmp, DevComponents.DotNetBar.dll.1.dr	String found in binary or memory: http://www.devcomponents.com;mailto:info
Source: dfsvc.exe, 00000001.00000003.274001585.000001F5C12D4000.00000004.00000001.sdmp	String found in binary or memory: http://www.disig.sk/ca/crl/ca_disig.crl0
Source: dfsvc.exe, 00000001.00000003.274001585.000001F5C12D4000.00000004.00000001.sdmp	String found in binary or memory: http://www.disig.sk/ca0f
Source: dfsvc.exe, 00000001.00000003.274153696.000001F5C1258000.00000004.00000001.sdmp	String found in binary or memory: http://www.e-me.lv/repository0
Source: dfsvc.exe, 00000001.00000003.274112378.000001F5C1213000.00000004.00000001.sdmp	String found in binary or memory: http://www.e-szigno.hu/RootCA.crl
Source: dfsvc.exe, 00000001.00000003.274112378.000001F5C1213000.00000004.00000001.sdmp	String found in binary or memory: http://www.e-szigno.hu/RootCA.crt0
Source: dfsvc.exe, 00000001.00000003.274112378.000001F5C1213000.00000004.00000001.sdmp	String found in binary or memory: http://www.e-szigno.hu/SZSZ/0
Source: dfsvc.exe, 00000001.00000003.274153696.000001F5C1258000.00000004.00000001.sdmp	String found in binary or memory: http://www.e-trust.be/CPS/QNcerts
Source: dfsvc.exe, 00000001.00000003.274033616.000001F5C1207000.00000004.00000001.sdmp	String found in binary or memory: http://www.ecee.gov.pt/dpc0
Source: dfsvc.exe, 00000001.00000003.274059011.000001F5C1224000.00000004.00000001.sdmp	String found in binary or memory: http://www.echoworx.com/ca/root2/cps.pdf0
Source: dfsvc.exe, 00000001.00000003.274059011.000001F5C1224000.00000004.00000001.sdmp	String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: dfsvc.exe, 00000001.00000003.248513852.000001F5BF817000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: dfsvc.exe, 00000001.00000003.251658806.000001F5BF817000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: dfsvc.exe, 00000001.00000003.244461019.000001F5BF819000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/
Source: dfsvc.exe, 00000001.00000003.249670293.000001F5BF861000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.html
Source: dfsvc.exe, 00000001.00000003.250373484.000001F5BF861000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlJ
Source: dfsvc.exe, 00000001.00000003.248182595.000001F5BF815000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers0
Source: dfsvc.exe, 00000001.00000003.244958190.000001F5BF817000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersp-
Source: dfsvc.exe, 00000001.00000003.251658806.000001F5BF817000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comASC.TTF
Source: dfsvc.exe, 00000001.00000003.251658806.000001F5BF817000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comF
Source: dfsvc.exe, 00000001.00000003.246025208.000001F5BF817000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comSCI.TTF
Source: dfsvc.exe, 00000001.00000003.248513852.000001F5BF817000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comu
Source: dfsvc.exe, 00000001.00000003.244958190.000001F5BF817000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comv
Source: dfsvc.exe, 00000001.00000003.252981063.000001F5BF816000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comva
Source: dfsvc.exe, 00000001.00000003.247962122.000001F5BF817000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comx
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.google.fr#SCC_ForceAppliExt
Source: dfsvc.exe, 00000001.00000003.274101045.000001F5C11FD000.00000004.00000001.sdmp	String found in binary or memory: http://www.ica.co.il/repository/cps/PersonalID_Practice_Statement.pdf0
Source: dfsvc.exe, 00000001.00000003.274112378.000001F5C1213000.00000004.00000001.sdmp	String found in binary or memory: http://www.informatik.admin.ch/PKI/links/CPS_2_16_756_1_17_3_1_0.pdf0
Source: dfsvc.exe, 00000001.00000003.236136499.000001F5BF813000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: dfsvc.exe, 00000001.00000003.236136499.000001F5BF813000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Fa
Source: dfsvc.exe, 00000001.00000003.236136499.000001F5BF813000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp
Source: dfsvc.exe, 00000001.00000003.236136499.000001F5BF813000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: dfsvc.exe, 00000001.00000003.236136499.000001F5BF813000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/F
Source: dfsvc.exe, 00000001.00000003.236136499.000001F5BF813000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/o14
Source: dfsvc.exe, 00000001.00000003.236136499.000001F5BF813000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/oi8
Source: dfsvc.exe, 00000001.00000003.236136499.000001F5BF813000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/voi
Source: dfsvc.exe, 00000001.00000003.274101045.000001F5C11FD000.00000004.00000001.sdmp	String found in binary or memory: http://www.oaticerts.com/repository.
Source: SilaeClient.exe, 0000000D.00000000.321067456.0000000000AF2000.00000002.00020000.sdmp	String found in binary or memory: http://www.oxygen-icons.org/
Source: dfsvc.exe, 00000001.00000003.274059011.000001F5C1224000.00000004.00000001.sdmp	String found in binary or memory: http://www.pki.admin.ch/cps/CPS_2_16_756_1_17_3_1_0.pdf09
Source: dfsvc.exe, 00000001.00000003.274059011.000001F5C1224000.00000004.00000001.sdmp	String found in binary or memory: http://www.pki.admin.ch/cps/CPS_2_16_756_1_17_3_21_1.pdf0:
Source: dfsvc.exe, 00000001.00000003.273840100.000001F5C12E6000.00000004.00000001.sdmp	String found in binary or memory: http://www.pki.admin.ch/policy/CPS_2_16_756_1_17_3_21_1.pdf0
Source: dfsvc.exe, 00000001.00000003.274059011.000001F5C1224000.00000004.00000001.sdmp	String found in binary or memory: http://www.pki.gva.es/cps0
Source: dfsvc.exe, 00000001.00000003.274059011.000001F5C1224000.00000004.00000001.sdmp	String found in binary or memory: http://www.pki.gva.es/cps0%
Source: dfsvc.exe, 00000001.00000003.273892998.000001F5C11EC000.00000004.00000001.sdmp	String found in binary or memory: http://www.pkioverheid.nl/policies/root-policy-G20
Source: dfsvc.exe, 00000001.00000003.274059011.000001F5C1224000.00000004.00000001.sdmp	String found in binary or memory: http://www.pkioverheid.nl/policies/root-policy0
Source: dfsvc.exe, 00000001.00000003.274059011.000001F5C1224000.00000004.00000001.sdmp	String found in binary or memory: http://www.postsignum.cz/crl/psrootqca2.crl02
Source: dfsvc.exe, 00000001.00000003.273840100.000001F5C12E6000.00000004.00000001.sdmp	String found in binary or memory: http://www.quovadis.bm0
Source: dfsvc.exe, 00000001.00000003.274112378.000001F5C1213000.00000004.00000001.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: dfsvc.exe, 00000001.00000003.274059011.000001F5C1224000.00000004.00000001.sdmp	String found in binary or memory: http://www.rcsc.lt/repository0
Source: dfsvc.exe, 00000001.00000003.228475074.000001F5BF819000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: dfsvc.exe, 00000001.00000003.228475074.000001F5BF819000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com64
Source: dfsvc.exe, 00000001.00000003.228475074.000001F5BF819000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.comd
Source: dfsvc.exe, 00000001.00000003.228475074.000001F5BF819000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.comr
Source: dfsvc.exe, 00000001.00000003.236915282.000001F5BF817000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/.
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/:
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/AppelCom
Source: SilaeClient.exe, 0000000D.00000000.321067456.0000000000AF2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/IIWCF/AppelComResponse
Source: SilaeClient.exe, 0000000D.00000000.321067456.0000000000AF2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/IIWCF/AppelComT
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_AdministrationCollaborateurEnregistrement
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_AdministrationCollaborateurLecture
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_AffecterCleDossier
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_AnalyseProductionPaie
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_AnalyseProductionPaieUtilisateurs
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_BureautiquePaieNombreDocumentsCrees
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_ComptesNumeroIntitule
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_ControlerBulletinsPeriode
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_CreationClient
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_CreationDossierPaie
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_CreationSalarieEmplois
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_DefinitionPeriodeComptableDossier
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_DocQuery
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_DossierRecupererPeriodeEnCours
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_EcrituresComptables
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_EditionEtatDesPaiements
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_EditionJournalDePaie
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_EditionTableauDesCharges
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_EtablissementsAExclureCVAE
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_EtatSession
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_ExcelChercheValeurComptaV2
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_ExcelChercheValeurPaieBulletinV2
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_ExcelChercheValeurPaieClientV2
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_ExcelChercheValeurPaieEtablissementV2
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_ExcelChercheValeurPaieLigneBulletinV2
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_ExcelChercheValeurPaieSalarieV2
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_ExcelLogin
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_GererCycleDePaie
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_GererEtatDossierPaie
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_GererEtatRobotDePaie
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_LectureCodeClientFacturation
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_LectureInformationsDossier
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_LectureInformationsPaie
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_ListeDossiers
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_ListeDossiersSelonDroit
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_ListeDossiersT
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_ListeInformationsDossiersPaie
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_ListeNumerosDossiers
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_ListeSalarieEmplois
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_ListeSalaries
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_Login
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_LoginSimple
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_Logout
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_LogoutSimple
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_RAZPeriodeComptableDossier
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_RecuperationInformationsDomainesEtUtilisateurs
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_RecupererImage
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_SalarieAbsences
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_SalarieAjouterAbsence
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_SalarieAjouterAcompte
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_SalarieAjouterActiviteJournaliere
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_SalarieAjouterActiviteJournaliereSurEmploi
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_SalarieAjouterElementVariable
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_SalarieAjouterElementVariableSurEmploi
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_SalarieAjouterHeures
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_SalarieAjouterHeuresNatives
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_SalarieAjouterHeuresNativesSurEmploi
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_SalarieAjouterHeuresSurEmploi
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_SalarieAjouterPrime
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_SalarieAjouterPrimeSurEmploi
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_SalarieBulletinEntete
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_SalarieBulletinLignes
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_SalarieEmploiClassificationMetier
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_SalarieLectureInformations
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_SalarieRecupererPeriodeDernierBulletinCalcule
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_SalarieReinitialiserSaisies
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_SalariesBulletins
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_SalariesConfirmerSaisies
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_SalariesDUE
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_SalariesStockVar
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_SiteGenereMotDePasseAlternatif
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_SiteLogin
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_SiteLoginEx
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_SiteLoginRep
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_SoldeRepos
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_SpectacleCreation
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_SpectacleListe
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_SpectacleSalarieAcquisitionAffectations
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_SpectacleSalarieAjouterAffectations
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_SpectacleSalarieCalculerBulletin
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_SpectacleSalarieReinitialiserAffectations
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_UtilisateurSalarieEnregistrerDemandeAbsence
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_UtilisateurSalarieEnvoyerMailAnnulationAbsence
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_UtilisateurSalarieListeBulletins
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_UtilisateurSalarieObtenirMailAnnulationAbsence
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_UtilisateurSalarieRecupererAbsences
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_UtilisateurSalarieRecupererCodesAbsenceAutorises
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_UtilisateurSalarieRecupererImage
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_UtilisateurSalarieRecupererInfosConges
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_UtilisateurSalarieSupprimerDemandeAbsence
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_UtilisateurSuperviseurAjouterAbsencesMultiples
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_UtilisateurSuperviseurEnvoyerMail
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_UtilisateurSuperviseurRecupererAbsences
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_UtilisateurSuperviseurRecupererCodesAbsenceAutorisesPourSalarie
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_UtilisateurSuperviseurRecupererDemandesConges
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_UtilisateurSuperviseurRejeterDemandeAbsence
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_UtilisateurSuperviseurRejeterDemandesAbsence
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_UtilisateurSuperviseurValiderDemandeAbsence
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_UtilisateurSuperviseurValiderDemandesAbsence
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/SWS_ValideCleDossier
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/T
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silae.fr/TU
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silaedocs.fr/
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silaedocs.fr/contrats/netentreprises.pdf
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silaedocs.fr/contrats/netentreprises.pdfqSouscription
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silaexpertdev.fr/silae/sws/sws.asmx
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: http://www.silaexpertdev.fr/silae/sws/sws.asmx)
Source: dfsvc.exe, 00000001.00000003.274101045.000001F5C11FD000.00000004.00000001.sdmp	String found in binary or memory: http://www.sk.ee/cps/0
Source: dfsvc.exe, 00000001.00000003.274101045.000001F5C11FD000.00000004.00000001.sdmp	String found in binary or memory: http://www.sk.ee/juur/crl/0
Source: dfsvc.exe, 00000001.00000003.274101045.000001F5C11FD000.00000004.00000001.sdmp	String found in binary or memory: http://www.ssc.lt/cps03
Source: dfsvc.exe, 00000001.00000003.273840100.000001F5C12E6000.00000004.00000001.sdmp	String found in binary or memory: http://www.suscerte.gob.ve/dpc0
Source: dfsvc.exe, 00000001.00000003.273840100.000001F5C12E6000.00000004.00000001.sdmp	String found in binary or memory: http://www.suscerte.gob.ve/lcr0#
Source: dfsvc.exe, 00000001.00000003.273840100.000001F5C12E6000.00000004.00000001.sdmp	String found in binary or memory: http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl
Source: dfsvc.exe, 00000001.00000003.274013361.000001F5C12E4000.00000004.00000001.sdmp	String found in binary or memory: http://www.trustdst.com/certificates/policy/ACES-index.html0
Source: dfsvc.exe, 00000001.00000003.230617812.000001F5BF819000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.net
Source: dfsvc.exe, 00000001.00000003.230617812.000001F5BF819000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.netnetTTFo%4
Source: dfsvc.exe, 00000001.00000003.273840100.000001F5C12E6000.00000004.00000001.sdmp	String found in binary or memory: http://www.uce.gub.uy/acrn/acrn.crl0
Source: dfsvc.exe, 00000001.00000003.273840100.000001F5C12E6000.00000004.00000001.sdmp	String found in binary or memory: http://www.uce.gub.uy/informacion-tecnica/politicas/cp_acrn.pdf0G
Source: SilaeClient.exe, 0000000D.00000003.328770717.0000000001BD6000.00000004.00000001.sdmp	String found in binary or memory: http://www.w3.oP
Source: dfsvc.exe, 00000001.00000003.274059011.000001F5C1224000.00000004.00000001.sdmp	String found in binary or memory: http://www2.postsignum.cz/crl/psrootqca2.crl01
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: https://activitepartielle.emploi.gouv.fr/aparts/
Source: dfsvc.exe, 00000001.00000003.274059011.000001F5C1224000.00000004.00000001.sdmp	String found in binary or memory: https://crl.anf.es/AC/ANFServerCA.crl0
Source: dfsvc.exe, 00000001.00000003.273840100.000001F5C12E6000.00000004.00000001.sdmp	String found in binary or memory: https://eca.hinet.net/repository0
Source: dfsvc.exe, 00000001.00000003.273840100.000001F5C12E6000.00000004.00000001.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: dfsvc.exe, 00000001.00000003.274112378.000001F5C1213000.00000004.00000001.sdmp	String found in binary or memory: https://rca.e-szigno.hu/ocsp0-
Source: SilaeClient.exe, 0000000D.00000003.331803520.000000001C98B000.00000004.00000001.sdmp	String found in binary or memory: https://sectigo.com/CPS0D
Source: dfsvc.exe, 00000001.00000003.273892998.000001F5C11EC000.00000004.00000001.sdmp	String found in binary or memory: https://web.certicamara.com/marco-legal0Z
Source: dfsvc.exe, 00000001.00000003.274059011.000001F5C1224000.00000004.00000001.sdmp	String found in binary or memory: https://www.anf.es/AC/ACTAS/789230
Source: dfsvc.exe, 00000001.00000003.274059011.000001F5C1224000.00000004.00000001.sdmp	String found in binary or memory: https://www.anf.es/AC/ANFServerCA.crl0
Source: dfsvc.exe, 00000001.00000003.274059011.000001F5C1224000.00000004.00000001.sdmp	String found in binary or memory: https://www.anf.es/address/)1(0&
Source: dfsvc.exe, 00000001.00000003.274112378.000001F5C1213000.00000004.00000001.sdmp	String found in binary or memory: https://www.catcert.net/verarrel
Source: dfsvc.exe, 00000001.00000003.274112378.000001F5C1213000.00000004.00000001.sdmp	String found in binary or memory: https://www.catcert.net/verarrel05
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: https://www.jedeclare.com/webservices/wspid_spring/CommunicationV2Service/
Source: SilaeClient.exe, 0000000D.00000000.323884140.00000000014F2000.00000002.00020000.sdmp	String found in binary or memory: https://www.jedeclare.com/webservices/wspid_spring/CommunicationV2Service/3
Source: dfsvc.exe, 00000001.00000003.274153696.000001F5C1258000.00000004.00000001.sdmp	String found in binary or memory: https://www.netlock.hu/docs/
Source: dfsvc.exe, 00000001.00000003.274059011.000001F5C1224000.00000004.00000001.sdmp	String found in binary or memory: https://www.netlock.net/docs
Source: dfsvc.exe, 00000001.00000003.274033616.000001F5C1207000.00000004.00000001.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/0m

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\74FBF93595CFC8459196065CE54AD928

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

File created: C:\Windows\assembly\Desktop.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Apps\2.0\LPXCVOAB.EL6\HLP17DZ7.VHN\sila...app_a698a498bfdfbd33_0001.04eb_cb6a484e7a863a2b\SilaeClient.exe

Code function: 13_2_00007FFAE8F557FD

13_2_00007FFAE8F557FD

Source: unknown

Process created: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe dw20.exe -x -s 1524

Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Section loaded: phoneinfo.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Section loaded: ext-ms-win-xblauth-console-l1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Section loaded: ext-ms-win-xblauth-console-l1.dll	Jump to behavior

Source: dfsvc.exe, 00000001.00000003.229766304.000001F5BF847000.00000004.00000001.sdmp

Source: classification engine

Classification label: mal48.winAPPLICATION@5/34@2/1

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

File created: C:\Users\user\AppData\Local\Deployment

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

File created: C:\Users\user\AppData\Local\Temp\Deployment

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\077cf2bd55145d691314f0889d7a1997\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\LPXCVOAB.EL6\HLP17DZ7.VHN\sila...app_a698a498bfdfbd33_0001.04eb_cb6a484e7a863a2b\SilaeClient.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\077cf2bd55145d691314f0889d7a1997\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\LPXCVOAB.EL6\HLP17DZ7.VHN\sila...app_a698a498bfdfbd33_0001.04eb_cb6a484e7a863a2b\SilaeClient.exe	Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\LPXCVOAB.EL6\HLP17DZ7.VHN\sila...app_a698a498bfdfbd33_0001.04eb_cb6a484e7a863a2b\SilaeClient.exe	Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Apps\2.0\LPXCVOAB.EL6\HLP17DZ7.VHN\sila...app_a698a498bfdfbd33_0001.04eb_cb6a484e7a863a2b\SilaeClient.exe C:\Users\user\AppData\Local\Apps\2.0\LPXCVOAB.EL6\HLP17DZ7.VHN\sila...app_a698a498bfdfbd33_0001.04eb_cb6a484e7a863a2b\SilaeClient.exe
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe dw20.exe -x -s 1524
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process created: C:\Users\user\AppData\Local\Apps\2.0\LPXCVOAB.EL6\HLP17DZ7.VHN\sila...app_a698a498bfdfbd33_0001.04eb_cb6a484e7a863a2b\SilaeClient.exe C:\Users\user\AppData\Local\Apps\2.0\LPXCVOAB.EL6\HLP17DZ7.VHN\sila...app_a698a498bfdfbd33_0001.04eb_cb6a484e7a863a2b\SilaeClient.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\LPXCVOAB.EL6\HLP17DZ7.VHN\sila...app_a698a498bfdfbd33_0001.04eb_cb6a484e7a863a2b\SilaeClient.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe dw20.exe -x -s 1524	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

File written: C:\Windows\assembly\Desktop.ini

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Apps\2.0\LPXCVOAB.EL6\HLP17DZ7.VHN\sila...app_a698a498bfdfbd33_0001.04eb_cb6a484e7a863a2b\SilaeClient.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

File opened: C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_88df21dd2faf7c49\MSVCR80.dll

Jump to behavior

Source:	Binary string: C:\dev\VS2008\Applications\PeopleDoc\obj\Release\PeopleDoc.pdbt~ source: SilaeClient.exe, 0000000D.00000000.321067456.0000000000AF2000.00000002.00020000.sdmp
Source:	Binary string: C:\DEV\VS2008\Applications\SOREGORDLL\obj\Release\SOREGORDLL.pdb source: SilaeClient.exe, 0000000D.00000000.321067456.0000000000AF2000.00000002.00020000.sdmp
Source:	Binary string: C:\DEV\VS2008\Applications\EDOCDLL\obj\Release\EDOCDLL.pdb source: SilaeClient.exe, 0000000D.00000000.321067456.0000000000AF2000.00000002.00020000.sdmp
Source:	Binary string: C:\DEV\VS2008\Applications\ZIPDLL\obj\Release\ZIPDLL.pdb source: SilaeClient.exe, 0000000D.00000000.321067456.0000000000AF2000.00000002.00020000.sdmp
Source:	Binary string: C:\DEV\VS2008\Applications\DaoExec\obj\x86\Release\DaoExec.pdb source: SilaeClient.exe, 0000000D.00000000.321067456.0000000000AF2000.00000002.00020000.sdmp
Source:	Binary string: C:\DEV\VS2008\Applications\Scan2Folder\obj\x86\Release\Scan2Folder.pdb source: SilaeClient.exe, 0000000D.00000000.321067456.0000000000AF2000.00000002.00020000.sdmp
Source:	Binary string: C:\DEV\VS2008\Applications\XPSDLL\obj\Release\XPSDLL.pdb$x>x 0x_CorDllMainmscoree.dll source: SilaeClient.exe, 0000000D.00000000.321067456.0000000000AF2000.00000002.00020000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Apps\2.0\LPXCVOAB.EL6\HLP17DZ7.VHN\sila...app_a698a498bfdfbd33_0001.04eb_cb6a484e7a863a2b\SilaeClient.PDB source: SilaeClient.exe, 0000000D.00000002.424648309.0000000001B7A000.00000004.00000020.sdmp
Source:	Binary string: C:\dev\VS2008\Applications\PeopleDoc\obj\Release\PeopleDoc.pdb source: SilaeClient.exe, 0000000D.00000000.321067456.0000000000AF2000.00000002.00020000.sdmp
Source:	Binary string: C:\DEV\VS2008\Applications\Scan2Folder\obj\x86\Release\Scan2Folder.pdb source: SilaeClient.exe, 0000000D.00000000.321067456.0000000000AF2000.00000002.00020000.sdmp
Source:	Binary string: mscorrc.pdb source: SilaeClient.exe, 0000000D.00000002.426143878.000000001C540000.00000002.00000001.sdmp
Source:	Binary string: C:\DEV\VS2008\Applications\XPSDLL\obj\Release\XPSDLL.pdb source: SilaeClient.exe, 0000000D.00000000.321067456.0000000000AF2000.00000002.00020000.sdmp

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\XZR8T96H.RXL\BPJNJPG8.517\ExcelLibrary.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\XZR8T96H.RXL\BPJNJPG8.517\SilaeClient.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\XZR8T96H.RXL\BPJNJPG8.517\DevComponents.DotNetBar.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Apps\2.0\LPXCVOAB.EL6\HLP17DZ7.VHN\sila...app_a698a498bfdfbd33_0001.04eb_cb6a484e7a863a2b\SilaeClient.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Apps\2.0\LPXCVOAB.EL6\HLP17DZ7.VHN\sila...app_a698a498bfdfbd33_0001.04eb_cb6a484e7a863a2b\ExcelLibrary.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Apps\2.0\LPXCVOAB.EL6\HLP17DZ7.VHN\sila...app_a698a498bfdfbd33_0001.04eb_cb6a484e7a863a2b\DevComponents.DotNetBar.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Key value created or modified: HKEY_CURRENT_USER_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\sila...app_a698a498bfdfbd33_0001.04eb_a97f4f42ea654217 {c989bb7a-8385-4715-98cf-a741a8edb823}!ApplicationTrust

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\LPXCVOAB.EL6\HLP17DZ7.VHN\sila...app_a698a498bfdfbd33_0001.04eb_cb6a484e7a863a2b\SilaeClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\LPXCVOAB.EL6\HLP17DZ7.VHN\sila...app_a698a498bfdfbd33_0001.04eb_cb6a484e7a863a2b\SilaeClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\LPXCVOAB.EL6\HLP17DZ7.VHN\sila...app_a698a498bfdfbd33_0001.04eb_cb6a484e7a863a2b\SilaeClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\LPXCVOAB.EL6\HLP17DZ7.VHN\sila...app_a698a498bfdfbd33_0001.04eb_cb6a484e7a863a2b\SilaeClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\LPXCVOAB.EL6\HLP17DZ7.VHN\sila...app_a698a498bfdfbd33_0001.04eb_cb6a484e7a863a2b\SilaeClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\LPXCVOAB.EL6\HLP17DZ7.VHN\sila...app_a698a498bfdfbd33_0001.04eb_cb6a484e7a863a2b\SilaeClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\LPXCVOAB.EL6\HLP17DZ7.VHN\sila...app_a698a498bfdfbd33_0001.04eb_cb6a484e7a863a2b\SilaeClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\LPXCVOAB

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report SilaeClient.application

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Sigma Overview

Signature Overview

Spreading:

Networking:

E-Banking Fraud:

System Summary:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection: