Windows Analysis Report
P1 BOL.exe

Overview

General Information

Sample name: P1 BOL.exe
Analysis ID: 1542080
MD5: ca46bdd8c9b4d199900c8c3c09acee71
SHA1: d3f17afe48b2958b3bcbf05590da4f5e00639c46
SHA256: 7bbdb77457e755afd372c75269a245fe4640762e37b46d9ca90211edfa848eb5
Tags: exeFormbook
Infos:

Detection

FormBook
Score: 80
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected FormBook
AI detected suspicious sample
Contains functionality to detect sleep reduction / modifications
Machine Learning detection for sample
Maps a DLL or memory area into another process
Switches to a custom stack to bypass stack traces
Writes to foreign memory regions
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
PE file contains an invalid checksum
Potential key logger detected (key state polling based)
Sample file is different than original file name gathered from version info
Sigma detected: Uncommon Svchost Parent Process
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: P1 BOL.exe ReversingLabs: Detection: 42%
Yara detected FormBook
Source: Yara match File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000002.2180166603.0000000003990000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.2179892339.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: P1 BOL.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: P1 BOL.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: Binary string: wntdll.pdbUGP source: P1 BOL.exe, 00000000.00000003.2069545284.00000000045A0000.00000004.00001000.00020000.00000000.sdmp, P1 BOL.exe, 00000000.00000003.2069416088.0000000004400000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2180211476.0000000003C00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2143381735.0000000003A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2141589397.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2180211476.0000000003D9E000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: P1 BOL.exe, 00000000.00000003.2069545284.00000000045A0000.00000004.00001000.00020000.00000000.sdmp, P1 BOL.exe, 00000000.00000003.2069416088.0000000004400000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000002.2180211476.0000000003C00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2143381735.0000000003A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2141589397.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2180211476.0000000003D9E000.00000040.00001000.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose, 0_2_00452126
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_0045C999 FindFirstFileW,FindNextFileW,FindClose, 0_2_0045C999
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose, 0_2_00436ADE
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 0_2_00434BEE
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_0045DD7C FindFirstFileW,FindClose, 0_2_0045DD7C
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_0044BD29 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose, 0_2_0044BD29
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle, 0_2_00436D2D
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 0_2_00442E1F
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, 0_2_00475FE5
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_0044BF8D _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose, 0_2_0044BF8D
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_0044289D InternetQueryDataAvailable,InternetReadFile, 0_2_0044289D
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_0046C5D0 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard, 0_2_0046C5D0
Contains functionality to modify clipboard data
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_00459FFF OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard, 0_2_00459FFF
Contains functionality to read the clipboard data
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_0046C5D0 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard, 0_2_0046C5D0
Contains functionality to retrieve information about pressed keystrokes
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_00456354 GetCursorPos,ScreenToClient,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetWindowLongW, 0_2_00456354
Potential key logger detected (key state polling based)
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_0047C08E SendMessageW,DefDlgProcW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,GetWindowLongW,SendMessageW,SendMessageW,SendMessageW,_wcsncpy,SendMessageW,SendMessageW,SendMessageW,InvalidateRect,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW, 0_2_0047C08E

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000002.2180166603.0000000003990000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.2179892339.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Contains functionality to call native functions
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_0042C6A3 NtClose, 2_2_0042C6A3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72B60 NtClose,LdrInitializeThunk, 2_2_03C72B60
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72DF0 NtQuerySystemInformation,LdrInitializeThunk, 2_2_03C72DF0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C735C0 NtCreateMutant,LdrInitializeThunk, 2_2_03C735C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C74340 NtSetContextThread, 2_2_03C74340
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C74650 NtSuspendThread, 2_2_03C74650
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72BE0 NtQueryValueKey, 2_2_03C72BE0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72BF0 NtAllocateVirtualMemory, 2_2_03C72BF0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72B80 NtQueryInformationFile, 2_2_03C72B80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72BA0 NtEnumerateValueKey, 2_2_03C72BA0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72AD0 NtReadFile, 2_2_03C72AD0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72AF0 NtWriteFile, 2_2_03C72AF0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72AB0 NtWaitForSingleObject, 2_2_03C72AB0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72FE0 NtCreateFile, 2_2_03C72FE0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72F90 NtProtectVirtualMemory, 2_2_03C72F90
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72FA0 NtQuerySection, 2_2_03C72FA0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72FB0 NtResumeThread, 2_2_03C72FB0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72F60 NtCreateProcessEx, 2_2_03C72F60
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72F30 NtCreateSection, 2_2_03C72F30
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72EE0 NtQueueApcThread, 2_2_03C72EE0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72E80 NtReadVirtualMemory, 2_2_03C72E80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72EA0 NtAdjustPrivilegesToken, 2_2_03C72EA0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72E30 NtWriteVirtualMemory, 2_2_03C72E30
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72DD0 NtDelayExecution, 2_2_03C72DD0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72DB0 NtEnumerateKey, 2_2_03C72DB0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72D00 NtSetInformationFile, 2_2_03C72D00
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72D10 NtMapViewOfSection, 2_2_03C72D10
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72D30 NtUnmapViewOfSection, 2_2_03C72D30
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72CC0 NtQueryVirtualMemory, 2_2_03C72CC0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72CF0 NtOpenProcess, 2_2_03C72CF0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72CA0 NtQueryInformationToken, 2_2_03C72CA0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72C60 NtCreateKey, 2_2_03C72C60
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72C70 NtFreeVirtualMemory, 2_2_03C72C70
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72C00 NtQueryInformationProcess, 2_2_03C72C00
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C73090 NtSetValueKey, 2_2_03C73090
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C73010 NtOpenDirectoryObject, 2_2_03C73010
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C739B0 NtGetContextThread, 2_2_03C739B0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C73D70 NtOpenThread, 2_2_03C73D70
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C73D10 NtOpenProcessToken, 2_2_03C73D10
Contains functionality to communicate with device drivers
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_00434D50: GetFullPathNameW,__swprintf,_wcslen,_wcslen,_wcslen,CreateDirectoryW,CreateFileW,_memset,_wcslen,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle, 0_2_00434D50
Contains functionality to launch a process as a different user
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_004461ED _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,_wcsncpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock, 0_2_004461ED
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState, 0_2_004364AA
Detected potential crypto function
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_00409A40 0_2_00409A40
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_00412038 0_2_00412038
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_00427161 0_2_00427161
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_0047E1FA 0_2_0047E1FA
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_004212BE 0_2_004212BE
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_00443390 0_2_00443390
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_00443391 0_2_00443391
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_0041A46B 0_2_0041A46B
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_0041240C 0_2_0041240C
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_00446566 0_2_00446566
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_004045E0 0_2_004045E0
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_0041D750 0_2_0041D750
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_004037E0 0_2_004037E0
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_00427859 0_2_00427859
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_00412818 0_2_00412818
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_0040F890 0_2_0040F890
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_0042397B 0_2_0042397B
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_00411B63 0_2_00411B63
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_0047CBF0 0_2_0047CBF0
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_0044EBBC 0_2_0044EBBC
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_00412C38 0_2_00412C38
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_0044ED9A 0_2_0044ED9A
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_00423EBF 0_2_00423EBF
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_00424F70 0_2_00424F70
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_0041AF0D 0_2_0041AF0D
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_03F99240 0_2_03F99240
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_004017EA 2_2_004017EA
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_004030B0 2_2_004030B0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_00410163 2_2_00410163
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_004031AE 2_2_004031AE
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_00416A4E 2_2_00416A4E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_00416A53 2_2_00416A53
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_00410383 2_2_00410383
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_0040E403 2_2_0040E403
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_00402C1F 2_2_00402C1F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_00402C20 2_2_00402C20
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_0042ECD3 2_2_0042ECD3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_00402490 2_2_00402490
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_00402760 2_2_00402760
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4E3F0 2_2_03C4E3F0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D003E6 2_2_03D003E6
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CFA352 2_2_03CFA352
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC02C0 2_2_03CC02C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE0274 2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF81CC 2_2_03CF81CC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF41A2 2_2_03CF41A2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D001AA 2_2_03D001AA
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC8158 2_2_03CC8158
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C30100 2_2_03C30100
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDA118 2_2_03CDA118
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CD2000 2_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3C7C0 2_2_03C3C7C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C64750 2_2_03C64750
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40770 2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5C6E0 2_2_03C5C6E0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D00591 2_2_03D00591
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40535 2_2_03C40535
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CEE4F6 2_2_03CEE4F6
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF2446 2_2_03CF2446
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE4420 2_2_03CE4420
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF6BD7 2_2_03CF6BD7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CFAB40 2_2_03CFAB40
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3EA80 2_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C429A0 2_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D0A9A6 2_2_03D0A9A6
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C56962 2_2_03C56962
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6E8F0 2_2_03C6E8F0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C268B8 2_2_03C268B8
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4A840 2_2_03C4A840
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C42840 2_2_03C42840
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C32FC8 2_2_03C32FC8
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4CFE0 2_2_03C4CFE0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CBEFA0 2_2_03CBEFA0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB4F40 2_2_03CB4F40
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C82F28 2_2_03C82F28
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C60F30 2_2_03C60F30
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE2F30 2_2_03CE2F30
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CFEEDB 2_2_03CFEEDB
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C52E90 2_2_03C52E90
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CFCE93 2_2_03CFCE93
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40E59 2_2_03C40E59
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CFEE26 2_2_03CFEE26
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3ADE0 2_2_03C3ADE0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C58DBF 2_2_03C58DBF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4AD00 2_2_03C4AD00
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDCD1F 2_2_03CDCD1F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C30CF2 2_2_03C30CF2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE0CB5 2_2_03CE0CB5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40C00 2_2_03C40C00
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C8739A 2_2_03C8739A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2D34C 2_2_03C2D34C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF132D 2_2_03CF132D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5B2C0 2_2_03C5B2C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE12ED 2_2_03CE12ED
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C452A0 2_2_03C452A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4B1B0 2_2_03C4B1B0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C7516C 2_2_03C7516C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2F172 2_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D0B16B 2_2_03D0B16B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CEF0CC 2_2_03CEF0CC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C470C0 2_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF70E9 2_2_03CF70E9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CFF0E0 2_2_03CFF0E0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CFF7B0 2_2_03CFF7B0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF16CC 2_2_03CF16CC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C85630 2_2_03C85630
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D095C3 2_2_03D095C3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDD5B0 2_2_03CDD5B0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF7571 2_2_03CF7571
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C31460 2_2_03C31460
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CFF43F 2_2_03CFF43F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB5BF0 2_2_03CB5BF0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C7DBF9 2_2_03C7DBF9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5FB80 2_2_03C5FB80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CFFB76 2_2_03CFFB76
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CEDAC6 2_2_03CEDAC6
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDDAAC 2_2_03CDDAAC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C85AA0 2_2_03C85AA0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE1AA3 2_2_03CE1AA3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CFFA49 2_2_03CFFA49
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF7A46 2_2_03CF7A46
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB3A6C 2_2_03CB3A6C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C49950 2_2_03C49950
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5B950 2_2_03C5B950
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CD5910 2_2_03CD5910
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C438E0 2_2_03C438E0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAD800 2_2_03CAD800
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C03FD2 2_2_03C03FD2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C03FD5 2_2_03C03FD5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C41F92 2_2_03C41F92
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CFFFB1 2_2_03CFFFB1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CFFF09 2_2_03CFFF09
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C49EB0 2_2_03C49EB0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5FDC0 2_2_03C5FDC0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C43D40 2_2_03C43D40
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF1D5A 2_2_03CF1D5A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF7D73 2_2_03CF7D73
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CFFCF2 2_2_03CFFCF2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB9C32 2_2_03CB9C32
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\svchost.exe Code function: String function: 03C87E54 appears 111 times
Source: C:\Windows\SysWOW64\svchost.exe Code function: String function: 03CBF290 appears 105 times
Source: C:\Windows\SysWOW64\svchost.exe Code function: String function: 03C75130 appears 58 times
Source: C:\Windows\SysWOW64\svchost.exe Code function: String function: 03C2B970 appears 280 times
Source: C:\Windows\SysWOW64\svchost.exe Code function: String function: 03CAEA12 appears 86 times
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: String function: 00445975 appears 65 times
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: String function: 0041171A appears 37 times
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: String function: 0041718C appears 45 times
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: String function: 0040E6D0 appears 35 times
Sample file is different than original file name gathered from version info
Source: P1 BOL.exe, 00000000.00000003.2069139645.00000000046CD000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs P1 BOL.exe
Source: P1 BOL.exe, 00000000.00000003.2069416088.0000000004523000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs P1 BOL.exe
Uses 32bit PE files
Source: P1 BOL.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: classification engine Classification label: mal80.troj.evad.winEXE@3/1@0/0
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_0044AF5C GetLastError,FormatMessageW, 0_2_0044AF5C
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_00464422 OpenProcess,GetLastError,GetLastError,GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,AdjustTokenPrivileges,GetLastError,OpenProcess,AdjustTokenPrivileges,CloseHandle,TerminateProcess,GetLastError,CloseHandle, 0_2_00464422
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState, 0_2_004364AA
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_0045D517 SetErrorMode,GetDiskFreeSpaceW,GetLastError,SetErrorMode, 0_2_0045D517
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_0043701F CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,__wcsicoll,CloseHandle, 0_2_0043701F
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_0047A999 OleInitialize,CLSIDFromProgID,CoCreateInstance,CoInitializeSecurity,_memset,_wcslen,_memset,CoCreateInstanceEx,CoSetProxyBlanket, 0_2_0047A999
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_0043614F __swprintf,__swprintf,__wcsicoll,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx, 0_2_0043614F
Source: C:\Users\user\Desktop\P1 BOL.exe File created: C:\Users\user\AppData\Local\Temp\nouses Jump to behavior
Source: P1 BOL.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\P1 BOL.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\P1 BOL.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: P1 BOL.exe ReversingLabs: Detection: 42%
Source: C:\Users\user\Desktop\P1 BOL.exe File read: C:\Users\user\Desktop\P1 BOL.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\P1 BOL.exe "C:\Users\user\Desktop\P1 BOL.exe"
Source: C:\Users\user\Desktop\P1 BOL.exe Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\P1 BOL.exe"
Source: C:\Users\user\Desktop\P1 BOL.exe Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\P1 BOL.exe" Jump to behavior
Source: C:\Users\user\Desktop\P1 BOL.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\P1 BOL.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\Desktop\P1 BOL.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\P1 BOL.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\P1 BOL.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\P1 BOL.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\P1 BOL.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\P1 BOL.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\P1 BOL.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\P1 BOL.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\P1 BOL.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\P1 BOL.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32 Jump to behavior
Source: P1 BOL.exe Static file information: File size 1342625 > 1048576
Source: Binary string: wntdll.pdbUGP source: P1 BOL.exe, 00000000.00000003.2069545284.00000000045A0000.00000004.00001000.00020000.00000000.sdmp, P1 BOL.exe, 00000000.00000003.2069416088.0000000004400000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2180211476.0000000003C00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2143381735.0000000003A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2141589397.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2180211476.0000000003D9E000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: P1 BOL.exe, 00000000.00000003.2069545284.00000000045A0000.00000004.00001000.00020000.00000000.sdmp, P1 BOL.exe, 00000000.00000003.2069416088.0000000004400000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000002.2180211476.0000000003C00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2143381735.0000000003A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2141589397.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2180211476.0000000003D9E000.00000040.00001000.00020000.00000000.sdmp
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_0040EB70 LoadLibraryA,GetProcAddress, 0_2_0040EB70
PE file contains an invalid checksum
Source: P1 BOL.exe Static PE information: real checksum: 0xa2135 should be: 0x14d7a6
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_004171D1 push ecx; ret 0_2_004171E4
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_0040205C push ebx; iretd 2_2_004020F0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_0040501A pushad ; iretd 2_2_0040501C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_0041482A push edi; ret 2_2_0041482B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_0040212A push ebx; iretd 2_2_00402161
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_0041A9C3 push edi; ret 2_2_0041A9CC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_0040C9C7 push ds; ret 2_2_0040C9C9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_004141FB push esp; retf 2_2_0041420A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_0041A9B0 push edi; ret 2_2_0041A9CC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_00411B5B push esp; retf 2_2_00411B5C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_00403330 push eax; ret 2_2_00403332
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_0041ECA6 push ds; ret 2_2_0041ECA7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_0041255B push esp; iretd 2_2_00412570
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_0041F704 push ecx; iretd 2_2_0041F70C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_0040D717 push edi; iretd 2_2_0040D749
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C0225F pushad ; ret 2_2_03C027F9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C027FA pushad ; ret 2_2_03C027F9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C309AD push ecx; mov dword ptr [esp], ecx 2_2_03C309B6
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C0283D push eax; iretd 2_2_03C02858
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C01368 push eax; iretd 2_2_03C01369
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C01065 push edi; ret 2_2_03C0108A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C018F3 push edx; iretd 2_2_03C01906
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_004772DE IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed, 0_2_004772DE
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput, 0_2_004375B0
Source: C:\Users\user\Desktop\P1 BOL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Contains functionality to detect sleep reduction / modifications
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_00444078 0_2_00444078
Switches to a custom stack to bypass stack traces
Source: C:\Users\user\Desktop\P1 BOL.exe API/Special instruction interceptor: Address: 3F98E64
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C7096E rdtsc 2_2_03C7096E
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\P1 BOL.exe API coverage: 3.3 %
Source: C:\Windows\SysWOW64\svchost.exe API coverage: 0.6 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\SysWOW64\svchost.exe TID: 940 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose, 0_2_00452126
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_0045C999 FindFirstFileW,FindNextFileW,FindClose, 0_2_0045C999
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose, 0_2_00436ADE
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 0_2_00434BEE
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_0045DD7C FindFirstFileW,FindClose, 0_2_0045DD7C
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_0044BD29 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose, 0_2_0044BD29
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle, 0_2_00436D2D
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 0_2_00442E1F
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, 0_2_00475FE5
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_0044BF8D _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose, 0_2_0044BF8D
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo, 0_2_0040E470
Source: C:\Windows\SysWOW64\svchost.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Windows\SysWOW64\svchost.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C7096E rdtsc 2_2_03C7096E
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_004179A3 LdrLoadDll, 2_2_004179A3
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_0045A259 BlockInput, 0_2_0045A259
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_0040D6D0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW, 0_2_0040D6D0
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_0040EB70 LoadLibraryA,GetProcAddress, 0_2_0040EB70
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_03F99130 mov eax, dword ptr fs:[00000030h] 0_2_03F99130
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_03F990D0 mov eax, dword ptr fs:[00000030h] 0_2_03F990D0
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_03F97AA0 mov eax, dword ptr fs:[00000030h] 0_2_03F97AA0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CEC3CD mov eax, dword ptr fs:[00000030h] 2_2_03CEC3CD
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3A3C0 mov eax, dword ptr fs:[00000030h] 2_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3A3C0 mov eax, dword ptr fs:[00000030h] 2_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3A3C0 mov eax, dword ptr fs:[00000030h] 2_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3A3C0 mov eax, dword ptr fs:[00000030h] 2_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3A3C0 mov eax, dword ptr fs:[00000030h] 2_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3A3C0 mov eax, dword ptr fs:[00000030h] 2_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C383C0 mov eax, dword ptr fs:[00000030h] 2_2_03C383C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C383C0 mov eax, dword ptr fs:[00000030h] 2_2_03C383C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C383C0 mov eax, dword ptr fs:[00000030h] 2_2_03C383C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C383C0 mov eax, dword ptr fs:[00000030h] 2_2_03C383C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB63C0 mov eax, dword ptr fs:[00000030h] 2_2_03CB63C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDE3DB mov eax, dword ptr fs:[00000030h] 2_2_03CDE3DB
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDE3DB mov eax, dword ptr fs:[00000030h] 2_2_03CDE3DB
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDE3DB mov ecx, dword ptr fs:[00000030h] 2_2_03CDE3DB
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDE3DB mov eax, dword ptr fs:[00000030h] 2_2_03CDE3DB
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CD43D4 mov eax, dword ptr fs:[00000030h] 2_2_03CD43D4
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CD43D4 mov eax, dword ptr fs:[00000030h] 2_2_03CD43D4
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C403E9 mov eax, dword ptr fs:[00000030h] 2_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C403E9 mov eax, dword ptr fs:[00000030h] 2_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C403E9 mov eax, dword ptr fs:[00000030h] 2_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C403E9 mov eax, dword ptr fs:[00000030h] 2_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C403E9 mov eax, dword ptr fs:[00000030h] 2_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C403E9 mov eax, dword ptr fs:[00000030h] 2_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C403E9 mov eax, dword ptr fs:[00000030h] 2_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C403E9 mov eax, dword ptr fs:[00000030h] 2_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4E3F0 mov eax, dword ptr fs:[00000030h] 2_2_03C4E3F0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4E3F0 mov eax, dword ptr fs:[00000030h] 2_2_03C4E3F0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4E3F0 mov eax, dword ptr fs:[00000030h] 2_2_03C4E3F0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C663FF mov eax, dword ptr fs:[00000030h] 2_2_03C663FF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2E388 mov eax, dword ptr fs:[00000030h] 2_2_03C2E388
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2E388 mov eax, dword ptr fs:[00000030h] 2_2_03C2E388
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2E388 mov eax, dword ptr fs:[00000030h] 2_2_03C2E388
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5438F mov eax, dword ptr fs:[00000030h] 2_2_03C5438F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5438F mov eax, dword ptr fs:[00000030h] 2_2_03C5438F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C28397 mov eax, dword ptr fs:[00000030h] 2_2_03C28397
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C28397 mov eax, dword ptr fs:[00000030h] 2_2_03C28397
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C28397 mov eax, dword ptr fs:[00000030h] 2_2_03C28397
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h] 2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h] 2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h] 2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h] 2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h] 2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h] 2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h] 2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h] 2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h] 2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h] 2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h] 2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h] 2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h] 2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h] 2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h] 2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB035C mov eax, dword ptr fs:[00000030h] 2_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB035C mov eax, dword ptr fs:[00000030h] 2_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB035C mov eax, dword ptr fs:[00000030h] 2_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB035C mov ecx, dword ptr fs:[00000030h] 2_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB035C mov eax, dword ptr fs:[00000030h] 2_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB035C mov eax, dword ptr fs:[00000030h] 2_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CFA352 mov eax, dword ptr fs:[00000030h] 2_2_03CFA352
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CD8350 mov ecx, dword ptr fs:[00000030h] 2_2_03CD8350
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D0634F mov eax, dword ptr fs:[00000030h] 2_2_03D0634F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CD437C mov eax, dword ptr fs:[00000030h] 2_2_03CD437C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6A30B mov eax, dword ptr fs:[00000030h] 2_2_03C6A30B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6A30B mov eax, dword ptr fs:[00000030h] 2_2_03C6A30B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6A30B mov eax, dword ptr fs:[00000030h] 2_2_03C6A30B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2C310 mov ecx, dword ptr fs:[00000030h] 2_2_03C2C310
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C50310 mov ecx, dword ptr fs:[00000030h] 2_2_03C50310
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D08324 mov eax, dword ptr fs:[00000030h] 2_2_03D08324
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D08324 mov ecx, dword ptr fs:[00000030h] 2_2_03D08324
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D08324 mov eax, dword ptr fs:[00000030h] 2_2_03D08324
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D08324 mov eax, dword ptr fs:[00000030h] 2_2_03D08324
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3A2C3 mov eax, dword ptr fs:[00000030h] 2_2_03C3A2C3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3A2C3 mov eax, dword ptr fs:[00000030h] 2_2_03C3A2C3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3A2C3 mov eax, dword ptr fs:[00000030h] 2_2_03C3A2C3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3A2C3 mov eax, dword ptr fs:[00000030h] 2_2_03C3A2C3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3A2C3 mov eax, dword ptr fs:[00000030h] 2_2_03C3A2C3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D062D6 mov eax, dword ptr fs:[00000030h] 2_2_03D062D6
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C402E1 mov eax, dword ptr fs:[00000030h] 2_2_03C402E1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C402E1 mov eax, dword ptr fs:[00000030h] 2_2_03C402E1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C402E1 mov eax, dword ptr fs:[00000030h] 2_2_03C402E1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6E284 mov eax, dword ptr fs:[00000030h] 2_2_03C6E284
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6E284 mov eax, dword ptr fs:[00000030h] 2_2_03C6E284
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB0283 mov eax, dword ptr fs:[00000030h] 2_2_03CB0283
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB0283 mov eax, dword ptr fs:[00000030h] 2_2_03CB0283
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB0283 mov eax, dword ptr fs:[00000030h] 2_2_03CB0283
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C402A0 mov eax, dword ptr fs:[00000030h] 2_2_03C402A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C402A0 mov eax, dword ptr fs:[00000030h] 2_2_03C402A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC62A0 mov eax, dword ptr fs:[00000030h] 2_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC62A0 mov ecx, dword ptr fs:[00000030h] 2_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC62A0 mov eax, dword ptr fs:[00000030h] 2_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC62A0 mov eax, dword ptr fs:[00000030h] 2_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC62A0 mov eax, dword ptr fs:[00000030h] 2_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC62A0 mov eax, dword ptr fs:[00000030h] 2_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB8243 mov eax, dword ptr fs:[00000030h] 2_2_03CB8243
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB8243 mov ecx, dword ptr fs:[00000030h] 2_2_03CB8243
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D0625D mov eax, dword ptr fs:[00000030h] 2_2_03D0625D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2A250 mov eax, dword ptr fs:[00000030h] 2_2_03C2A250
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C36259 mov eax, dword ptr fs:[00000030h] 2_2_03C36259
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CEA250 mov eax, dword ptr fs:[00000030h] 2_2_03CEA250
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CEA250 mov eax, dword ptr fs:[00000030h] 2_2_03CEA250
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C34260 mov eax, dword ptr fs:[00000030h] 2_2_03C34260
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C34260 mov eax, dword ptr fs:[00000030h] 2_2_03C34260
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C34260 mov eax, dword ptr fs:[00000030h] 2_2_03C34260
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2826B mov eax, dword ptr fs:[00000030h] 2_2_03C2826B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h] 2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h] 2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h] 2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h] 2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h] 2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h] 2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h] 2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h] 2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h] 2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h] 2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h] 2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h] 2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2823B mov eax, dword ptr fs:[00000030h] 2_2_03C2823B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF61C3 mov eax, dword ptr fs:[00000030h] 2_2_03CF61C3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF61C3 mov eax, dword ptr fs:[00000030h] 2_2_03CF61C3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAE1D0 mov eax, dword ptr fs:[00000030h] 2_2_03CAE1D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAE1D0 mov eax, dword ptr fs:[00000030h] 2_2_03CAE1D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAE1D0 mov ecx, dword ptr fs:[00000030h] 2_2_03CAE1D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAE1D0 mov eax, dword ptr fs:[00000030h] 2_2_03CAE1D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAE1D0 mov eax, dword ptr fs:[00000030h] 2_2_03CAE1D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D061E5 mov eax, dword ptr fs:[00000030h] 2_2_03D061E5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C601F8 mov eax, dword ptr fs:[00000030h] 2_2_03C601F8
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C70185 mov eax, dword ptr fs:[00000030h] 2_2_03C70185
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CEC188 mov eax, dword ptr fs:[00000030h] 2_2_03CEC188
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CEC188 mov eax, dword ptr fs:[00000030h] 2_2_03CEC188
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CD4180 mov eax, dword ptr fs:[00000030h] 2_2_03CD4180
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CD4180 mov eax, dword ptr fs:[00000030h] 2_2_03CD4180
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB019F mov eax, dword ptr fs:[00000030h] 2_2_03CB019F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB019F mov eax, dword ptr fs:[00000030h] 2_2_03CB019F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB019F mov eax, dword ptr fs:[00000030h] 2_2_03CB019F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB019F mov eax, dword ptr fs:[00000030h] 2_2_03CB019F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2A197 mov eax, dword ptr fs:[00000030h] 2_2_03C2A197
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2A197 mov eax, dword ptr fs:[00000030h] 2_2_03C2A197
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2A197 mov eax, dword ptr fs:[00000030h] 2_2_03C2A197
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC4144 mov eax, dword ptr fs:[00000030h] 2_2_03CC4144
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC4144 mov eax, dword ptr fs:[00000030h] 2_2_03CC4144
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC4144 mov ecx, dword ptr fs:[00000030h] 2_2_03CC4144
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC4144 mov eax, dword ptr fs:[00000030h] 2_2_03CC4144
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC4144 mov eax, dword ptr fs:[00000030h] 2_2_03CC4144
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2C156 mov eax, dword ptr fs:[00000030h] 2_2_03C2C156
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC8158 mov eax, dword ptr fs:[00000030h] 2_2_03CC8158
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C36154 mov eax, dword ptr fs:[00000030h] 2_2_03C36154
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C36154 mov eax, dword ptr fs:[00000030h] 2_2_03C36154
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D04164 mov eax, dword ptr fs:[00000030h] 2_2_03D04164
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D04164 mov eax, dword ptr fs:[00000030h] 2_2_03D04164
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDE10E mov eax, dword ptr fs:[00000030h] 2_2_03CDE10E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDE10E mov ecx, dword ptr fs:[00000030h] 2_2_03CDE10E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDE10E mov eax, dword ptr fs:[00000030h] 2_2_03CDE10E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDE10E mov eax, dword ptr fs:[00000030h] 2_2_03CDE10E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDE10E mov ecx, dword ptr fs:[00000030h] 2_2_03CDE10E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDE10E mov eax, dword ptr fs:[00000030h] 2_2_03CDE10E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDE10E mov eax, dword ptr fs:[00000030h] 2_2_03CDE10E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDE10E mov ecx, dword ptr fs:[00000030h] 2_2_03CDE10E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDE10E mov eax, dword ptr fs:[00000030h] 2_2_03CDE10E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDE10E mov ecx, dword ptr fs:[00000030h] 2_2_03CDE10E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDA118 mov ecx, dword ptr fs:[00000030h] 2_2_03CDA118
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDA118 mov eax, dword ptr fs:[00000030h] 2_2_03CDA118
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDA118 mov eax, dword ptr fs:[00000030h] 2_2_03CDA118
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDA118 mov eax, dword ptr fs:[00000030h] 2_2_03CDA118
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF0115 mov eax, dword ptr fs:[00000030h] 2_2_03CF0115
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C60124 mov eax, dword ptr fs:[00000030h] 2_2_03C60124
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB20DE mov eax, dword ptr fs:[00000030h] 2_2_03CB20DE
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2A0E3 mov ecx, dword ptr fs:[00000030h] 2_2_03C2A0E3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C380E9 mov eax, dword ptr fs:[00000030h] 2_2_03C380E9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB60E0 mov eax, dword ptr fs:[00000030h] 2_2_03CB60E0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2C0F0 mov eax, dword ptr fs:[00000030h] 2_2_03C2C0F0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C720F0 mov ecx, dword ptr fs:[00000030h] 2_2_03C720F0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3208A mov eax, dword ptr fs:[00000030h] 2_2_03C3208A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C280A0 mov eax, dword ptr fs:[00000030h] 2_2_03C280A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC80A8 mov eax, dword ptr fs:[00000030h] 2_2_03CC80A8
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF60B8 mov eax, dword ptr fs:[00000030h] 2_2_03CF60B8
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF60B8 mov ecx, dword ptr fs:[00000030h] 2_2_03CF60B8
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C32050 mov eax, dword ptr fs:[00000030h] 2_2_03C32050
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB6050 mov eax, dword ptr fs:[00000030h] 2_2_03CB6050
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5C073 mov eax, dword ptr fs:[00000030h] 2_2_03C5C073
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB4000 mov ecx, dword ptr fs:[00000030h] 2_2_03CB4000
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CD2000 mov eax, dword ptr fs:[00000030h] 2_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CD2000 mov eax, dword ptr fs:[00000030h] 2_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CD2000 mov eax, dword ptr fs:[00000030h] 2_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CD2000 mov eax, dword ptr fs:[00000030h] 2_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CD2000 mov eax, dword ptr fs:[00000030h] 2_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CD2000 mov eax, dword ptr fs:[00000030h] 2_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CD2000 mov eax, dword ptr fs:[00000030h] 2_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CD2000 mov eax, dword ptr fs:[00000030h] 2_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4E016 mov eax, dword ptr fs:[00000030h] 2_2_03C4E016
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4E016 mov eax, dword ptr fs:[00000030h] 2_2_03C4E016
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4E016 mov eax, dword ptr fs:[00000030h] 2_2_03C4E016
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4E016 mov eax, dword ptr fs:[00000030h] 2_2_03C4E016
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2A020 mov eax, dword ptr fs:[00000030h] 2_2_03C2A020
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2C020 mov eax, dword ptr fs:[00000030h] 2_2_03C2C020
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC6030 mov eax, dword ptr fs:[00000030h] 2_2_03CC6030
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3C7C0 mov eax, dword ptr fs:[00000030h] 2_2_03C3C7C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB07C3 mov eax, dword ptr fs:[00000030h] 2_2_03CB07C3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C527ED mov eax, dword ptr fs:[00000030h] 2_2_03C527ED
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C527ED mov eax, dword ptr fs:[00000030h] 2_2_03C527ED
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C527ED mov eax, dword ptr fs:[00000030h] 2_2_03C527ED
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CBE7E1 mov eax, dword ptr fs:[00000030h] 2_2_03CBE7E1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C347FB mov eax, dword ptr fs:[00000030h] 2_2_03C347FB
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C347FB mov eax, dword ptr fs:[00000030h] 2_2_03C347FB
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CD678E mov eax, dword ptr fs:[00000030h] 2_2_03CD678E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C307AF mov eax, dword ptr fs:[00000030h] 2_2_03C307AF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE47A0 mov eax, dword ptr fs:[00000030h] 2_2_03CE47A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6674D mov esi, dword ptr fs:[00000030h] 2_2_03C6674D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6674D mov eax, dword ptr fs:[00000030h] 2_2_03C6674D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6674D mov eax, dword ptr fs:[00000030h] 2_2_03C6674D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C30750 mov eax, dword ptr fs:[00000030h] 2_2_03C30750
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CBE75D mov eax, dword ptr fs:[00000030h] 2_2_03CBE75D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72750 mov eax, dword ptr fs:[00000030h] 2_2_03C72750
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72750 mov eax, dword ptr fs:[00000030h] 2_2_03C72750
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB4755 mov eax, dword ptr fs:[00000030h] 2_2_03CB4755
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C38770 mov eax, dword ptr fs:[00000030h] 2_2_03C38770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h] 2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h] 2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h] 2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h] 2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h] 2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h] 2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h] 2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h] 2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h] 2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h] 2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h] 2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h] 2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6C700 mov eax, dword ptr fs:[00000030h] 2_2_03C6C700
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C30710 mov eax, dword ptr fs:[00000030h] 2_2_03C30710
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C60710 mov eax, dword ptr fs:[00000030h] 2_2_03C60710
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6C720 mov eax, dword ptr fs:[00000030h] 2_2_03C6C720
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6C720 mov eax, dword ptr fs:[00000030h] 2_2_03C6C720
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6273C mov eax, dword ptr fs:[00000030h] 2_2_03C6273C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6273C mov ecx, dword ptr fs:[00000030h] 2_2_03C6273C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6273C mov eax, dword ptr fs:[00000030h] 2_2_03C6273C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAC730 mov eax, dword ptr fs:[00000030h] 2_2_03CAC730
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6A6C7 mov ebx, dword ptr fs:[00000030h] 2_2_03C6A6C7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6A6C7 mov eax, dword ptr fs:[00000030h] 2_2_03C6A6C7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAE6F2 mov eax, dword ptr fs:[00000030h] 2_2_03CAE6F2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAE6F2 mov eax, dword ptr fs:[00000030h] 2_2_03CAE6F2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAE6F2 mov eax, dword ptr fs:[00000030h] 2_2_03CAE6F2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAE6F2 mov eax, dword ptr fs:[00000030h] 2_2_03CAE6F2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB06F1 mov eax, dword ptr fs:[00000030h] 2_2_03CB06F1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB06F1 mov eax, dword ptr fs:[00000030h] 2_2_03CB06F1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C34690 mov eax, dword ptr fs:[00000030h] 2_2_03C34690
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C34690 mov eax, dword ptr fs:[00000030h] 2_2_03C34690
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6C6A6 mov eax, dword ptr fs:[00000030h] 2_2_03C6C6A6
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C666B0 mov eax, dword ptr fs:[00000030h] 2_2_03C666B0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4C640 mov eax, dword ptr fs:[00000030h] 2_2_03C4C640
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF866E mov eax, dword ptr fs:[00000030h] 2_2_03CF866E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF866E mov eax, dword ptr fs:[00000030h] 2_2_03CF866E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6A660 mov eax, dword ptr fs:[00000030h] 2_2_03C6A660
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6A660 mov eax, dword ptr fs:[00000030h] 2_2_03C6A660
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C62674 mov eax, dword ptr fs:[00000030h] 2_2_03C62674
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAE609 mov eax, dword ptr fs:[00000030h] 2_2_03CAE609
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4260B mov eax, dword ptr fs:[00000030h] 2_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4260B mov eax, dword ptr fs:[00000030h] 2_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4260B mov eax, dword ptr fs:[00000030h] 2_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4260B mov eax, dword ptr fs:[00000030h] 2_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4260B mov eax, dword ptr fs:[00000030h] 2_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4260B mov eax, dword ptr fs:[00000030h] 2_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4260B mov eax, dword ptr fs:[00000030h] 2_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72619 mov eax, dword ptr fs:[00000030h] 2_2_03C72619
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4E627 mov eax, dword ptr fs:[00000030h] 2_2_03C4E627
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C66620 mov eax, dword ptr fs:[00000030h] 2_2_03C66620
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C68620 mov eax, dword ptr fs:[00000030h] 2_2_03C68620
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3262C mov eax, dword ptr fs:[00000030h] 2_2_03C3262C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6E5CF mov eax, dword ptr fs:[00000030h] 2_2_03C6E5CF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6E5CF mov eax, dword ptr fs:[00000030h] 2_2_03C6E5CF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C365D0 mov eax, dword ptr fs:[00000030h] 2_2_03C365D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6A5D0 mov eax, dword ptr fs:[00000030h] 2_2_03C6A5D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6A5D0 mov eax, dword ptr fs:[00000030h] 2_2_03C6A5D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5E5E7 mov eax, dword ptr fs:[00000030h] 2_2_03C5E5E7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5E5E7 mov eax, dword ptr fs:[00000030h] 2_2_03C5E5E7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5E5E7 mov eax, dword ptr fs:[00000030h] 2_2_03C5E5E7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5E5E7 mov eax, dword ptr fs:[00000030h] 2_2_03C5E5E7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5E5E7 mov eax, dword ptr fs:[00000030h] 2_2_03C5E5E7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5E5E7 mov eax, dword ptr fs:[00000030h] 2_2_03C5E5E7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5E5E7 mov eax, dword ptr fs:[00000030h] 2_2_03C5E5E7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5E5E7 mov eax, dword ptr fs:[00000030h] 2_2_03C5E5E7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C325E0 mov eax, dword ptr fs:[00000030h] 2_2_03C325E0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6C5ED mov eax, dword ptr fs:[00000030h] 2_2_03C6C5ED
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6C5ED mov eax, dword ptr fs:[00000030h] 2_2_03C6C5ED
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C32582 mov eax, dword ptr fs:[00000030h] 2_2_03C32582
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C32582 mov ecx, dword ptr fs:[00000030h] 2_2_03C32582
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C64588 mov eax, dword ptr fs:[00000030h] 2_2_03C64588
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6E59C mov eax, dword ptr fs:[00000030h] 2_2_03C6E59C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB05A7 mov eax, dword ptr fs:[00000030h] 2_2_03CB05A7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB05A7 mov eax, dword ptr fs:[00000030h] 2_2_03CB05A7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB05A7 mov eax, dword ptr fs:[00000030h] 2_2_03CB05A7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C545B1 mov eax, dword ptr fs:[00000030h] 2_2_03C545B1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C545B1 mov eax, dword ptr fs:[00000030h] 2_2_03C545B1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C38550 mov eax, dword ptr fs:[00000030h] 2_2_03C38550
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C38550 mov eax, dword ptr fs:[00000030h] 2_2_03C38550
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6656A mov eax, dword ptr fs:[00000030h] 2_2_03C6656A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6656A mov eax, dword ptr fs:[00000030h] 2_2_03C6656A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6656A mov eax, dword ptr fs:[00000030h] 2_2_03C6656A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC6500 mov eax, dword ptr fs:[00000030h] 2_2_03CC6500
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D04500 mov eax, dword ptr fs:[00000030h] 2_2_03D04500
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D04500 mov eax, dword ptr fs:[00000030h] 2_2_03D04500
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D04500 mov eax, dword ptr fs:[00000030h] 2_2_03D04500
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D04500 mov eax, dword ptr fs:[00000030h] 2_2_03D04500
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D04500 mov eax, dword ptr fs:[00000030h] 2_2_03D04500
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D04500 mov eax, dword ptr fs:[00000030h] 2_2_03D04500
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D04500 mov eax, dword ptr fs:[00000030h] 2_2_03D04500
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40535 mov eax, dword ptr fs:[00000030h] 2_2_03C40535
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40535 mov eax, dword ptr fs:[00000030h] 2_2_03C40535
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40535 mov eax, dword ptr fs:[00000030h] 2_2_03C40535
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40535 mov eax, dword ptr fs:[00000030h] 2_2_03C40535
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40535 mov eax, dword ptr fs:[00000030h] 2_2_03C40535
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40535 mov eax, dword ptr fs:[00000030h] 2_2_03C40535
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5E53E mov eax, dword ptr fs:[00000030h] 2_2_03C5E53E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5E53E mov eax, dword ptr fs:[00000030h] 2_2_03C5E53E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5E53E mov eax, dword ptr fs:[00000030h] 2_2_03C5E53E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5E53E mov eax, dword ptr fs:[00000030h] 2_2_03C5E53E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5E53E mov eax, dword ptr fs:[00000030h] 2_2_03C5E53E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C304E5 mov ecx, dword ptr fs:[00000030h] 2_2_03C304E5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CEA49A mov eax, dword ptr fs:[00000030h] 2_2_03CEA49A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C364AB mov eax, dword ptr fs:[00000030h] 2_2_03C364AB
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C644B0 mov ecx, dword ptr fs:[00000030h] 2_2_03C644B0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CBA4B0 mov eax, dword ptr fs:[00000030h] 2_2_03CBA4B0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6E443 mov eax, dword ptr fs:[00000030h] 2_2_03C6E443
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6E443 mov eax, dword ptr fs:[00000030h] 2_2_03C6E443
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6E443 mov eax, dword ptr fs:[00000030h] 2_2_03C6E443
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6E443 mov eax, dword ptr fs:[00000030h] 2_2_03C6E443
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6E443 mov eax, dword ptr fs:[00000030h] 2_2_03C6E443
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6E443 mov eax, dword ptr fs:[00000030h] 2_2_03C6E443
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6E443 mov eax, dword ptr fs:[00000030h] 2_2_03C6E443
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6E443 mov eax, dword ptr fs:[00000030h] 2_2_03C6E443
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CEA456 mov eax, dword ptr fs:[00000030h] 2_2_03CEA456
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2645D mov eax, dword ptr fs:[00000030h] 2_2_03C2645D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5245A mov eax, dword ptr fs:[00000030h] 2_2_03C5245A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CBC460 mov ecx, dword ptr fs:[00000030h] 2_2_03CBC460
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5A470 mov eax, dword ptr fs:[00000030h] 2_2_03C5A470
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5A470 mov eax, dword ptr fs:[00000030h] 2_2_03C5A470
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5A470 mov eax, dword ptr fs:[00000030h] 2_2_03C5A470
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C68402 mov eax, dword ptr fs:[00000030h] 2_2_03C68402
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C68402 mov eax, dword ptr fs:[00000030h] 2_2_03C68402
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C68402 mov eax, dword ptr fs:[00000030h] 2_2_03C68402
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2E420 mov eax, dword ptr fs:[00000030h] 2_2_03C2E420
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2E420 mov eax, dword ptr fs:[00000030h] 2_2_03C2E420
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2E420 mov eax, dword ptr fs:[00000030h] 2_2_03C2E420
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2C427 mov eax, dword ptr fs:[00000030h] 2_2_03C2C427
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB6420 mov eax, dword ptr fs:[00000030h] 2_2_03CB6420
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB6420 mov eax, dword ptr fs:[00000030h] 2_2_03CB6420
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB6420 mov eax, dword ptr fs:[00000030h] 2_2_03CB6420
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB6420 mov eax, dword ptr fs:[00000030h] 2_2_03CB6420
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB6420 mov eax, dword ptr fs:[00000030h] 2_2_03CB6420
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB6420 mov eax, dword ptr fs:[00000030h] 2_2_03CB6420
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB6420 mov eax, dword ptr fs:[00000030h] 2_2_03CB6420
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6A430 mov eax, dword ptr fs:[00000030h] 2_2_03C6A430
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C50BCB mov eax, dword ptr fs:[00000030h] 2_2_03C50BCB
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C50BCB mov eax, dword ptr fs:[00000030h] 2_2_03C50BCB
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C50BCB mov eax, dword ptr fs:[00000030h] 2_2_03C50BCB
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C30BCD mov eax, dword ptr fs:[00000030h] 2_2_03C30BCD
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C30BCD mov eax, dword ptr fs:[00000030h] 2_2_03C30BCD
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C30BCD mov eax, dword ptr fs:[00000030h] 2_2_03C30BCD
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDEBD0 mov eax, dword ptr fs:[00000030h] 2_2_03CDEBD0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C38BF0 mov eax, dword ptr fs:[00000030h] 2_2_03C38BF0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C38BF0 mov eax, dword ptr fs:[00000030h] 2_2_03C38BF0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C38BF0 mov eax, dword ptr fs:[00000030h] 2_2_03C38BF0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5EBFC mov eax, dword ptr fs:[00000030h] 2_2_03C5EBFC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CBCBF0 mov eax, dword ptr fs:[00000030h] 2_2_03CBCBF0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40BBE mov eax, dword ptr fs:[00000030h] 2_2_03C40BBE
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40BBE mov eax, dword ptr fs:[00000030h] 2_2_03C40BBE
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE4BB0 mov eax, dword ptr fs:[00000030h] 2_2_03CE4BB0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE4BB0 mov eax, dword ptr fs:[00000030h] 2_2_03CE4BB0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE4B4B mov eax, dword ptr fs:[00000030h] 2_2_03CE4B4B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE4B4B mov eax, dword ptr fs:[00000030h] 2_2_03CE4B4B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D02B57 mov eax, dword ptr fs:[00000030h] 2_2_03D02B57
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D02B57 mov eax, dword ptr fs:[00000030h] 2_2_03D02B57
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D02B57 mov eax, dword ptr fs:[00000030h] 2_2_03D02B57
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D02B57 mov eax, dword ptr fs:[00000030h] 2_2_03D02B57
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC6B40 mov eax, dword ptr fs:[00000030h] 2_2_03CC6B40
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC6B40 mov eax, dword ptr fs:[00000030h] 2_2_03CC6B40
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CFAB40 mov eax, dword ptr fs:[00000030h] 2_2_03CFAB40
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CD8B42 mov eax, dword ptr fs:[00000030h] 2_2_03CD8B42
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C28B50 mov eax, dword ptr fs:[00000030h] 2_2_03C28B50
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDEB50 mov eax, dword ptr fs:[00000030h] 2_2_03CDEB50
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2CB7E mov eax, dword ptr fs:[00000030h] 2_2_03C2CB7E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D04B00 mov eax, dword ptr fs:[00000030h] 2_2_03D04B00
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAEB1D mov eax, dword ptr fs:[00000030h] 2_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAEB1D mov eax, dword ptr fs:[00000030h] 2_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAEB1D mov eax, dword ptr fs:[00000030h] 2_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAEB1D mov eax, dword ptr fs:[00000030h] 2_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAEB1D mov eax, dword ptr fs:[00000030h] 2_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAEB1D mov eax, dword ptr fs:[00000030h] 2_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAEB1D mov eax, dword ptr fs:[00000030h] 2_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAEB1D mov eax, dword ptr fs:[00000030h] 2_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAEB1D mov eax, dword ptr fs:[00000030h] 2_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5EB20 mov eax, dword ptr fs:[00000030h] 2_2_03C5EB20
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5EB20 mov eax, dword ptr fs:[00000030h] 2_2_03C5EB20
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF8B28 mov eax, dword ptr fs:[00000030h] 2_2_03CF8B28
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF8B28 mov eax, dword ptr fs:[00000030h] 2_2_03CF8B28
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C86ACC mov eax, dword ptr fs:[00000030h] 2_2_03C86ACC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C86ACC mov eax, dword ptr fs:[00000030h] 2_2_03C86ACC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C86ACC mov eax, dword ptr fs:[00000030h] 2_2_03C86ACC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C30AD0 mov eax, dword ptr fs:[00000030h] 2_2_03C30AD0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C64AD0 mov eax, dword ptr fs:[00000030h] 2_2_03C64AD0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C64AD0 mov eax, dword ptr fs:[00000030h] 2_2_03C64AD0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6AAEE mov eax, dword ptr fs:[00000030h] 2_2_03C6AAEE
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6AAEE mov eax, dword ptr fs:[00000030h] 2_2_03C6AAEE
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3EA80 mov eax, dword ptr fs:[00000030h] 2_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3EA80 mov eax, dword ptr fs:[00000030h] 2_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3EA80 mov eax, dword ptr fs:[00000030h] 2_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3EA80 mov eax, dword ptr fs:[00000030h] 2_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3EA80 mov eax, dword ptr fs:[00000030h] 2_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3EA80 mov eax, dword ptr fs:[00000030h] 2_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3EA80 mov eax, dword ptr fs:[00000030h] 2_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3EA80 mov eax, dword ptr fs:[00000030h] 2_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3EA80 mov eax, dword ptr fs:[00000030h] 2_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D04A80 mov eax, dword ptr fs:[00000030h] 2_2_03D04A80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C68A90 mov edx, dword ptr fs:[00000030h] 2_2_03C68A90
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C38AA0 mov eax, dword ptr fs:[00000030h] 2_2_03C38AA0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C38AA0 mov eax, dword ptr fs:[00000030h] 2_2_03C38AA0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C86AA4 mov eax, dword ptr fs:[00000030h] 2_2_03C86AA4
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C36A50 mov eax, dword ptr fs:[00000030h] 2_2_03C36A50
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C36A50 mov eax, dword ptr fs:[00000030h] 2_2_03C36A50
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C36A50 mov eax, dword ptr fs:[00000030h] 2_2_03C36A50
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C36A50 mov eax, dword ptr fs:[00000030h] 2_2_03C36A50
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C36A50 mov eax, dword ptr fs:[00000030h] 2_2_03C36A50
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C36A50 mov eax, dword ptr fs:[00000030h] 2_2_03C36A50
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C36A50 mov eax, dword ptr fs:[00000030h] 2_2_03C36A50
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40A5B mov eax, dword ptr fs:[00000030h] 2_2_03C40A5B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40A5B mov eax, dword ptr fs:[00000030h] 2_2_03C40A5B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6CA6F mov eax, dword ptr fs:[00000030h] 2_2_03C6CA6F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6CA6F mov eax, dword ptr fs:[00000030h] 2_2_03C6CA6F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6CA6F mov eax, dword ptr fs:[00000030h] 2_2_03C6CA6F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDEA60 mov eax, dword ptr fs:[00000030h] 2_2_03CDEA60
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CACA72 mov eax, dword ptr fs:[00000030h] 2_2_03CACA72
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CACA72 mov eax, dword ptr fs:[00000030h] 2_2_03CACA72
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CBCA11 mov eax, dword ptr fs:[00000030h] 2_2_03CBCA11
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6CA24 mov eax, dword ptr fs:[00000030h] 2_2_03C6CA24
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5EA2E mov eax, dword ptr fs:[00000030h] 2_2_03C5EA2E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C54A35 mov eax, dword ptr fs:[00000030h] 2_2_03C54A35
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C54A35 mov eax, dword ptr fs:[00000030h] 2_2_03C54A35
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6CA38 mov eax, dword ptr fs:[00000030h] 2_2_03C6CA38
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC69C0 mov eax, dword ptr fs:[00000030h] 2_2_03CC69C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3A9D0 mov eax, dword ptr fs:[00000030h] 2_2_03C3A9D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3A9D0 mov eax, dword ptr fs:[00000030h] 2_2_03C3A9D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3A9D0 mov eax, dword ptr fs:[00000030h] 2_2_03C3A9D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3A9D0 mov eax, dword ptr fs:[00000030h] 2_2_03C3A9D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3A9D0 mov eax, dword ptr fs:[00000030h] 2_2_03C3A9D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3A9D0 mov eax, dword ptr fs:[00000030h] 2_2_03C3A9D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C649D0 mov eax, dword ptr fs:[00000030h] 2_2_03C649D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CFA9D3 mov eax, dword ptr fs:[00000030h] 2_2_03CFA9D3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CBE9E0 mov eax, dword ptr fs:[00000030h] 2_2_03CBE9E0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C629F9 mov eax, dword ptr fs:[00000030h] 2_2_03C629F9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C629F9 mov eax, dword ptr fs:[00000030h] 2_2_03C629F9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C429A0 mov eax, dword ptr fs:[00000030h] 2_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C429A0 mov eax, dword ptr fs:[00000030h] 2_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C429A0 mov eax, dword ptr fs:[00000030h] 2_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C429A0 mov eax, dword ptr fs:[00000030h] 2_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C429A0 mov eax, dword ptr fs:[00000030h] 2_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C429A0 mov eax, dword ptr fs:[00000030h] 2_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C429A0 mov eax, dword ptr fs:[00000030h] 2_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C429A0 mov eax, dword ptr fs:[00000030h] 2_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C429A0 mov eax, dword ptr fs:[00000030h] 2_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C429A0 mov eax, dword ptr fs:[00000030h] 2_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C429A0 mov eax, dword ptr fs:[00000030h] 2_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C429A0 mov eax, dword ptr fs:[00000030h] 2_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C429A0 mov eax, dword ptr fs:[00000030h] 2_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C309AD mov eax, dword ptr fs:[00000030h] 2_2_03C309AD
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C309AD mov eax, dword ptr fs:[00000030h] 2_2_03C309AD
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB89B3 mov esi, dword ptr fs:[00000030h] 2_2_03CB89B3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB89B3 mov eax, dword ptr fs:[00000030h] 2_2_03CB89B3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB89B3 mov eax, dword ptr fs:[00000030h] 2_2_03CB89B3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB0946 mov eax, dword ptr fs:[00000030h] 2_2_03CB0946
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D04940 mov eax, dword ptr fs:[00000030h] 2_2_03D04940
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C56962 mov eax, dword ptr fs:[00000030h] 2_2_03C56962
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C56962 mov eax, dword ptr fs:[00000030h] 2_2_03C56962
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C56962 mov eax, dword ptr fs:[00000030h] 2_2_03C56962
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C7096E mov eax, dword ptr fs:[00000030h] 2_2_03C7096E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C7096E mov edx, dword ptr fs:[00000030h] 2_2_03C7096E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C7096E mov eax, dword ptr fs:[00000030h] 2_2_03C7096E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CD4978 mov eax, dword ptr fs:[00000030h] 2_2_03CD4978
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CD4978 mov eax, dword ptr fs:[00000030h] 2_2_03CD4978
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CBC97C mov eax, dword ptr fs:[00000030h] 2_2_03CBC97C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAE908 mov eax, dword ptr fs:[00000030h] 2_2_03CAE908
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAE908 mov eax, dword ptr fs:[00000030h] 2_2_03CAE908
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CBC912 mov eax, dword ptr fs:[00000030h] 2_2_03CBC912
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C28918 mov eax, dword ptr fs:[00000030h] 2_2_03C28918
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C28918 mov eax, dword ptr fs:[00000030h] 2_2_03C28918
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB892A mov eax, dword ptr fs:[00000030h] 2_2_03CB892A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC892B mov eax, dword ptr fs:[00000030h] 2_2_03CC892B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5E8C0 mov eax, dword ptr fs:[00000030h] 2_2_03C5E8C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D008C0 mov eax, dword ptr fs:[00000030h] 2_2_03D008C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CFA8E4 mov eax, dword ptr fs:[00000030h] 2_2_03CFA8E4
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6C8F9 mov eax, dword ptr fs:[00000030h] 2_2_03C6C8F9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6C8F9 mov eax, dword ptr fs:[00000030h] 2_2_03C6C8F9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C30887 mov eax, dword ptr fs:[00000030h] 2_2_03C30887
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CBC89D mov eax, dword ptr fs:[00000030h] 2_2_03CBC89D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C42840 mov ecx, dword ptr fs:[00000030h] 2_2_03C42840
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C60854 mov eax, dword ptr fs:[00000030h] 2_2_03C60854
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C34859 mov eax, dword ptr fs:[00000030h] 2_2_03C34859
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C34859 mov eax, dword ptr fs:[00000030h] 2_2_03C34859
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_00426DA1 CreateFileW,__lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock, 0_2_00426DA1
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_0042202E SetUnhandledExceptionFilter, 0_2_0042202E
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_004230F5 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_004230F5
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_00417D93 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_00417D93
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_00421FA7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_00421FA7

HIPS / PFW / Operating System Protection Evasion
barindex
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\P1 BOL.exe Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\Desktop\P1 BOL.exe Memory written: C:\Windows\SysWOW64\svchost.exe base: 30EE008 Jump to behavior
Contains functionality to execute programs as a different user
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_0043916A LogonUserW, 0_2_0043916A
Contains functionality to launch a program with higher privileges
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_0040D6D0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW, 0_2_0040D6D0
Contains functionality to simulate keystroke presses
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput, 0_2_004375B0
Contains functionality to simulate mouse events
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_00436431 __wcsicoll,mouse_event,__wcsicoll,mouse_event, 0_2_00436431
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\P1 BOL.exe Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\P1 BOL.exe" Jump to behavior
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_00445DD3 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity, 0_2_00445DD3
Source: P1 BOL.exe Binary or memory string: Shell_TrayWnd
Source: P1 BOL.exe Binary or memory string: @3PDASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_00410D10 cpuid 0_2_00410D10
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_004223BC GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter, 0_2_004223BC
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_004711D2 GetUserNameW, 0_2_004711D2
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo, 0_2_0040E470

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000002.2180166603.0000000003990000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.2179892339.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
OS version to string mapping found (often used in BOTs)
Source: P1 BOL.exe Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPWIN_2000InstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 6, 0USERPROFILEUSERDOMAINUSERDNSDOMAINDefaultGetSystemWow64DirectoryWSeDebugPrivilege:cdeclwinapistdcallnonestrwstrintbooluintlongulongdwordshortushortwordbyteubytebooleanfloatdoubleptrhwndhandlelresultlparamwparamint64uint64int_ptruint_ptrlong_ptrulong_ptrdword_ptridispatch64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYadvapi32.dllRegDeleteKeyExW+.-.+-\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]ISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXISTSEXPANDmsctls_statusbar321tooltips_class32AutoIt v3 GUI%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----
Source: P1 BOL.exe Binary or memory string: WIN_XP
Source: P1 BOL.exe Binary or memory string: WIN_XPe
Source: P1 BOL.exe Binary or memory string: WIN_VISTA
Source: P1 BOL.exe Binary or memory string: WIN_7

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000002.2180166603.0000000003990000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.2179892339.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_004741BB socket,WSAGetLastError,bind,WSAGetLastError,closesocket, 0_2_004741BB
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_0046483C socket,WSAGetLastError,bind,WSAGetLastError,listen,WSAGetLastError,closesocket, 0_2_0046483C
Source: C:\Users\user\Desktop\P1 BOL.exe Code function: 0_2_0047AD92 OleInitialize,_wcslen,CreateBindCtx,MkParseDisplayName,CLSIDFromProgID,GetActiveObject, 0_2_0047AD92
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1542080 Sample: P1 BOL.exe Startdate: 25/10/2024 Architecture: WINDOWS Score: 80 11 Multi AV Scanner detection for submitted file 2->11 13 Yara detected FormBook 2->13 15 Machine Learning detection for sample 2->15 17 3 other signatures 2->17 6 P1 BOL.exe 1 2->6         started        process3 signatures4 19 Writes to foreign memory regions 6->19 21 Maps a DLL or memory area into another process 6->21 9 svchost.exe 6->9         started        process5
⊘No contacted IP infos

Contacted Domains

Name IP Active
s-part-0023.t-0009.t-msedge.net 13.107.246.51 true