Windows Analysis Report
rOr__amentoprim.exe

AV Detection

Source: rOr__amentoprim.exe

Avira: detected

Source: Yara match	File source: 4.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2189639612.00000000008E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2189442414.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: rOr__amentoprim.exe

Joe Sandbox ML: detected

Compliance

Source: rOr__amentoprim.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:

Binary string: wntdll.pdbUGP source: svchost.exe, 00000004.00000002.2189946586.000000000359E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.2189946586.0000000003400000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.2155394881.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.2157290028.0000000003200000.00000004.00000020.00020000.00000000.sdmp

Source:

Binary string: wntdll.pdb source: svchost.exe, svchost.exe, 00000004.00000002.2189946586.000000000359E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.2189946586.0000000003400000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.2155394881.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.2157290028.0000000003200000.00000004.00000020.00020000.00000000.sdmp

Networking

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.4:49737
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.4:49730

E-Banking Fraud

Source: Yara match	File source: 4.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2189639612.00000000008E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2189442414.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: rOr__amentoprim.exe, 00000000.00000000.1708031558.0000000000ED2000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.		memstr_7086d90a-a
Source: rOr__amentoprim.exe, 00000000.00000000.1708031558.0000000000ED2000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer		memstr_9fd4a77a-6
Source: rOr__amentoprim.exe	String found in binary or memory: This is a third-party compiled AutoIt script.		memstr_aec7d9af-8
Source: rOr__amentoprim.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer		memstr_f1c8b165-6

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0042C633 NtClose,		4_2_0042C633
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034735C0 NtCreateMutant,LdrInitializeThunk,		4_2_034735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03472B60 NtClose,LdrInitializeThunk,		4_2_03472B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03472DF0 NtQuerySystemInformation,LdrInitializeThunk,		4_2_03472DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03474340 NtSetContextThread,		4_2_03474340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03473010 NtOpenDirectoryObject,		4_2_03473010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03473090 NtSetValueKey,		4_2_03473090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03474650 NtSuspendThread,		4_2_03474650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03472BE0 NtQueryValueKey,		4_2_03472BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03472BF0 NtAllocateVirtualMemory,		4_2_03472BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03472B80 NtQueryInformationFile,		4_2_03472B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03472BA0 NtEnumerateValueKey,		4_2_03472BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03472AD0 NtReadFile,		4_2_03472AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03472AF0 NtWriteFile,		4_2_03472AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03472AB0 NtWaitForSingleObject,		4_2_03472AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034739B0 NtGetContextThread,		4_2_034739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03472F60 NtCreateProcessEx,		4_2_03472F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03472F30 NtCreateSection,		4_2_03472F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03472FE0 NtCreateFile,		4_2_03472FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03472F90 NtProtectVirtualMemory,		4_2_03472F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03472FA0 NtQuerySection,		4_2_03472FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03472FB0 NtResumeThread,		4_2_03472FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03472E30 NtWriteVirtualMemory,		4_2_03472E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03472EE0 NtQueueApcThread,		4_2_03472EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03472E80 NtReadVirtualMemory,		4_2_03472E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03472EA0 NtAdjustPrivilegesToken,		4_2_03472EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03473D70 NtOpenThread,		4_2_03473D70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03472D00 NtSetInformationFile,		4_2_03472D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03472D10 NtMapViewOfSection,		4_2_03472D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03473D10 NtOpenProcessToken,		4_2_03473D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03472D30 NtUnmapViewOfSection,		4_2_03472D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03472DD0 NtDelayExecution,		4_2_03472DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03472DB0 NtEnumerateKey,		4_2_03472DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03472C60 NtCreateKey,		4_2_03472C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03472C70 NtFreeVirtualMemory,		4_2_03472C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03472C00 NtQueryInformationProcess,		4_2_03472C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03472CC0 NtQueryVirtualMemory,		4_2_03472CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03472CF0 NtOpenProcess,		4_2_03472CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03472CA0 NtQueryInformationToken,		4_2_03472CA0

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0041684E		4_2_0041684E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_00416853		4_2_00416853
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0041680C		4_2_0041680C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_00410103		4_2_00410103
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_00423911		4_2_00423911
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_00402920		4_2_00402920
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_004031F0		4_2_004031F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0040E183		4_2_0040E183
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_004011B0		4_2_004011B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_00402340		4_2_00402340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_00402336		4_2_00402336
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0042EC43		4_2_0042EC43
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_00402530		4_2_00402530
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0040FEDC		4_2_0040FEDC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0040FEE3		4_2_0040FEE3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342D34C		4_2_0342D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034FA352		4_2_034FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034F132D		4_2_034F132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0344E3F0		4_2_0344E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_035003E6		4_2_035003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0348739A		4_2_0348739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034E0274		4_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0345B2C0		4_2_0345B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034E12ED		4_2_034E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034452A0		4_2_034452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0347516C		4_2_0347516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342F172		4_2_0342F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0350B16B		4_2_0350B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03430100		4_2_03430100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034DA118		4_2_034DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034F81CC		4_2_034F81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0344B1B0		4_2_0344B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_035001AA		4_2_035001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034EF0CC		4_2_034EF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034470C0		4_2_034470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034F70E9		4_2_034F70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034FF0E0		4_2_034FF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03464750		4_2_03464750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03440770		4_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0343C7C0		4_2_0343C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034FF7B0		4_2_034FF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034F16CC		4_2_034F16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0345C6E0		4_2_0345C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034F7571		4_2_034F7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03440535		4_2_03440535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03500591		4_2_03500591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034DD5B0		4_2_034DD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034F2446		4_2_034F2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03431460		4_2_03431460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034FF43F		4_2_034FF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034EE4F6		4_2_034EE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034FAB40		4_2_034FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034FFB76		4_2_034FFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034F6BD7		4_2_034F6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0347DBF9		4_2_0347DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0345FB80		4_2_0345FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034FFA49		4_2_034FFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034F7A46		4_2_034F7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034B3A6C		4_2_034B3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034EDAC6		4_2_034EDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0343EA80		4_2_0343EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034DDAAC		4_2_034DDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03485AA0		4_2_03485AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03449950		4_2_03449950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0345B950		4_2_0345B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03456962		4_2_03456962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034429A0		4_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0350A9A6		4_2_0350A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03442840		4_2_03442840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0344A840		4_2_0344A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034AD800		4_2_034AD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034438E0		4_2_034438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0346E8F0		4_2_0346E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034268B8		4_2_034268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034B4F40		4_2_034B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034FFF09		4_2_034FFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03482F28		4_2_03482F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03460F30		4_2_03460F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03432FC8		4_2_03432FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03441F92		4_2_03441F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034FFFB1		4_2_034FFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03440E59		4_2_03440E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034FEE26		4_2_034FEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034FEEDB		4_2_034FEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03452E90		4_2_03452E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034FCE93		4_2_034FCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03449EB0		4_2_03449EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03443D40		4_2_03443D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034F1D5A		4_2_034F1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034F7D73		4_2_034F7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0344AD00		4_2_0344AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0345FDC0		4_2_0345FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0343ADE0		4_2_0343ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03458DBF		4_2_03458DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03440C00		4_2_03440C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034B9C32		4_2_034B9C32
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03430CF2		4_2_03430CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034FFCF2		4_2_034FFCF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034E0CB5		4_2_034E0CB5

Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 034BF290 appears 105 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 034AEA12 appears 84 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 0342B970 appears 251 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03475130 appears 36 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03487E54 appears 86 times

Source: rOr__amentoprim.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal80.troj.evad.winEXE@3/1@0/0

Source: C:\Users\user\Desktop\rOr__amentoprim.exe

File created: C:\Users\user\AppData\Local\Temp\konked

Jump to behavior

Source: rOr__amentoprim.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\rOr__amentoprim.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\rOr__amentoprim.exe "C:\Users\user\Desktop\rOr__amentoprim.exe"
Source: C:\Users\user\Desktop\rOr__amentoprim.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\rOr__amentoprim.exe"
Source: C:\Users\user\Desktop\rOr__amentoprim.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\rOr__amentoprim.exe"			Jump to behavior

Source: C:\Users\user\Desktop\rOr__amentoprim.exe	Section loaded: wsock32.dll			Jump to behavior
Source: C:\Users\user\Desktop\rOr__amentoprim.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Users\user\Desktop\rOr__amentoprim.exe	Section loaded: winmm.dll			Jump to behavior
Source: C:\Users\user\Desktop\rOr__amentoprim.exe	Section loaded: mpr.dll			Jump to behavior
Source: C:\Users\user\Desktop\rOr__amentoprim.exe	Section loaded: wininet.dll			Jump to behavior
Source: C:\Users\user\Desktop\rOr__amentoprim.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Users\user\Desktop\rOr__amentoprim.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Users\user\Desktop\rOr__amentoprim.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Users\user\Desktop\rOr__amentoprim.exe	Section loaded: kernel.appcore.dll			Jump to behavior

Source: rOr__amentoprim.exe

Static file information: File size 1583616 > 1048576

Source: rOr__amentoprim.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: rOr__amentoprim.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: rOr__amentoprim.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: rOr__amentoprim.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: rOr__amentoprim.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: rOr__amentoprim.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: rOr__amentoprim.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: wntdll.pdbUGP source: svchost.exe, 00000004.00000002.2189946586.000000000359E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.2189946586.0000000003400000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.2155394881.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.2157290028.0000000003200000.00000004.00000020.00020000.00000000.sdmp

Source:

Binary string: wntdll.pdb source: svchost.exe, svchost.exe, 00000004.00000002.2189946586.000000000359E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.2189946586.0000000003400000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.2155394881.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.2157290028.0000000003200000.00000004.00000020.00020000.00000000.sdmp

Source: rOr__amentoprim.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: rOr__amentoprim.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: rOr__amentoprim.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: rOr__amentoprim.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: rOr__amentoprim.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_004030C8 push 1B94128Fh; iretd		4_2_004030CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_004242F8 push esi; retf		4_2_004242F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0040D290 push CD5A526Fh; retf		4_2_0040D29D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_004053EA push esi; retf		4_2_004053EB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_00403470 push eax; ret		4_2_00403472
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_00401420 push dword ptr [eax+54E4DA92h]; retf		4_2_004014EA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_004014F0 push dword ptr [eax+54E4DA92h]; retf		4_2_004014EA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_00401509 push esi; retf		4_2_0040151D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0041F5EC push 422D53B1h; iretd		4_2_0041F5F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0041A63E push ecx; retf		4_2_0041A63F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_00418EA3 push cs; iretd		4_2_00418EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0040B7A0 pushfd ; iretd		4_2_0040B7A1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034309AD push ecx; mov dword ptr [esp], ecx		4_2_034309B6

Hooking and other Techniques for Hiding and Protection

Source: C:\Users\user\Desktop\rOr__amentoprim.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\rOr__amentoprim.exe

API/Special instruction interceptor: Address: 137B78C

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 4_2_034AD1C0 rdtsc

4_2_034AD1C0

Source: C:\Windows\SysWOW64\svchost.exe

API coverage: 0.7 %

Source: C:\Windows\SysWOW64\svchost.exe TID: 4908

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Source: C:\Windows\SysWOW64\svchost.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 4_2_034AD1C0 rdtsc

4_2_034AD1C0

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 4_2_004177A3 LdrLoadDll,

4_2_004177A3

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034B2349 mov eax, dword ptr fs:[00000030h]		4_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034B2349 mov eax, dword ptr fs:[00000030h]		4_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034B2349 mov eax, dword ptr fs:[00000030h]		4_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034B2349 mov eax, dword ptr fs:[00000030h]		4_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034B2349 mov eax, dword ptr fs:[00000030h]		4_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034B2349 mov eax, dword ptr fs:[00000030h]		4_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034B2349 mov eax, dword ptr fs:[00000030h]		4_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034B2349 mov eax, dword ptr fs:[00000030h]		4_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034B2349 mov eax, dword ptr fs:[00000030h]		4_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034B2349 mov eax, dword ptr fs:[00000030h]		4_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034B2349 mov eax, dword ptr fs:[00000030h]		4_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034B2349 mov eax, dword ptr fs:[00000030h]		4_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034B2349 mov eax, dword ptr fs:[00000030h]		4_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034B2349 mov eax, dword ptr fs:[00000030h]		4_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034B2349 mov eax, dword ptr fs:[00000030h]		4_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342D34C mov eax, dword ptr fs:[00000030h]		4_2_0342D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342D34C mov eax, dword ptr fs:[00000030h]		4_2_0342D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03505341 mov eax, dword ptr fs:[00000030h]		4_2_03505341
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03429353 mov eax, dword ptr fs:[00000030h]		4_2_03429353
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03429353 mov eax, dword ptr fs:[00000030h]		4_2_03429353
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034B035C mov eax, dword ptr fs:[00000030h]		4_2_034B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034B035C mov eax, dword ptr fs:[00000030h]		4_2_034B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034B035C mov eax, dword ptr fs:[00000030h]		4_2_034B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034B035C mov ecx, dword ptr fs:[00000030h]		4_2_034B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034B035C mov eax, dword ptr fs:[00000030h]		4_2_034B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034B035C mov eax, dword ptr fs:[00000030h]		4_2_034B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034FA352 mov eax, dword ptr fs:[00000030h]		4_2_034FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034EF367 mov eax, dword ptr fs:[00000030h]		4_2_034EF367
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034D437C mov eax, dword ptr fs:[00000030h]		4_2_034D437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03437370 mov eax, dword ptr fs:[00000030h]		4_2_03437370
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03437370 mov eax, dword ptr fs:[00000030h]		4_2_03437370
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03437370 mov eax, dword ptr fs:[00000030h]		4_2_03437370
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034B930B mov eax, dword ptr fs:[00000030h]		4_2_034B930B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034B930B mov eax, dword ptr fs:[00000030h]		4_2_034B930B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034B930B mov eax, dword ptr fs:[00000030h]		4_2_034B930B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0346A30B mov eax, dword ptr fs:[00000030h]		4_2_0346A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0346A30B mov eax, dword ptr fs:[00000030h]		4_2_0346A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0346A30B mov eax, dword ptr fs:[00000030h]		4_2_0346A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342C310 mov ecx, dword ptr fs:[00000030h]		4_2_0342C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03450310 mov ecx, dword ptr fs:[00000030h]		4_2_03450310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034F132D mov eax, dword ptr fs:[00000030h]		4_2_034F132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034F132D mov eax, dword ptr fs:[00000030h]		4_2_034F132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0345F32A mov eax, dword ptr fs:[00000030h]		4_2_0345F32A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03427330 mov eax, dword ptr fs:[00000030h]		4_2_03427330
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034EC3CD mov eax, dword ptr fs:[00000030h]		4_2_034EC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0343A3C0 mov eax, dword ptr fs:[00000030h]		4_2_0343A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0343A3C0 mov eax, dword ptr fs:[00000030h]		4_2_0343A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0343A3C0 mov eax, dword ptr fs:[00000030h]		4_2_0343A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0343A3C0 mov eax, dword ptr fs:[00000030h]		4_2_0343A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0343A3C0 mov eax, dword ptr fs:[00000030h]		4_2_0343A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0343A3C0 mov eax, dword ptr fs:[00000030h]		4_2_0343A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034EB3D0 mov ecx, dword ptr fs:[00000030h]		4_2_034EB3D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034EF3E6 mov eax, dword ptr fs:[00000030h]		4_2_034EF3E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_035053FC mov eax, dword ptr fs:[00000030h]		4_2_035053FC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034403E9 mov eax, dword ptr fs:[00000030h]		4_2_034403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034403E9 mov eax, dword ptr fs:[00000030h]		4_2_034403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034403E9 mov eax, dword ptr fs:[00000030h]		4_2_034403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034403E9 mov eax, dword ptr fs:[00000030h]		4_2_034403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034403E9 mov eax, dword ptr fs:[00000030h]		4_2_034403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034403E9 mov eax, dword ptr fs:[00000030h]		4_2_034403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034403E9 mov eax, dword ptr fs:[00000030h]		4_2_034403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034403E9 mov eax, dword ptr fs:[00000030h]		4_2_034403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0344E3F0 mov eax, dword ptr fs:[00000030h]		4_2_0344E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0344E3F0 mov eax, dword ptr fs:[00000030h]		4_2_0344E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0344E3F0 mov eax, dword ptr fs:[00000030h]		4_2_0344E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034663FF mov eax, dword ptr fs:[00000030h]		4_2_034663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342E388 mov eax, dword ptr fs:[00000030h]		4_2_0342E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342E388 mov eax, dword ptr fs:[00000030h]		4_2_0342E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342E388 mov eax, dword ptr fs:[00000030h]		4_2_0342E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0345438F mov eax, dword ptr fs:[00000030h]		4_2_0345438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0345438F mov eax, dword ptr fs:[00000030h]		4_2_0345438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0350539D mov eax, dword ptr fs:[00000030h]		4_2_0350539D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0348739A mov eax, dword ptr fs:[00000030h]		4_2_0348739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0348739A mov eax, dword ptr fs:[00000030h]		4_2_0348739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03428397 mov eax, dword ptr fs:[00000030h]		4_2_03428397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03428397 mov eax, dword ptr fs:[00000030h]		4_2_03428397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03428397 mov eax, dword ptr fs:[00000030h]		4_2_03428397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034533A5 mov eax, dword ptr fs:[00000030h]		4_2_034533A5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034633A0 mov eax, dword ptr fs:[00000030h]		4_2_034633A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034633A0 mov eax, dword ptr fs:[00000030h]		4_2_034633A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03429240 mov eax, dword ptr fs:[00000030h]		4_2_03429240
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03429240 mov eax, dword ptr fs:[00000030h]		4_2_03429240
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0346724D mov eax, dword ptr fs:[00000030h]		4_2_0346724D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342A250 mov eax, dword ptr fs:[00000030h]		4_2_0342A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034EB256 mov eax, dword ptr fs:[00000030h]		4_2_034EB256
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034EB256 mov eax, dword ptr fs:[00000030h]		4_2_034EB256
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03436259 mov eax, dword ptr fs:[00000030h]		4_2_03436259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03434260 mov eax, dword ptr fs:[00000030h]		4_2_03434260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03434260 mov eax, dword ptr fs:[00000030h]		4_2_03434260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03434260 mov eax, dword ptr fs:[00000030h]		4_2_03434260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034FD26B mov eax, dword ptr fs:[00000030h]		4_2_034FD26B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034FD26B mov eax, dword ptr fs:[00000030h]		4_2_034FD26B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342826B mov eax, dword ptr fs:[00000030h]		4_2_0342826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03459274 mov eax, dword ptr fs:[00000030h]		4_2_03459274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03471270 mov eax, dword ptr fs:[00000030h]		4_2_03471270
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03471270 mov eax, dword ptr fs:[00000030h]		4_2_03471270
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034E0274 mov eax, dword ptr fs:[00000030h]		4_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034E0274 mov eax, dword ptr fs:[00000030h]		4_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034E0274 mov eax, dword ptr fs:[00000030h]		4_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034E0274 mov eax, dword ptr fs:[00000030h]		4_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034E0274 mov eax, dword ptr fs:[00000030h]		4_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034E0274 mov eax, dword ptr fs:[00000030h]		4_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034E0274 mov eax, dword ptr fs:[00000030h]		4_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034E0274 mov eax, dword ptr fs:[00000030h]		4_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034E0274 mov eax, dword ptr fs:[00000030h]		4_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034E0274 mov eax, dword ptr fs:[00000030h]		4_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034E0274 mov eax, dword ptr fs:[00000030h]		4_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034E0274 mov eax, dword ptr fs:[00000030h]		4_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03467208 mov eax, dword ptr fs:[00000030h]		4_2_03467208
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03467208 mov eax, dword ptr fs:[00000030h]		4_2_03467208
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03505227 mov eax, dword ptr fs:[00000030h]		4_2_03505227
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342823B mov eax, dword ptr fs:[00000030h]		4_2_0342823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0343A2C3 mov eax, dword ptr fs:[00000030h]		4_2_0343A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0343A2C3 mov eax, dword ptr fs:[00000030h]		4_2_0343A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0343A2C3 mov eax, dword ptr fs:[00000030h]		4_2_0343A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0343A2C3 mov eax, dword ptr fs:[00000030h]		4_2_0343A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0343A2C3 mov eax, dword ptr fs:[00000030h]		4_2_0343A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0345B2C0 mov eax, dword ptr fs:[00000030h]		4_2_0345B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0345B2C0 mov eax, dword ptr fs:[00000030h]		4_2_0345B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0345B2C0 mov eax, dword ptr fs:[00000030h]		4_2_0345B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0345B2C0 mov eax, dword ptr fs:[00000030h]		4_2_0345B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0345B2C0 mov eax, dword ptr fs:[00000030h]		4_2_0345B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0345B2C0 mov eax, dword ptr fs:[00000030h]		4_2_0345B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0345B2C0 mov eax, dword ptr fs:[00000030h]		4_2_0345B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034392C5 mov eax, dword ptr fs:[00000030h]		4_2_034392C5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034392C5 mov eax, dword ptr fs:[00000030h]		4_2_034392C5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342B2D3 mov eax, dword ptr fs:[00000030h]		4_2_0342B2D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342B2D3 mov eax, dword ptr fs:[00000030h]		4_2_0342B2D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342B2D3 mov eax, dword ptr fs:[00000030h]		4_2_0342B2D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0345F2D0 mov eax, dword ptr fs:[00000030h]		4_2_0345F2D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0345F2D0 mov eax, dword ptr fs:[00000030h]		4_2_0345F2D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034E12ED mov eax, dword ptr fs:[00000030h]		4_2_034E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034E12ED mov eax, dword ptr fs:[00000030h]		4_2_034E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034E12ED mov eax, dword ptr fs:[00000030h]		4_2_034E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034E12ED mov eax, dword ptr fs:[00000030h]		4_2_034E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034E12ED mov eax, dword ptr fs:[00000030h]		4_2_034E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034E12ED mov eax, dword ptr fs:[00000030h]		4_2_034E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034E12ED mov eax, dword ptr fs:[00000030h]		4_2_034E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034E12ED mov eax, dword ptr fs:[00000030h]		4_2_034E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034E12ED mov eax, dword ptr fs:[00000030h]		4_2_034E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034E12ED mov eax, dword ptr fs:[00000030h]		4_2_034E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034E12ED mov eax, dword ptr fs:[00000030h]		4_2_034E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034E12ED mov eax, dword ptr fs:[00000030h]		4_2_034E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034E12ED mov eax, dword ptr fs:[00000030h]		4_2_034E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034E12ED mov eax, dword ptr fs:[00000030h]		4_2_034E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034402E1 mov eax, dword ptr fs:[00000030h]		4_2_034402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034402E1 mov eax, dword ptr fs:[00000030h]		4_2_034402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034402E1 mov eax, dword ptr fs:[00000030h]		4_2_034402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_035052E2 mov eax, dword ptr fs:[00000030h]		4_2_035052E2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034EF2F8 mov eax, dword ptr fs:[00000030h]		4_2_034EF2F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034292FF mov eax, dword ptr fs:[00000030h]		4_2_034292FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0346E284 mov eax, dword ptr fs:[00000030h]		4_2_0346E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0346E284 mov eax, dword ptr fs:[00000030h]		4_2_0346E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034B0283 mov eax, dword ptr fs:[00000030h]		4_2_034B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034B0283 mov eax, dword ptr fs:[00000030h]		4_2_034B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034B0283 mov eax, dword ptr fs:[00000030h]		4_2_034B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03505283 mov eax, dword ptr fs:[00000030h]		4_2_03505283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0346329E mov eax, dword ptr fs:[00000030h]		4_2_0346329E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0346329E mov eax, dword ptr fs:[00000030h]		4_2_0346329E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034402A0 mov eax, dword ptr fs:[00000030h]		4_2_034402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034402A0 mov eax, dword ptr fs:[00000030h]		4_2_034402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034452A0 mov eax, dword ptr fs:[00000030h]		4_2_034452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034452A0 mov eax, dword ptr fs:[00000030h]		4_2_034452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034452A0 mov eax, dword ptr fs:[00000030h]		4_2_034452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034452A0 mov eax, dword ptr fs:[00000030h]		4_2_034452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034F92A6 mov eax, dword ptr fs:[00000030h]		4_2_034F92A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034F92A6 mov eax, dword ptr fs:[00000030h]		4_2_034F92A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034F92A6 mov eax, dword ptr fs:[00000030h]		4_2_034F92A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034F92A6 mov eax, dword ptr fs:[00000030h]		4_2_034F92A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034C62A0 mov eax, dword ptr fs:[00000030h]		4_2_034C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034C62A0 mov ecx, dword ptr fs:[00000030h]		4_2_034C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034C62A0 mov eax, dword ptr fs:[00000030h]		4_2_034C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034C62A0 mov eax, dword ptr fs:[00000030h]		4_2_034C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034C62A0 mov eax, dword ptr fs:[00000030h]		4_2_034C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034C62A0 mov eax, dword ptr fs:[00000030h]		4_2_034C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034C72A0 mov eax, dword ptr fs:[00000030h]		4_2_034C72A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034C72A0 mov eax, dword ptr fs:[00000030h]		4_2_034C72A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034B92BC mov eax, dword ptr fs:[00000030h]		4_2_034B92BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034B92BC mov eax, dword ptr fs:[00000030h]		4_2_034B92BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034B92BC mov ecx, dword ptr fs:[00000030h]		4_2_034B92BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034B92BC mov ecx, dword ptr fs:[00000030h]		4_2_034B92BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03505152 mov eax, dword ptr fs:[00000030h]		4_2_03505152
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034C4144 mov eax, dword ptr fs:[00000030h]		4_2_034C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034C4144 mov eax, dword ptr fs:[00000030h]		4_2_034C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034C4144 mov ecx, dword ptr fs:[00000030h]		4_2_034C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034C4144 mov eax, dword ptr fs:[00000030h]		4_2_034C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034C4144 mov eax, dword ptr fs:[00000030h]		4_2_034C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03429148 mov eax, dword ptr fs:[00000030h]		4_2_03429148
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03429148 mov eax, dword ptr fs:[00000030h]		4_2_03429148
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03429148 mov eax, dword ptr fs:[00000030h]		4_2_03429148
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03429148 mov eax, dword ptr fs:[00000030h]		4_2_03429148
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03437152 mov eax, dword ptr fs:[00000030h]		4_2_03437152
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342C156 mov eax, dword ptr fs:[00000030h]		4_2_0342C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03436154 mov eax, dword ptr fs:[00000030h]		4_2_03436154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03436154 mov eax, dword ptr fs:[00000030h]		4_2_03436154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342F172 mov eax, dword ptr fs:[00000030h]		4_2_0342F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342F172 mov eax, dword ptr fs:[00000030h]		4_2_0342F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342F172 mov eax, dword ptr fs:[00000030h]		4_2_0342F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342F172 mov eax, dword ptr fs:[00000030h]		4_2_0342F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342F172 mov eax, dword ptr fs:[00000030h]		4_2_0342F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342F172 mov eax, dword ptr fs:[00000030h]		4_2_0342F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342F172 mov eax, dword ptr fs:[00000030h]		4_2_0342F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342F172 mov eax, dword ptr fs:[00000030h]		4_2_0342F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342F172 mov eax, dword ptr fs:[00000030h]		4_2_0342F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342F172 mov eax, dword ptr fs:[00000030h]		4_2_0342F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342F172 mov eax, dword ptr fs:[00000030h]		4_2_0342F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342F172 mov eax, dword ptr fs:[00000030h]		4_2_0342F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342F172 mov eax, dword ptr fs:[00000030h]		4_2_0342F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342F172 mov eax, dword ptr fs:[00000030h]		4_2_0342F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342F172 mov eax, dword ptr fs:[00000030h]		4_2_0342F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342F172 mov eax, dword ptr fs:[00000030h]		4_2_0342F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342F172 mov eax, dword ptr fs:[00000030h]		4_2_0342F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342F172 mov eax, dword ptr fs:[00000030h]		4_2_0342F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342F172 mov eax, dword ptr fs:[00000030h]		4_2_0342F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342F172 mov eax, dword ptr fs:[00000030h]		4_2_0342F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342F172 mov eax, dword ptr fs:[00000030h]		4_2_0342F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034C9179 mov eax, dword ptr fs:[00000030h]		4_2_034C9179
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034DA118 mov ecx, dword ptr fs:[00000030h]		4_2_034DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034DA118 mov eax, dword ptr fs:[00000030h]		4_2_034DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034DA118 mov eax, dword ptr fs:[00000030h]		4_2_034DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034DA118 mov eax, dword ptr fs:[00000030h]		4_2_034DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034F0115 mov eax, dword ptr fs:[00000030h]		4_2_034F0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03460124 mov eax, dword ptr fs:[00000030h]		4_2_03460124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03431131 mov eax, dword ptr fs:[00000030h]		4_2_03431131
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03431131 mov eax, dword ptr fs:[00000030h]		4_2_03431131
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342B136 mov eax, dword ptr fs:[00000030h]		4_2_0342B136
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342B136 mov eax, dword ptr fs:[00000030h]		4_2_0342B136
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342B136 mov eax, dword ptr fs:[00000030h]		4_2_0342B136
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342B136 mov eax, dword ptr fs:[00000030h]		4_2_0342B136
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034F61C3 mov eax, dword ptr fs:[00000030h]		4_2_034F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034F61C3 mov eax, dword ptr fs:[00000030h]		4_2_034F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0346D1D0 mov eax, dword ptr fs:[00000030h]		4_2_0346D1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0346D1D0 mov ecx, dword ptr fs:[00000030h]		4_2_0346D1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034AE1D0 mov eax, dword ptr fs:[00000030h]		4_2_034AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034AE1D0 mov eax, dword ptr fs:[00000030h]		4_2_034AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034AE1D0 mov ecx, dword ptr fs:[00000030h]		4_2_034AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034AE1D0 mov eax, dword ptr fs:[00000030h]		4_2_034AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034AE1D0 mov eax, dword ptr fs:[00000030h]		4_2_034AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_035051CB mov eax, dword ptr fs:[00000030h]		4_2_035051CB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034551EF mov eax, dword ptr fs:[00000030h]		4_2_034551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034551EF mov eax, dword ptr fs:[00000030h]		4_2_034551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034551EF mov eax, dword ptr fs:[00000030h]		4_2_034551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034551EF mov eax, dword ptr fs:[00000030h]		4_2_034551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034551EF mov eax, dword ptr fs:[00000030h]		4_2_034551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034551EF mov eax, dword ptr fs:[00000030h]		4_2_034551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034551EF mov eax, dword ptr fs:[00000030h]		4_2_034551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034551EF mov eax, dword ptr fs:[00000030h]		4_2_034551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034551EF mov eax, dword ptr fs:[00000030h]		4_2_034551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034551EF mov eax, dword ptr fs:[00000030h]		4_2_034551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034551EF mov eax, dword ptr fs:[00000030h]		4_2_034551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034551EF mov eax, dword ptr fs:[00000030h]		4_2_034551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034551EF mov eax, dword ptr fs:[00000030h]		4_2_034551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034351ED mov eax, dword ptr fs:[00000030h]		4_2_034351ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_035061E5 mov eax, dword ptr fs:[00000030h]		4_2_035061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034601F8 mov eax, dword ptr fs:[00000030h]		4_2_034601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03470185 mov eax, dword ptr fs:[00000030h]		4_2_03470185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034EC188 mov eax, dword ptr fs:[00000030h]		4_2_034EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034EC188 mov eax, dword ptr fs:[00000030h]		4_2_034EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034B019F mov eax, dword ptr fs:[00000030h]		4_2_034B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034B019F mov eax, dword ptr fs:[00000030h]		4_2_034B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034B019F mov eax, dword ptr fs:[00000030h]		4_2_034B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034B019F mov eax, dword ptr fs:[00000030h]		4_2_034B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342A197 mov eax, dword ptr fs:[00000030h]		4_2_0342A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342A197 mov eax, dword ptr fs:[00000030h]		4_2_0342A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342A197 mov eax, dword ptr fs:[00000030h]		4_2_0342A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03487190 mov eax, dword ptr fs:[00000030h]		4_2_03487190
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034E11A4 mov eax, dword ptr fs:[00000030h]		4_2_034E11A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034E11A4 mov eax, dword ptr fs:[00000030h]		4_2_034E11A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034E11A4 mov eax, dword ptr fs:[00000030h]		4_2_034E11A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034E11A4 mov eax, dword ptr fs:[00000030h]		4_2_034E11A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0344B1B0 mov eax, dword ptr fs:[00000030h]		4_2_0344B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03432050 mov eax, dword ptr fs:[00000030h]		4_2_03432050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034D705E mov ebx, dword ptr fs:[00000030h]		4_2_034D705E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034D705E mov eax, dword ptr fs:[00000030h]		4_2_034D705E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0345B052 mov eax, dword ptr fs:[00000030h]		4_2_0345B052
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03505060 mov eax, dword ptr fs:[00000030h]		4_2_03505060
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03441070 mov eax, dword ptr fs:[00000030h]		4_2_03441070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03441070 mov ecx, dword ptr fs:[00000030h]		4_2_03441070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03441070 mov eax, dword ptr fs:[00000030h]		4_2_03441070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03441070 mov eax, dword ptr fs:[00000030h]		4_2_03441070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03441070 mov eax, dword ptr fs:[00000030h]		4_2_03441070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03441070 mov eax, dword ptr fs:[00000030h]		4_2_03441070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03441070 mov eax, dword ptr fs:[00000030h]		4_2_03441070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03441070 mov eax, dword ptr fs:[00000030h]		4_2_03441070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03441070 mov eax, dword ptr fs:[00000030h]		4_2_03441070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03441070 mov eax, dword ptr fs:[00000030h]		4_2_03441070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03441070 mov eax, dword ptr fs:[00000030h]		4_2_03441070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03441070 mov eax, dword ptr fs:[00000030h]		4_2_03441070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03441070 mov eax, dword ptr fs:[00000030h]		4_2_03441070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0345C073 mov eax, dword ptr fs:[00000030h]		4_2_0345C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034AD070 mov ecx, dword ptr fs:[00000030h]		4_2_034AD070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0344E016 mov eax, dword ptr fs:[00000030h]		4_2_0344E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0344E016 mov eax, dword ptr fs:[00000030h]		4_2_0344E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0344E016 mov eax, dword ptr fs:[00000030h]		4_2_0344E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0344E016 mov eax, dword ptr fs:[00000030h]		4_2_0344E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342A020 mov eax, dword ptr fs:[00000030h]		4_2_0342A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342C020 mov eax, dword ptr fs:[00000030h]		4_2_0342C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034F903E mov eax, dword ptr fs:[00000030h]		4_2_034F903E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034F903E mov eax, dword ptr fs:[00000030h]		4_2_034F903E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034F903E mov eax, dword ptr fs:[00000030h]		4_2_034F903E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034F903E mov eax, dword ptr fs:[00000030h]		4_2_034F903E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034470C0 mov eax, dword ptr fs:[00000030h]		4_2_034470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034470C0 mov ecx, dword ptr fs:[00000030h]		4_2_034470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034470C0 mov ecx, dword ptr fs:[00000030h]		4_2_034470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034470C0 mov eax, dword ptr fs:[00000030h]		4_2_034470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034470C0 mov ecx, dword ptr fs:[00000030h]		4_2_034470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034470C0 mov ecx, dword ptr fs:[00000030h]		4_2_034470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034470C0 mov eax, dword ptr fs:[00000030h]		4_2_034470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034470C0 mov eax, dword ptr fs:[00000030h]		4_2_034470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034470C0 mov eax, dword ptr fs:[00000030h]		4_2_034470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034470C0 mov eax, dword ptr fs:[00000030h]		4_2_034470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034470C0 mov eax, dword ptr fs:[00000030h]		4_2_034470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034470C0 mov eax, dword ptr fs:[00000030h]		4_2_034470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034470C0 mov eax, dword ptr fs:[00000030h]		4_2_034470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034470C0 mov eax, dword ptr fs:[00000030h]		4_2_034470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034470C0 mov eax, dword ptr fs:[00000030h]		4_2_034470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034470C0 mov eax, dword ptr fs:[00000030h]		4_2_034470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034470C0 mov eax, dword ptr fs:[00000030h]		4_2_034470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034470C0 mov eax, dword ptr fs:[00000030h]		4_2_034470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_035050D9 mov eax, dword ptr fs:[00000030h]		4_2_035050D9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034AD0C0 mov eax, dword ptr fs:[00000030h]		4_2_034AD0C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034AD0C0 mov eax, dword ptr fs:[00000030h]		4_2_034AD0C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034B20DE mov eax, dword ptr fs:[00000030h]		4_2_034B20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034590DB mov eax, dword ptr fs:[00000030h]		4_2_034590DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034550E4 mov eax, dword ptr fs:[00000030h]		4_2_034550E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034550E4 mov ecx, dword ptr fs:[00000030h]		4_2_034550E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342A0E3 mov ecx, dword ptr fs:[00000030h]		4_2_0342A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034380E9 mov eax, dword ptr fs:[00000030h]		4_2_034380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342C0F0 mov eax, dword ptr fs:[00000030h]		4_2_0342C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034720F0 mov ecx, dword ptr fs:[00000030h]		4_2_034720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0343208A mov eax, dword ptr fs:[00000030h]		4_2_0343208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342D08D mov eax, dword ptr fs:[00000030h]		4_2_0342D08D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03435096 mov eax, dword ptr fs:[00000030h]		4_2_03435096
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0345D090 mov eax, dword ptr fs:[00000030h]		4_2_0345D090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0345D090 mov eax, dword ptr fs:[00000030h]		4_2_0345D090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0346909C mov eax, dword ptr fs:[00000030h]		4_2_0346909C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034F60B8 mov eax, dword ptr fs:[00000030h]		4_2_034F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034F60B8 mov ecx, dword ptr fs:[00000030h]		4_2_034F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03443740 mov eax, dword ptr fs:[00000030h]		4_2_03443740
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03443740 mov eax, dword ptr fs:[00000030h]		4_2_03443740
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03443740 mov eax, dword ptr fs:[00000030h]		4_2_03443740
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0346674D mov esi, dword ptr fs:[00000030h]		4_2_0346674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0346674D mov eax, dword ptr fs:[00000030h]		4_2_0346674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0346674D mov eax, dword ptr fs:[00000030h]		4_2_0346674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03430750 mov eax, dword ptr fs:[00000030h]		4_2_03430750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03472750 mov eax, dword ptr fs:[00000030h]		4_2_03472750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03472750 mov eax, dword ptr fs:[00000030h]		4_2_03472750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03503749 mov eax, dword ptr fs:[00000030h]		4_2_03503749
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034B4755 mov eax, dword ptr fs:[00000030h]		4_2_034B4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342B765 mov eax, dword ptr fs:[00000030h]		4_2_0342B765
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342B765 mov eax, dword ptr fs:[00000030h]		4_2_0342B765
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342B765 mov eax, dword ptr fs:[00000030h]		4_2_0342B765
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342B765 mov eax, dword ptr fs:[00000030h]		4_2_0342B765
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03438770 mov eax, dword ptr fs:[00000030h]		4_2_03438770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03440770 mov eax, dword ptr fs:[00000030h]		4_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03440770 mov eax, dword ptr fs:[00000030h]		4_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03440770 mov eax, dword ptr fs:[00000030h]		4_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03440770 mov eax, dword ptr fs:[00000030h]		4_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03440770 mov eax, dword ptr fs:[00000030h]		4_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03440770 mov eax, dword ptr fs:[00000030h]		4_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03440770 mov eax, dword ptr fs:[00000030h]		4_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03440770 mov eax, dword ptr fs:[00000030h]		4_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03440770 mov eax, dword ptr fs:[00000030h]		4_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03440770 mov eax, dword ptr fs:[00000030h]		4_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03440770 mov eax, dword ptr fs:[00000030h]		4_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03440770 mov eax, dword ptr fs:[00000030h]		4_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03437703 mov eax, dword ptr fs:[00000030h]		4_2_03437703
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03435702 mov eax, dword ptr fs:[00000030h]		4_2_03435702
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03435702 mov eax, dword ptr fs:[00000030h]		4_2_03435702
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0346C700 mov eax, dword ptr fs:[00000030h]		4_2_0346C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03430710 mov eax, dword ptr fs:[00000030h]		4_2_03430710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03460710 mov eax, dword ptr fs:[00000030h]		4_2_03460710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0346F71F mov eax, dword ptr fs:[00000030h]		4_2_0346F71F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0346F71F mov eax, dword ptr fs:[00000030h]		4_2_0346F71F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034EF72E mov eax, dword ptr fs:[00000030h]		4_2_034EF72E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03433720 mov eax, dword ptr fs:[00000030h]		4_2_03433720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0344F720 mov eax, dword ptr fs:[00000030h]		4_2_0344F720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0344F720 mov eax, dword ptr fs:[00000030h]		4_2_0344F720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0344F720 mov eax, dword ptr fs:[00000030h]		4_2_0344F720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034F972B mov eax, dword ptr fs:[00000030h]		4_2_034F972B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0346C720 mov eax, dword ptr fs:[00000030h]		4_2_0346C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0346C720 mov eax, dword ptr fs:[00000030h]		4_2_0346C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0350B73C mov eax, dword ptr fs:[00000030h]		4_2_0350B73C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0350B73C mov eax, dword ptr fs:[00000030h]		4_2_0350B73C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0350B73C mov eax, dword ptr fs:[00000030h]		4_2_0350B73C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0350B73C mov eax, dword ptr fs:[00000030h]		4_2_0350B73C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03429730 mov eax, dword ptr fs:[00000030h]		4_2_03429730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03429730 mov eax, dword ptr fs:[00000030h]		4_2_03429730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03465734 mov eax, dword ptr fs:[00000030h]		4_2_03465734
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0343973A mov eax, dword ptr fs:[00000030h]		4_2_0343973A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0343973A mov eax, dword ptr fs:[00000030h]		4_2_0343973A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0346273C mov eax, dword ptr fs:[00000030h]		4_2_0346273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0346273C mov ecx, dword ptr fs:[00000030h]		4_2_0346273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0346273C mov eax, dword ptr fs:[00000030h]		4_2_0346273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034AC730 mov eax, dword ptr fs:[00000030h]		4_2_034AC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0343C7C0 mov eax, dword ptr fs:[00000030h]		4_2_0343C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034357C0 mov eax, dword ptr fs:[00000030h]		4_2_034357C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034357C0 mov eax, dword ptr fs:[00000030h]		4_2_034357C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034357C0 mov eax, dword ptr fs:[00000030h]		4_2_034357C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0343D7E0 mov ecx, dword ptr fs:[00000030h]		4_2_0343D7E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034527ED mov eax, dword ptr fs:[00000030h]		4_2_034527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034527ED mov eax, dword ptr fs:[00000030h]		4_2_034527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034527ED mov eax, dword ptr fs:[00000030h]		4_2_034527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034347FB mov eax, dword ptr fs:[00000030h]		4_2_034347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034347FB mov eax, dword ptr fs:[00000030h]		4_2_034347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034EF78A mov eax, dword ptr fs:[00000030h]		4_2_034EF78A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034B97A9 mov eax, dword ptr fs:[00000030h]		4_2_034B97A9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034BF7AF mov eax, dword ptr fs:[00000030h]		4_2_034BF7AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034BF7AF mov eax, dword ptr fs:[00000030h]		4_2_034BF7AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034BF7AF mov eax, dword ptr fs:[00000030h]		4_2_034BF7AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034BF7AF mov eax, dword ptr fs:[00000030h]		4_2_034BF7AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034BF7AF mov eax, dword ptr fs:[00000030h]		4_2_034BF7AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_035037B6 mov eax, dword ptr fs:[00000030h]		4_2_035037B6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034307AF mov eax, dword ptr fs:[00000030h]		4_2_034307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0345D7B0 mov eax, dword ptr fs:[00000030h]		4_2_0345D7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342F7BA mov eax, dword ptr fs:[00000030h]		4_2_0342F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342F7BA mov eax, dword ptr fs:[00000030h]		4_2_0342F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342F7BA mov eax, dword ptr fs:[00000030h]		4_2_0342F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342F7BA mov eax, dword ptr fs:[00000030h]		4_2_0342F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342F7BA mov eax, dword ptr fs:[00000030h]		4_2_0342F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342F7BA mov eax, dword ptr fs:[00000030h]		4_2_0342F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342F7BA mov eax, dword ptr fs:[00000030h]		4_2_0342F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342F7BA mov eax, dword ptr fs:[00000030h]		4_2_0342F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342F7BA mov eax, dword ptr fs:[00000030h]		4_2_0342F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0344C640 mov eax, dword ptr fs:[00000030h]		4_2_0344C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034F866E mov eax, dword ptr fs:[00000030h]		4_2_034F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034F866E mov eax, dword ptr fs:[00000030h]		4_2_034F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0346A660 mov eax, dword ptr fs:[00000030h]		4_2_0346A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0346A660 mov eax, dword ptr fs:[00000030h]		4_2_0346A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03469660 mov eax, dword ptr fs:[00000030h]		4_2_03469660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03469660 mov eax, dword ptr fs:[00000030h]		4_2_03469660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03462674 mov eax, dword ptr fs:[00000030h]		4_2_03462674
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03461607 mov eax, dword ptr fs:[00000030h]		4_2_03461607
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034AE609 mov eax, dword ptr fs:[00000030h]		4_2_034AE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0346F603 mov eax, dword ptr fs:[00000030h]		4_2_0346F603
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0344260B mov eax, dword ptr fs:[00000030h]		4_2_0344260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0344260B mov eax, dword ptr fs:[00000030h]		4_2_0344260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0344260B mov eax, dword ptr fs:[00000030h]		4_2_0344260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0344260B mov eax, dword ptr fs:[00000030h]		4_2_0344260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0344260B mov eax, dword ptr fs:[00000030h]		4_2_0344260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0344260B mov eax, dword ptr fs:[00000030h]		4_2_0344260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0344260B mov eax, dword ptr fs:[00000030h]		4_2_0344260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03433616 mov eax, dword ptr fs:[00000030h]		4_2_03433616
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03433616 mov eax, dword ptr fs:[00000030h]		4_2_03433616
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03472619 mov eax, dword ptr fs:[00000030h]		4_2_03472619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0344E627 mov eax, dword ptr fs:[00000030h]		4_2_0344E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342F626 mov eax, dword ptr fs:[00000030h]		4_2_0342F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342F626 mov eax, dword ptr fs:[00000030h]		4_2_0342F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342F626 mov eax, dword ptr fs:[00000030h]		4_2_0342F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342F626 mov eax, dword ptr fs:[00000030h]		4_2_0342F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342F626 mov eax, dword ptr fs:[00000030h]		4_2_0342F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342F626 mov eax, dword ptr fs:[00000030h]		4_2_0342F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342F626 mov eax, dword ptr fs:[00000030h]		4_2_0342F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342F626 mov eax, dword ptr fs:[00000030h]		4_2_0342F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342F626 mov eax, dword ptr fs:[00000030h]		4_2_0342F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03466620 mov eax, dword ptr fs:[00000030h]		4_2_03466620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03505636 mov eax, dword ptr fs:[00000030h]		4_2_03505636
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03468620 mov eax, dword ptr fs:[00000030h]		4_2_03468620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0343262C mov eax, dword ptr fs:[00000030h]		4_2_0343262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0346A6C7 mov ebx, dword ptr fs:[00000030h]		4_2_0346A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0346A6C7 mov eax, dword ptr fs:[00000030h]		4_2_0346A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0343B6C0 mov eax, dword ptr fs:[00000030h]		4_2_0343B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0343B6C0 mov eax, dword ptr fs:[00000030h]		4_2_0343B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0343B6C0 mov eax, dword ptr fs:[00000030h]		4_2_0343B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0343B6C0 mov eax, dword ptr fs:[00000030h]		4_2_0343B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0343B6C0 mov eax, dword ptr fs:[00000030h]		4_2_0343B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0343B6C0 mov eax, dword ptr fs:[00000030h]		4_2_0343B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034F16CC mov eax, dword ptr fs:[00000030h]		4_2_034F16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034F16CC mov eax, dword ptr fs:[00000030h]		4_2_034F16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034F16CC mov eax, dword ptr fs:[00000030h]		4_2_034F16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034F16CC mov eax, dword ptr fs:[00000030h]		4_2_034F16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034EF6C7 mov eax, dword ptr fs:[00000030h]		4_2_034EF6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034616CF mov eax, dword ptr fs:[00000030h]		4_2_034616CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034C36EE mov eax, dword ptr fs:[00000030h]		4_2_034C36EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034C36EE mov eax, dword ptr fs:[00000030h]		4_2_034C36EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034C36EE mov eax, dword ptr fs:[00000030h]		4_2_034C36EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034C36EE mov eax, dword ptr fs:[00000030h]		4_2_034C36EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034C36EE mov eax, dword ptr fs:[00000030h]		4_2_034C36EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034C36EE mov eax, dword ptr fs:[00000030h]		4_2_034C36EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0345D6E0 mov eax, dword ptr fs:[00000030h]		4_2_0345D6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0345D6E0 mov eax, dword ptr fs:[00000030h]		4_2_0345D6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034AE6F2 mov eax, dword ptr fs:[00000030h]		4_2_034AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034AE6F2 mov eax, dword ptr fs:[00000030h]		4_2_034AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034AE6F2 mov eax, dword ptr fs:[00000030h]		4_2_034AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034AE6F2 mov eax, dword ptr fs:[00000030h]		4_2_034AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034B06F1 mov eax, dword ptr fs:[00000030h]		4_2_034B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034B06F1 mov eax, dword ptr fs:[00000030h]		4_2_034B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034ED6F0 mov eax, dword ptr fs:[00000030h]		4_2_034ED6F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034B368C mov eax, dword ptr fs:[00000030h]		4_2_034B368C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034B368C mov eax, dword ptr fs:[00000030h]		4_2_034B368C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034B368C mov eax, dword ptr fs:[00000030h]		4_2_034B368C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034B368C mov eax, dword ptr fs:[00000030h]		4_2_034B368C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03434690 mov eax, dword ptr fs:[00000030h]		4_2_03434690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03434690 mov eax, dword ptr fs:[00000030h]		4_2_03434690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0346C6A6 mov eax, dword ptr fs:[00000030h]		4_2_0346C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342D6AA mov eax, dword ptr fs:[00000030h]		4_2_0342D6AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0342D6AA mov eax, dword ptr fs:[00000030h]		4_2_0342D6AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034276B2 mov eax, dword ptr fs:[00000030h]		4_2_034276B2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034276B2 mov eax, dword ptr fs:[00000030h]		4_2_034276B2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_034276B2 mov eax, dword ptr fs:[00000030h]		4_2_034276B2

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\Desktop\rOr__amentoprim.exe

Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write

Jump to behavior

Source: C:\Users\user\Desktop\rOr__amentoprim.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 2B11008

Jump to behavior

Source: C:\Users\user\Desktop\rOr__amentoprim.exe

Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\rOr__amentoprim.exe"

Jump to behavior

Source: rOr__amentoprim.exe

Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning

Stealing of Sensitive Information

Source: Yara match	File source: 4.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2189639612.00000000008E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2189442414.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Source: Yara match	File source: 4.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2189639612.00000000008E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2189442414.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY