Windows Analysis Report
LiuUGJK9vH.exe

AI detected suspicious sample

Source: Yara match	File source: 4.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1792348155.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1793038630.0000000003950000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Joe Sandbox ML: detected
Source: C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	Joe Sandbox ML: detected
Source: C:\Windows\System32\AppVClient.exe	Joe Sandbox ML: detected
Source: C:\Windows\System32\alg.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: LiuUGJK9vH.exe

Joe Sandbox ML: detected

Source: LiuUGJK9vH.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: D:\DCB\CBT_Main\BuildResults\bin\Win32\Release\armsvc.pdb source: LiuUGJK9vH.exe, 00000000.00000003.1459636308.0000000003EF0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe.0.dr
Source:	Binary string: DiagnosticsHub.StandardCollector.Service.pdb source: DiagnosticsHub.StandardCollector.Service.exe.0.dr
Source:	Binary string: AppVClient.pdbGCTL source: AppVClient.exe.0.dr
Source:	Binary string: ALG.pdbGCTL source: LiuUGJK9vH.exe, 00000000.00000003.1463706750.0000000003EF0000.00000004.00001000.00020000.00000000.sdmp, alg.exe.0.dr
Source:	Binary string: AppVClient.pdb source: AppVClient.exe.0.dr
Source:	Binary string: DiagnosticsHub.StandardCollector.Service.pdbGCTL source: DiagnosticsHub.StandardCollector.Service.exe.0.dr
Source:	Binary string: wntdll.pdbUGP source: LiuUGJK9vH.exe, 00000000.00000003.1466769088.0000000004250000.00000004.00001000.00020000.00000000.sdmp, LiuUGJK9vH.exe, 00000000.00000003.1472318667.0000000004250000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1751681677.0000000003900000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1793138117.0000000003B00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1749096738.0000000003700000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1793138117.0000000003C9E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: LiuUGJK9vH.exe, 00000000.00000003.1466769088.0000000004250000.00000004.00001000.00020000.00000000.sdmp, LiuUGJK9vH.exe, 00000000.00000003.1472318667.0000000004250000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000004.00000003.1751681677.0000000003900000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1793138117.0000000003B00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1749096738.0000000003700000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1793138117.0000000003C9E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: ALG.pdb source: LiuUGJK9vH.exe, 00000000.00000003.1463706750.0000000003EF0000.00000004.00001000.00020000.00000000.sdmp, alg.exe.0.dr

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	System file written: C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	Jump to behavior
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	System file written: C:\Windows\System32\AppVClient.exe	Jump to behavior
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	System file written: C:\Windows\System32\alg.exe	Jump to behavior

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_0046445A GetFileAttributesW,FindFirstFileW,FindClose,	0_2_0046445A
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_0046C6D1 FindFirstFileW,FindClose,	0_2_0046C6D1
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_0046C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_0046C75C
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_0046EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0046EF95
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_0046F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0046F0F2
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_0046F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0046F3F3
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_004637EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_004637EF
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_00463B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00463B12
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_0046BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0046BCBC

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2850851 - Severity 1 - ETPRO MALWARE Win32/Expiro.NDO CnC Activity : 192.168.2.8:49704 -> 54.244.188.177:80

Source: Joe Sandbox View	IP Address: 54.244.188.177 54.244.188.177
Source: Joe Sandbox View	IP Address: 18.141.10.107 18.141.10.107

Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 54.244.188.177:80 -> 192.168.2.8:49704
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 54.244.188.177:80 -> 192.168.2.8:49704

Source: global traffic	HTTP traffic detected: POST /hdjf HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: pywolwnvd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 802
Source: global traffic	HTTP traffic detected: POST /rai HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ssbzmoy.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 802

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe

Code function: 0_2_004722EE InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_004722EE

Source: global traffic	DNS traffic detected: DNS query: pywolwnvd.biz
Source: global traffic	DNS traffic detected: DNS query: ssbzmoy.biz

Source: unknown

HTTP traffic detected: POST /hdjf HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: pywolwnvd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 802

Source: LiuUGJK9vH.exe, 00000000.00000002.1480829576.0000000000BBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107/
Source: LiuUGJK9vH.exe, 00000000.00000002.1480829576.0000000000BBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107/8
Source: LiuUGJK9vH.exe, 00000000.00000002.1480829576.0000000000BBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107/rai
Source: LiuUGJK9vH.exe, 00000000.00000002.1480829576.0000000000BBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107/raiI
Source: LiuUGJK9vH.exe, 00000000.00000002.1480616556.0000000000AE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107/raie
Source: LiuUGJK9vH.exe, 00000000.00000002.1480829576.0000000000BBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107/x
Source: LiuUGJK9vH.exe, 00000000.00000002.1480829576.0000000000BB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107:80/rai
Source: LiuUGJK9vH.exe, 00000000.00000002.1480829576.0000000000BA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://54.244.188.177/
Source: LiuUGJK9vH.exe, 00000000.00000002.1480616556.0000000000AE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://54.244.188.177/hdjf
Source: LiuUGJK9vH.exe, 00000000.00000002.1480616556.0000000000AE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://54.244.188.177/hdjf~A

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe

Code function: 0_2_00474164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00474164

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe

Code function: 0_2_00474164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00474164

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe

Code function: 0_2_00473F66 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00473F66

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe

Code function: 0_2_0046001C GetKeyboardState,SetKeyboardState,GetAsyncKeyState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_0046001C

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe

Code function: 0_2_0048CABC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_0048CABC

E-Banking Fraud

Binary is likely a compiled AutoIt script file

Source: Yara match	File source: 4.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1792348155.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1793038630.0000000003950000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00403B3A
Source: LiuUGJK9vH.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: LiuUGJK9vH.exe, 00000000.00000002.1480260793.00000000004B4000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_62348d65-f
Source: LiuUGJK9vH.exe, 00000000.00000002.1480260793.00000000004B4000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_0878ef87-3
Source: LiuUGJK9vH.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_28cd403f-1
Source: LiuUGJK9vH.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_c11a1c63-d

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0042CBC3 NtClose,	4_2_0042CBC3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B72B60 NtClose,LdrInitializeThunk,	4_2_03B72B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B72DF0 NtQuerySystemInformation,LdrInitializeThunk,	4_2_03B72DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B735C0 NtCreateMutant,LdrInitializeThunk,	4_2_03B735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B74340 NtSetContextThread,	4_2_03B74340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B74650 NtSuspendThread,	4_2_03B74650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B72BA0 NtEnumerateValueKey,	4_2_03B72BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B72B80 NtQueryInformationFile,	4_2_03B72B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B72BF0 NtAllocateVirtualMemory,	4_2_03B72BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B72BE0 NtQueryValueKey,	4_2_03B72BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B72AB0 NtWaitForSingleObject,	4_2_03B72AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B72AF0 NtWriteFile,	4_2_03B72AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B72AD0 NtReadFile,	4_2_03B72AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B72FB0 NtResumeThread,	4_2_03B72FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B72FA0 NtQuerySection,	4_2_03B72FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B72F90 NtProtectVirtualMemory,	4_2_03B72F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B72FE0 NtCreateFile,	4_2_03B72FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B72F30 NtCreateSection,	4_2_03B72F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B72F60 NtCreateProcessEx,	4_2_03B72F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B72EA0 NtAdjustPrivilegesToken,	4_2_03B72EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B72E80 NtReadVirtualMemory,	4_2_03B72E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B72EE0 NtQueueApcThread,	4_2_03B72EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B72E30 NtWriteVirtualMemory,	4_2_03B72E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B72DB0 NtEnumerateKey,	4_2_03B72DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B72DD0 NtDelayExecution,	4_2_03B72DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B72D30 NtUnmapViewOfSection,	4_2_03B72D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B72D10 NtMapViewOfSection,	4_2_03B72D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B72D00 NtSetInformationFile,	4_2_03B72D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B72CA0 NtQueryInformationToken,	4_2_03B72CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B72CF0 NtOpenProcess,	4_2_03B72CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B72CC0 NtQueryVirtualMemory,	4_2_03B72CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B72C00 NtQueryInformationProcess,	4_2_03B72C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B72C70 NtFreeVirtualMemory,	4_2_03B72C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B72C60 NtCreateKey,	4_2_03B72C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B73090 NtSetValueKey,	4_2_03B73090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B73010 NtOpenDirectoryObject,	4_2_03B73010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B739B0 NtGetContextThread,	4_2_03B739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B73D10 NtOpenProcessToken,	4_2_03B73D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B73D70 NtOpenThread,	4_2_03B73D70

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe

Code function: 0_2_0046A1EF: GetFullPathNameW,__swprintf,CreateDirectoryW,CreateFileW,_memset,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

0_2_0046A1EF

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe

Code function: 0_2_00458310 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00458310

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe

Code function: 0_2_004651BD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_004651BD

Source: C:\Windows\System32\AppVClient.exe

File created: C:\Windows\system32\config\systemprofile\AppData\Roaming\a49546759c90d829.bin

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_0040E6A0	0_2_0040E6A0
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_0042D975	0_2_0042D975
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_0040FCE0	0_2_0040FCE0
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_004221C5	0_2_004221C5
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_004362D2	0_2_004362D2
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_004803DA	0_2_004803DA
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_0043242E	0_2_0043242E
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_004225FA	0_2_004225FA
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_0045E616	0_2_0045E616
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_004166E1	0_2_004166E1
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_0043878F	0_2_0043878F
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_00436844	0_2_00436844
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_00480857	0_2_00480857
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_00418808	0_2_00418808
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_00468889	0_2_00468889
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_0042CB21	0_2_0042CB21
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_00436DB6	0_2_00436DB6
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_00416F9E	0_2_00416F9E
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_00413030	0_2_00413030
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_0042F1D9	0_2_0042F1D9
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_00423187	0_2_00423187
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_00401287	0_2_00401287
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_00421484	0_2_00421484
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_00415520	0_2_00415520
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_00427696	0_2_00427696
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_00415760	0_2_00415760
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_00421978	0_2_00421978
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_00439AB5	0_2_00439AB5
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_0051FCC8	0_2_0051FCC8
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_00487DDB	0_2_00487DDB
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_00421D90	0_2_00421D90
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_0042BDA6	0_2_0042BDA6
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_0040DF00	0_2_0040DF00
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_00413FE0	0_2_00413FE0
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_00BA55E8	0_2_00BA55E8
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_02F900D9	0_2_02F900D9
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_02F551EE	0_2_02F551EE
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_02F56EAF	0_2_02F56EAF
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_02F8C7F0	0_2_02F8C7F0
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_02F83780	0_2_02F83780
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_02F8D580	0_2_02F8D580
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_02F57B71	0_2_02F57B71
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_02F939A3	0_2_02F939A3
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_02F85980	0_2_02F85980
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_02F57F80	0_2_02F57F80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0040E855	4_2_0040E855
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_004010C8	4_2_004010C8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_004010D0	4_2_004010D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0042F1D3	4_2_0042F1D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_004029F8	4_2_004029F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_00402A00	4_2_00402A00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_004032D0	4_2_004032D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0041040A	4_2_0041040A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_00410413	4_2_00410413
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_00401500	4_2_00401500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_00416DA3	4_2_00416DA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0040E643	4_2_0040E643
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_00410633	4_2_00410633
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_004026F0	4_2_004026F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0040E788	4_2_0040E788
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_0040E793	4_2_0040E793
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03C003E6	4_2_03C003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B4E3F0	4_2_03B4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BFA352	4_2_03BFA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BC02C0	4_2_03BC02C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BE0274	4_2_03BE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BF41A2	4_2_03BF41A2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03C001AA	4_2_03C001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BF81CC	4_2_03BF81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BDA118	4_2_03BDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B30100	4_2_03B30100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BC8158	4_2_03BC8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BD2000	4_2_03BD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B3C7C0	4_2_03B3C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B40770	4_2_03B40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B64750	4_2_03B64750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B5C6E0	4_2_03B5C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03C00591	4_2_03C00591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B40535	4_2_03B40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BEE4F6	4_2_03BEE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BE4420	4_2_03BE4420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BF2446	4_2_03BF2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BF6BD7	4_2_03BF6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BFAB40	4_2_03BFAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B3EA80	4_2_03B3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B429A0	4_2_03B429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03C0A9A6	4_2_03C0A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B56962	4_2_03B56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B268B8	4_2_03B268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B6E8F0	4_2_03B6E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B4A840	4_2_03B4A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B42840	4_2_03B42840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BBEFA0	4_2_03BBEFA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B4CFE0	4_2_03B4CFE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B32FC8	4_2_03B32FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B60F30	4_2_03B60F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BE2F30	4_2_03BE2F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B82F28	4_2_03B82F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB4F40	4_2_03BB4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B52E90	4_2_03B52E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BFCE93	4_2_03BFCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BFEEDB	4_2_03BFEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BFEE26	4_2_03BFEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B40E59	4_2_03B40E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B58DBF	4_2_03B58DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B3ADE0	4_2_03B3ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BDCD1F	4_2_03BDCD1F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B4AD00	4_2_03B4AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BE0CB5	4_2_03BE0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B30CF2	4_2_03B30CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B40C00	4_2_03B40C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B8739A	4_2_03B8739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BF132D	4_2_03BF132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B2D34C	4_2_03B2D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B452A0	4_2_03B452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BE12ED	4_2_03BE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B5B2C0	4_2_03B5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B4B1B0	4_2_03B4B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03C0B16B	4_2_03C0B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B2F172	4_2_03B2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B7516C	4_2_03B7516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BF70E9	4_2_03BF70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BFF0E0	4_2_03BFF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BEF0CC	4_2_03BEF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B470C0	4_2_03B470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BFF7B0	4_2_03BFF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BF16CC	4_2_03BF16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B85630	4_2_03B85630
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03C095C3	4_2_03C095C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BDD5B0	4_2_03BDD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BF7571	4_2_03BF7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BFF43F	4_2_03BFF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B31460	4_2_03B31460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B5FB80	4_2_03B5FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB5BF0	4_2_03BB5BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B7DBF9	4_2_03B7DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BFFB76	4_2_03BFFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BDDAAC	4_2_03BDDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B85AA0	4_2_03B85AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BE1AA3	4_2_03BE1AA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BEDAC6	4_2_03BEDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB3A6C	4_2_03BB3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BFFA49	4_2_03BFFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BF7A46	4_2_03BF7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BD5910	4_2_03BD5910
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B49950	4_2_03B49950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B5B950	4_2_03B5B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B438E0	4_2_03B438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BAD800	4_2_03BAD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BFFFB1	4_2_03BFFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B41F92	4_2_03B41F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B03FD2	4_2_03B03FD2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B03FD5	4_2_03B03FD5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BFFF09	4_2_03BFFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B49EB0	4_2_03B49EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B5FDC0	4_2_03B5FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BF7D73	4_2_03BF7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BF1D5A	4_2_03BF1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B43D40	4_2_03B43D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BFFCF2	4_2_03BFFCF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB9C32	4_2_03BB9C32

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: String function: 00407DE1 appears 35 times
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: String function: 00428900 appears 41 times
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: String function: 00420AE3 appears 70 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03B75130 appears 58 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03BBF290 appears 105 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03BAEA12 appears 86 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03B2B970 appears 280 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03B87E54 appears 111 times

Source: LiuUGJK9vH.exe, 00000000.00000003.1466548663.00000000041D3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs LiuUGJK9vH.exe
Source: LiuUGJK9vH.exe, 00000000.00000003.1459690952.0000000003EF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamearmsvc.exeN vs LiuUGJK9vH.exe
Source: LiuUGJK9vH.exe, 00000000.00000003.1478595540.0000000004E9D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs LiuUGJK9vH.exe
Source: LiuUGJK9vH.exe, 00000000.00000003.1463774651.0000000003EF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameALG.exej% vs LiuUGJK9vH.exe

Source: unknown

Driver loaded: C:\Windows\System32\drivers\AppVStrm.sys

Source: LiuUGJK9vH.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: LiuUGJK9vH.exe	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: armsvc.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: alg.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AppVClient.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: DiagnosticsHub.StandardCollector.Service.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: LiuUGJK9vH.exe	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: armsvc.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: alg.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AppVClient.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: DiagnosticsHub.StandardCollector.Service.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: classification engine

Classification label: mal100.spre.troj.evad.winEXE@6/10@2/2

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe

Code function: 0_2_0046A06A GetLastError,FormatMessageW,

0_2_0046A06A

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_004581CB AdjustTokenPrivileges,CloseHandle,		0_2_004581CB
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_004587E1 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_004587E1

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe

Code function: 0_2_0046B333 SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_0046B333

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe

Code function: 0_2_0047EE0D CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_0047EE0D

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe

Code function: 0_2_0046C397 CoInitialize,CoCreateInstance,CoUninitialize,

0_2_0046C397

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe

Code function: 0_2_00404E89 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00404E89

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe

Code function: 0_2_02F7CBD0 StrStrIW,CloseHandle,StrStrIW,CloseServiceHandle,OpenServiceW,StrStrIW,_wcslen,ChangeServiceConfigW,StrStrIW,StrStrIW,CloseServiceHandle,CloseHandle,StartServiceW,

0_2_02F7CBD0

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe

File created: C:\Users\user\AppData\Roaming\a49546759c90d829.bin

Source: C:\Windows\System32\AppVClient.exe	Mutant created: \BaseNamedObjects\Global\Multiarch.m0yv-a49546759c90d8299ea72c54-b
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\Multiarch.m0yv-a49546759c90d8293d78ffaf-b
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\Multiarch.m0yv-a49546759c90d829-inf

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe

File created: C:\Users\user\AppData\Local\Temp\autC621.tmp

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: LiuUGJK9vH.exe

ReversingLabs: Detection: 91%

Source: unknown	Process created: C:\Users\user\Desktop\LiuUGJK9vH.exe "C:\Users\user\Desktop\LiuUGJK9vH.exe"
Source: unknown	Process created: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
Source: unknown	Process created: C:\Windows\System32\alg.exe C:\Windows\System32\alg.exe
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\LiuUGJK9vH.exe"
Source: unknown	Process created: C:\Windows\System32\AppVClient.exe C:\Windows\system32\AppVClient.exe
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\LiuUGJK9vH.exe"	Jump to behavior

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: appvpolicy.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: appmanagementconfiguration.dll	Jump to behavior

Source: C:\Windows\System32\AppVClient.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{52BC3999-6E52-4E8A-87C4-0A2A0CC359B1}\InProcServer32

Creates files in the system32 config directory

Source: LiuUGJK9vH.exe

Static file information: File size 1761792 > 1048576

Source: LiuUGJK9vH.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\DCB\CBT_Main\BuildResults\bin\Win32\Release\armsvc.pdb source: LiuUGJK9vH.exe, 00000000.00000003.1459636308.0000000003EF0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe.0.dr
Source:	Binary string: DiagnosticsHub.StandardCollector.Service.pdb source: DiagnosticsHub.StandardCollector.Service.exe.0.dr
Source:	Binary string: AppVClient.pdbGCTL source: AppVClient.exe.0.dr
Source:	Binary string: ALG.pdbGCTL source: LiuUGJK9vH.exe, 00000000.00000003.1463706750.0000000003EF0000.00000004.00001000.00020000.00000000.sdmp, alg.exe.0.dr
Source:	Binary string: AppVClient.pdb source: AppVClient.exe.0.dr
Source:	Binary string: DiagnosticsHub.StandardCollector.Service.pdbGCTL source: DiagnosticsHub.StandardCollector.Service.exe.0.dr
Source:	Binary string: wntdll.pdbUGP source: LiuUGJK9vH.exe, 00000000.00000003.1466769088.0000000004250000.00000004.00001000.00020000.00000000.sdmp, LiuUGJK9vH.exe, 00000000.00000003.1472318667.0000000004250000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1751681677.0000000003900000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1793138117.0000000003B00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1749096738.0000000003700000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1793138117.0000000003C9E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: LiuUGJK9vH.exe, 00000000.00000003.1466769088.0000000004250000.00000004.00001000.00020000.00000000.sdmp, LiuUGJK9vH.exe, 00000000.00000003.1472318667.0000000004250000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000004.00000003.1751681677.0000000003900000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1793138117.0000000003B00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1749096738.0000000003700000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1793138117.0000000003C9E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: ALG.pdb source: LiuUGJK9vH.exe, 00000000.00000003.1463706750.0000000003EF0000.00000004.00001000.00020000.00000000.sdmp, alg.exe.0.dr

Source: alg.exe.0.dr

Static PE information: 0xF67E8745 [Tue Jan 18 10:28:21 2101 UTC]

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe

Code function: 0_2_00404B37 LoadLibraryA,GetProcAddress,

0_2_00404B37

Source: DiagnosticsHub.StandardCollector.Service.exe.0.dr

Static PE information: real checksum: 0x1fb4b should be: 0x19172d

Source: armsvc.exe.0.dr	Static PE information: section name: .didat
Source: alg.exe.0.dr	Static PE information: section name: .didat

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_00428945 push ecx; ret	0_2_00428958
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_00402F12 push es; retf	0_2_00402F13
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_02F5520C push 02F5528Fh; ret	0_2_02F5522D
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_02F5B180 push 02F5B0CAh; ret	0_2_02F5B061
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_02F5B180 push 02F5B30Dh; ret	0_2_02F5B1E6
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_02F5B180 push 02F5B2F2h; ret	0_2_02F5B262
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_02F5B180 push 02F5B255h; ret	0_2_02F5B2ED
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_02F5B180 push 02F5B2D0h; ret	0_2_02F5B346
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_02F5B180 push 02F5B37Fh; ret	0_2_02F5B3B7
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_02F78550 push 02F7852Eh; ret	0_2_02F77F3A
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_02F78550 push 02F78514h; ret	0_2_02F77F66
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_02F78550 push 02F77E66h; ret	0_2_02F78057
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_02F78550 push 02F7817Ah; ret	0_2_02F7808B
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_02F78550 push 02F782E5h; ret	0_2_02F780D9
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_02F78550 push 02F7826Ah; ret	0_2_02F7819E
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_02F78550 push 02F7849Ch; ret	0_2_02F781E4
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_02F78550 push 02F78321h; ret	0_2_02F782E0
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_02F78550 push 02F77FBFh; ret	0_2_02F7831F
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_02F78550 push 02F77FA8h; ret	0_2_02F7834C
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_02F78550 push 02F784BAh; ret	0_2_02F783E2
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_02F78550 push 02F78426h; ret	0_2_02F784D8
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_02F78550 push 02F78075h; ret	0_2_02F784FD
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_02F78550 push 02F7808Ch; ret	0_2_02F78512
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_02F78550 push 02F78D45h; ret	0_2_02F787D3
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_02F78550 push 02F78AB5h; ret	0_2_02F78B13
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_02F78550 push 02F78784h; ret	0_2_02F78CA1
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_02F78550 push 02F78DC9h; ret	0_2_02F78E1C
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_02F78550 push 02F78D14h; ret	0_2_02F78E2E
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_02F78550 push 02F78674h; ret	0_2_02F78E4D
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_02F78550 push 02F788A6h; ret	0_2_02F78F76
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_02F78550 push 02F7868Ch; ret	0_2_02F78FA4

Source: LiuUGJK9vH.exe	Static PE information: section name: .reloc entropy: 7.938033667934618
Source: AppVClient.exe.0.dr	Static PE information: section name: .reloc entropy: 7.94301967209562

Persistence and Installation Behavior

Source: C:\Windows\System32\AppVClient.exe

File created: C:\Windows\system32\config\systemprofile\AppData\Roaming\a49546759c90d829.bin

Drops executable to a common third party application directory

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	System file written: C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	Jump to behavior
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	System file written: C:\Windows\System32\AppVClient.exe	Jump to behavior
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	System file written: C:\Windows\System32\alg.exe	Jump to behavior

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	File created: C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	File created: C:\Windows\System32\AppVClient.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	File created: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	File created: C:\Windows\System32\alg.exe	Jump to dropped file

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	File created: C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	File created: C:\Windows\System32\AppVClient.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	File created: C:\Windows\System32\alg.exe	Jump to dropped file

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe

Code function: 0_2_02F7CBD0 StrStrIW,CloseHandle,StrStrIW,CloseServiceHandle,OpenServiceW,StrStrIW,_wcslen,ChangeServiceConfigW,StrStrIW,StrStrIW,CloseServiceHandle,CloseHandle,StartServiceW,

0_2_02F7CBD0

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_004048D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_004048D7
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_00485376 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00485376

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe

Code function: 0_2_00423187 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00423187

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe

API/Special instruction interceptor: Address: BA520C

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 4_2_03B7096E rdtsc

4_2_03B7096E

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe

Dropped PE file which has not been started: C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

Jump to dropped file

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-110178

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	API coverage: 5.1 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.6 %

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe TID: 2868	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 1996	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_0046445A GetFileAttributesW,FindFirstFileW,FindClose,	0_2_0046445A
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_0046C6D1 FindFirstFileW,FindClose,	0_2_0046C6D1
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_0046C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_0046C75C
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_0046EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0046EF95
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_0046F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0046F0F2
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_0046F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0046F3F3
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_004637EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_004637EF
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_00463B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00463B12
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_0046BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0046BCBC

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe

Code function: 0_2_004049A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_004049A0

Source: AppVClient.exe, 00000008.00000003.1475204828.0000000000599000.00000004.00000020.00020000.00000000.sdmp, AppVClient.exe, 00000008.00000002.1481720566.00000000005B0000.00000004.00000020.00020000.00000000.sdmp, AppVClient.exe, 00000008.00000003.1474643358.0000000000591000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: appv:SoftwareClients/appv:JavaVirtualMachineI
Source: LiuUGJK9vH.exe, 00000000.00000002.1480829576.0000000000BA6000.00000004.00000020.00020000.00000000.sdmp, LiuUGJK9vH.exe, 00000000.00000002.1480829576.0000000000BDA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe

API call chain: ExitProcess graph end node

graph_0-108733

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Source: C:\Windows\SysWOW64\svchost.exe

Process queried: DebugPort

Maps a DLL or memory area into another process

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 4_2_03B7096E rdtsc

4_2_03B7096E

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 4_2_00417D33 LdrLoadDll,

4_2_00417D33

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe

Code function: 0_2_00473F09 BlockInput,

0_2_00473F09

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe

Code function: 0_2_00403B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00403B3A

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe

Code function: 0_2_00435A7C EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00435A7C

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe

Code function: 0_2_00404B37 LoadLibraryA,GetProcAddress,

0_2_00404B37

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_0056C594 mov eax, dword ptr fs:[00000030h]	0_2_0056C594
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_00BA54D8 mov eax, dword ptr fs:[00000030h]	0_2_00BA54D8
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_00BA5478 mov eax, dword ptr fs:[00000030h]	0_2_00BA5478
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_00BA3E58 mov eax, dword ptr fs:[00000030h]	0_2_00BA3E58
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_02F51130 mov eax, dword ptr fs:[00000030h]	0_2_02F51130
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_02F93F3D mov eax, dword ptr fs:[00000030h]	0_2_02F93F3D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B28397 mov eax, dword ptr fs:[00000030h]	4_2_03B28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B28397 mov eax, dword ptr fs:[00000030h]	4_2_03B28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B28397 mov eax, dword ptr fs:[00000030h]	4_2_03B28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B2E388 mov eax, dword ptr fs:[00000030h]	4_2_03B2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B2E388 mov eax, dword ptr fs:[00000030h]	4_2_03B2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B2E388 mov eax, dword ptr fs:[00000030h]	4_2_03B2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B5438F mov eax, dword ptr fs:[00000030h]	4_2_03B5438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B5438F mov eax, dword ptr fs:[00000030h]	4_2_03B5438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B4E3F0 mov eax, dword ptr fs:[00000030h]	4_2_03B4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B4E3F0 mov eax, dword ptr fs:[00000030h]	4_2_03B4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B4E3F0 mov eax, dword ptr fs:[00000030h]	4_2_03B4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B663FF mov eax, dword ptr fs:[00000030h]	4_2_03B663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B403E9 mov eax, dword ptr fs:[00000030h]	4_2_03B403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B403E9 mov eax, dword ptr fs:[00000030h]	4_2_03B403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B403E9 mov eax, dword ptr fs:[00000030h]	4_2_03B403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B403E9 mov eax, dword ptr fs:[00000030h]	4_2_03B403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B403E9 mov eax, dword ptr fs:[00000030h]	4_2_03B403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B403E9 mov eax, dword ptr fs:[00000030h]	4_2_03B403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B403E9 mov eax, dword ptr fs:[00000030h]	4_2_03B403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B403E9 mov eax, dword ptr fs:[00000030h]	4_2_03B403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BDE3DB mov eax, dword ptr fs:[00000030h]	4_2_03BDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BDE3DB mov eax, dword ptr fs:[00000030h]	4_2_03BDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BDE3DB mov ecx, dword ptr fs:[00000030h]	4_2_03BDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BDE3DB mov eax, dword ptr fs:[00000030h]	4_2_03BDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BD43D4 mov eax, dword ptr fs:[00000030h]	4_2_03BD43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BD43D4 mov eax, dword ptr fs:[00000030h]	4_2_03BD43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BEC3CD mov eax, dword ptr fs:[00000030h]	4_2_03BEC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B3A3C0 mov eax, dword ptr fs:[00000030h]	4_2_03B3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B3A3C0 mov eax, dword ptr fs:[00000030h]	4_2_03B3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B3A3C0 mov eax, dword ptr fs:[00000030h]	4_2_03B3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B3A3C0 mov eax, dword ptr fs:[00000030h]	4_2_03B3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B3A3C0 mov eax, dword ptr fs:[00000030h]	4_2_03B3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B3A3C0 mov eax, dword ptr fs:[00000030h]	4_2_03B3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B383C0 mov eax, dword ptr fs:[00000030h]	4_2_03B383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B383C0 mov eax, dword ptr fs:[00000030h]	4_2_03B383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B383C0 mov eax, dword ptr fs:[00000030h]	4_2_03B383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B383C0 mov eax, dword ptr fs:[00000030h]	4_2_03B383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB63C0 mov eax, dword ptr fs:[00000030h]	4_2_03BB63C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03C0634F mov eax, dword ptr fs:[00000030h]	4_2_03C0634F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B2C310 mov ecx, dword ptr fs:[00000030h]	4_2_03B2C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B50310 mov ecx, dword ptr fs:[00000030h]	4_2_03B50310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B6A30B mov eax, dword ptr fs:[00000030h]	4_2_03B6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B6A30B mov eax, dword ptr fs:[00000030h]	4_2_03B6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B6A30B mov eax, dword ptr fs:[00000030h]	4_2_03B6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BD437C mov eax, dword ptr fs:[00000030h]	4_2_03BD437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03C08324 mov eax, dword ptr fs:[00000030h]	4_2_03C08324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03C08324 mov ecx, dword ptr fs:[00000030h]	4_2_03C08324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03C08324 mov eax, dword ptr fs:[00000030h]	4_2_03C08324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03C08324 mov eax, dword ptr fs:[00000030h]	4_2_03C08324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB035C mov eax, dword ptr fs:[00000030h]	4_2_03BB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB035C mov eax, dword ptr fs:[00000030h]	4_2_03BB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB035C mov eax, dword ptr fs:[00000030h]	4_2_03BB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB035C mov ecx, dword ptr fs:[00000030h]	4_2_03BB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB035C mov eax, dword ptr fs:[00000030h]	4_2_03BB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB035C mov eax, dword ptr fs:[00000030h]	4_2_03BB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BFA352 mov eax, dword ptr fs:[00000030h]	4_2_03BFA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BD8350 mov ecx, dword ptr fs:[00000030h]	4_2_03BD8350
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB2349 mov eax, dword ptr fs:[00000030h]	4_2_03BB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB2349 mov eax, dword ptr fs:[00000030h]	4_2_03BB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB2349 mov eax, dword ptr fs:[00000030h]	4_2_03BB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB2349 mov eax, dword ptr fs:[00000030h]	4_2_03BB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB2349 mov eax, dword ptr fs:[00000030h]	4_2_03BB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB2349 mov eax, dword ptr fs:[00000030h]	4_2_03BB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB2349 mov eax, dword ptr fs:[00000030h]	4_2_03BB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB2349 mov eax, dword ptr fs:[00000030h]	4_2_03BB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB2349 mov eax, dword ptr fs:[00000030h]	4_2_03BB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB2349 mov eax, dword ptr fs:[00000030h]	4_2_03BB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB2349 mov eax, dword ptr fs:[00000030h]	4_2_03BB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB2349 mov eax, dword ptr fs:[00000030h]	4_2_03BB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB2349 mov eax, dword ptr fs:[00000030h]	4_2_03BB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB2349 mov eax, dword ptr fs:[00000030h]	4_2_03BB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB2349 mov eax, dword ptr fs:[00000030h]	4_2_03BB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B402A0 mov eax, dword ptr fs:[00000030h]	4_2_03B402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B402A0 mov eax, dword ptr fs:[00000030h]	4_2_03B402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03C062D6 mov eax, dword ptr fs:[00000030h]	4_2_03C062D6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BC62A0 mov eax, dword ptr fs:[00000030h]	4_2_03BC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BC62A0 mov ecx, dword ptr fs:[00000030h]	4_2_03BC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BC62A0 mov eax, dword ptr fs:[00000030h]	4_2_03BC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BC62A0 mov eax, dword ptr fs:[00000030h]	4_2_03BC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BC62A0 mov eax, dword ptr fs:[00000030h]	4_2_03BC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BC62A0 mov eax, dword ptr fs:[00000030h]	4_2_03BC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B6E284 mov eax, dword ptr fs:[00000030h]	4_2_03B6E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B6E284 mov eax, dword ptr fs:[00000030h]	4_2_03B6E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB0283 mov eax, dword ptr fs:[00000030h]	4_2_03BB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB0283 mov eax, dword ptr fs:[00000030h]	4_2_03BB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB0283 mov eax, dword ptr fs:[00000030h]	4_2_03BB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B402E1 mov eax, dword ptr fs:[00000030h]	4_2_03B402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B402E1 mov eax, dword ptr fs:[00000030h]	4_2_03B402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B402E1 mov eax, dword ptr fs:[00000030h]	4_2_03B402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B3A2C3 mov eax, dword ptr fs:[00000030h]	4_2_03B3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B3A2C3 mov eax, dword ptr fs:[00000030h]	4_2_03B3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B3A2C3 mov eax, dword ptr fs:[00000030h]	4_2_03B3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B3A2C3 mov eax, dword ptr fs:[00000030h]	4_2_03B3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B3A2C3 mov eax, dword ptr fs:[00000030h]	4_2_03B3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B2823B mov eax, dword ptr fs:[00000030h]	4_2_03B2823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03C0625D mov eax, dword ptr fs:[00000030h]	4_2_03C0625D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BE0274 mov eax, dword ptr fs:[00000030h]	4_2_03BE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BE0274 mov eax, dword ptr fs:[00000030h]	4_2_03BE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BE0274 mov eax, dword ptr fs:[00000030h]	4_2_03BE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BE0274 mov eax, dword ptr fs:[00000030h]	4_2_03BE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BE0274 mov eax, dword ptr fs:[00000030h]	4_2_03BE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BE0274 mov eax, dword ptr fs:[00000030h]	4_2_03BE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BE0274 mov eax, dword ptr fs:[00000030h]	4_2_03BE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BE0274 mov eax, dword ptr fs:[00000030h]	4_2_03BE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BE0274 mov eax, dword ptr fs:[00000030h]	4_2_03BE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BE0274 mov eax, dword ptr fs:[00000030h]	4_2_03BE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BE0274 mov eax, dword ptr fs:[00000030h]	4_2_03BE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BE0274 mov eax, dword ptr fs:[00000030h]	4_2_03BE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B34260 mov eax, dword ptr fs:[00000030h]	4_2_03B34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B34260 mov eax, dword ptr fs:[00000030h]	4_2_03B34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B34260 mov eax, dword ptr fs:[00000030h]	4_2_03B34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B2826B mov eax, dword ptr fs:[00000030h]	4_2_03B2826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B2A250 mov eax, dword ptr fs:[00000030h]	4_2_03B2A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B36259 mov eax, dword ptr fs:[00000030h]	4_2_03B36259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BEA250 mov eax, dword ptr fs:[00000030h]	4_2_03BEA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BEA250 mov eax, dword ptr fs:[00000030h]	4_2_03BEA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB8243 mov eax, dword ptr fs:[00000030h]	4_2_03BB8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB8243 mov ecx, dword ptr fs:[00000030h]	4_2_03BB8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB019F mov eax, dword ptr fs:[00000030h]	4_2_03BB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB019F mov eax, dword ptr fs:[00000030h]	4_2_03BB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB019F mov eax, dword ptr fs:[00000030h]	4_2_03BB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB019F mov eax, dword ptr fs:[00000030h]	4_2_03BB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B2A197 mov eax, dword ptr fs:[00000030h]	4_2_03B2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B2A197 mov eax, dword ptr fs:[00000030h]	4_2_03B2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B2A197 mov eax, dword ptr fs:[00000030h]	4_2_03B2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03C061E5 mov eax, dword ptr fs:[00000030h]	4_2_03C061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B70185 mov eax, dword ptr fs:[00000030h]	4_2_03B70185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BEC188 mov eax, dword ptr fs:[00000030h]	4_2_03BEC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BEC188 mov eax, dword ptr fs:[00000030h]	4_2_03BEC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BD4180 mov eax, dword ptr fs:[00000030h]	4_2_03BD4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BD4180 mov eax, dword ptr fs:[00000030h]	4_2_03BD4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B601F8 mov eax, dword ptr fs:[00000030h]	4_2_03B601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BAE1D0 mov eax, dword ptr fs:[00000030h]	4_2_03BAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BAE1D0 mov eax, dword ptr fs:[00000030h]	4_2_03BAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BAE1D0 mov ecx, dword ptr fs:[00000030h]	4_2_03BAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BAE1D0 mov eax, dword ptr fs:[00000030h]	4_2_03BAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BAE1D0 mov eax, dword ptr fs:[00000030h]	4_2_03BAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BF61C3 mov eax, dword ptr fs:[00000030h]	4_2_03BF61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BF61C3 mov eax, dword ptr fs:[00000030h]	4_2_03BF61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B60124 mov eax, dword ptr fs:[00000030h]	4_2_03B60124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03C04164 mov eax, dword ptr fs:[00000030h]	4_2_03C04164
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03C04164 mov eax, dword ptr fs:[00000030h]	4_2_03C04164
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BDA118 mov ecx, dword ptr fs:[00000030h]	4_2_03BDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BDA118 mov eax, dword ptr fs:[00000030h]	4_2_03BDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BDA118 mov eax, dword ptr fs:[00000030h]	4_2_03BDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BDA118 mov eax, dword ptr fs:[00000030h]	4_2_03BDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BF0115 mov eax, dword ptr fs:[00000030h]	4_2_03BF0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BDE10E mov eax, dword ptr fs:[00000030h]	4_2_03BDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BDE10E mov ecx, dword ptr fs:[00000030h]	4_2_03BDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BDE10E mov eax, dword ptr fs:[00000030h]	4_2_03BDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BDE10E mov eax, dword ptr fs:[00000030h]	4_2_03BDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BDE10E mov ecx, dword ptr fs:[00000030h]	4_2_03BDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BDE10E mov eax, dword ptr fs:[00000030h]	4_2_03BDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BDE10E mov eax, dword ptr fs:[00000030h]	4_2_03BDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BDE10E mov ecx, dword ptr fs:[00000030h]	4_2_03BDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BDE10E mov eax, dword ptr fs:[00000030h]	4_2_03BDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BDE10E mov ecx, dword ptr fs:[00000030h]	4_2_03BDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B2C156 mov eax, dword ptr fs:[00000030h]	4_2_03B2C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BC8158 mov eax, dword ptr fs:[00000030h]	4_2_03BC8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B36154 mov eax, dword ptr fs:[00000030h]	4_2_03B36154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B36154 mov eax, dword ptr fs:[00000030h]	4_2_03B36154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BC4144 mov eax, dword ptr fs:[00000030h]	4_2_03BC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BC4144 mov eax, dword ptr fs:[00000030h]	4_2_03BC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BC4144 mov ecx, dword ptr fs:[00000030h]	4_2_03BC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BC4144 mov eax, dword ptr fs:[00000030h]	4_2_03BC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BC4144 mov eax, dword ptr fs:[00000030h]	4_2_03BC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BF60B8 mov eax, dword ptr fs:[00000030h]	4_2_03BF60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BF60B8 mov ecx, dword ptr fs:[00000030h]	4_2_03BF60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B280A0 mov eax, dword ptr fs:[00000030h]	4_2_03B280A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BC80A8 mov eax, dword ptr fs:[00000030h]	4_2_03BC80A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B3208A mov eax, dword ptr fs:[00000030h]	4_2_03B3208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B2C0F0 mov eax, dword ptr fs:[00000030h]	4_2_03B2C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B720F0 mov ecx, dword ptr fs:[00000030h]	4_2_03B720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B2A0E3 mov ecx, dword ptr fs:[00000030h]	4_2_03B2A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B380E9 mov eax, dword ptr fs:[00000030h]	4_2_03B380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB60E0 mov eax, dword ptr fs:[00000030h]	4_2_03BB60E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB20DE mov eax, dword ptr fs:[00000030h]	4_2_03BB20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BC6030 mov eax, dword ptr fs:[00000030h]	4_2_03BC6030
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B2A020 mov eax, dword ptr fs:[00000030h]	4_2_03B2A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B2C020 mov eax, dword ptr fs:[00000030h]	4_2_03B2C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B4E016 mov eax, dword ptr fs:[00000030h]	4_2_03B4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B4E016 mov eax, dword ptr fs:[00000030h]	4_2_03B4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B4E016 mov eax, dword ptr fs:[00000030h]	4_2_03B4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B4E016 mov eax, dword ptr fs:[00000030h]	4_2_03B4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB4000 mov ecx, dword ptr fs:[00000030h]	4_2_03BB4000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BD2000 mov eax, dword ptr fs:[00000030h]	4_2_03BD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BD2000 mov eax, dword ptr fs:[00000030h]	4_2_03BD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BD2000 mov eax, dword ptr fs:[00000030h]	4_2_03BD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BD2000 mov eax, dword ptr fs:[00000030h]	4_2_03BD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BD2000 mov eax, dword ptr fs:[00000030h]	4_2_03BD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BD2000 mov eax, dword ptr fs:[00000030h]	4_2_03BD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BD2000 mov eax, dword ptr fs:[00000030h]	4_2_03BD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BD2000 mov eax, dword ptr fs:[00000030h]	4_2_03BD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B5C073 mov eax, dword ptr fs:[00000030h]	4_2_03B5C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B32050 mov eax, dword ptr fs:[00000030h]	4_2_03B32050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB6050 mov eax, dword ptr fs:[00000030h]	4_2_03BB6050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B307AF mov eax, dword ptr fs:[00000030h]	4_2_03B307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BE47A0 mov eax, dword ptr fs:[00000030h]	4_2_03BE47A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BD678E mov eax, dword ptr fs:[00000030h]	4_2_03BD678E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B347FB mov eax, dword ptr fs:[00000030h]	4_2_03B347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B347FB mov eax, dword ptr fs:[00000030h]	4_2_03B347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B527ED mov eax, dword ptr fs:[00000030h]	4_2_03B527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B527ED mov eax, dword ptr fs:[00000030h]	4_2_03B527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B527ED mov eax, dword ptr fs:[00000030h]	4_2_03B527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BBE7E1 mov eax, dword ptr fs:[00000030h]	4_2_03BBE7E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B3C7C0 mov eax, dword ptr fs:[00000030h]	4_2_03B3C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB07C3 mov eax, dword ptr fs:[00000030h]	4_2_03BB07C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B6273C mov eax, dword ptr fs:[00000030h]	4_2_03B6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B6273C mov ecx, dword ptr fs:[00000030h]	4_2_03B6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B6273C mov eax, dword ptr fs:[00000030h]	4_2_03B6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BAC730 mov eax, dword ptr fs:[00000030h]	4_2_03BAC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B6C720 mov eax, dword ptr fs:[00000030h]	4_2_03B6C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B6C720 mov eax, dword ptr fs:[00000030h]	4_2_03B6C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B30710 mov eax, dword ptr fs:[00000030h]	4_2_03B30710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B60710 mov eax, dword ptr fs:[00000030h]	4_2_03B60710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B6C700 mov eax, dword ptr fs:[00000030h]	4_2_03B6C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B38770 mov eax, dword ptr fs:[00000030h]	4_2_03B38770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B40770 mov eax, dword ptr fs:[00000030h]	4_2_03B40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B40770 mov eax, dword ptr fs:[00000030h]	4_2_03B40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B40770 mov eax, dword ptr fs:[00000030h]	4_2_03B40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B40770 mov eax, dword ptr fs:[00000030h]	4_2_03B40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B40770 mov eax, dword ptr fs:[00000030h]	4_2_03B40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B40770 mov eax, dword ptr fs:[00000030h]	4_2_03B40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B40770 mov eax, dword ptr fs:[00000030h]	4_2_03B40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B40770 mov eax, dword ptr fs:[00000030h]	4_2_03B40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B40770 mov eax, dword ptr fs:[00000030h]	4_2_03B40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B40770 mov eax, dword ptr fs:[00000030h]	4_2_03B40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B40770 mov eax, dword ptr fs:[00000030h]	4_2_03B40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B40770 mov eax, dword ptr fs:[00000030h]	4_2_03B40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B30750 mov eax, dword ptr fs:[00000030h]	4_2_03B30750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BBE75D mov eax, dword ptr fs:[00000030h]	4_2_03BBE75D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B72750 mov eax, dword ptr fs:[00000030h]	4_2_03B72750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B72750 mov eax, dword ptr fs:[00000030h]	4_2_03B72750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB4755 mov eax, dword ptr fs:[00000030h]	4_2_03BB4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B6674D mov esi, dword ptr fs:[00000030h]	4_2_03B6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B6674D mov eax, dword ptr fs:[00000030h]	4_2_03B6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B6674D mov eax, dword ptr fs:[00000030h]	4_2_03B6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B666B0 mov eax, dword ptr fs:[00000030h]	4_2_03B666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B6C6A6 mov eax, dword ptr fs:[00000030h]	4_2_03B6C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B34690 mov eax, dword ptr fs:[00000030h]	4_2_03B34690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B34690 mov eax, dword ptr fs:[00000030h]	4_2_03B34690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BAE6F2 mov eax, dword ptr fs:[00000030h]	4_2_03BAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BAE6F2 mov eax, dword ptr fs:[00000030h]	4_2_03BAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BAE6F2 mov eax, dword ptr fs:[00000030h]	4_2_03BAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BAE6F2 mov eax, dword ptr fs:[00000030h]	4_2_03BAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB06F1 mov eax, dword ptr fs:[00000030h]	4_2_03BB06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB06F1 mov eax, dword ptr fs:[00000030h]	4_2_03BB06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B6A6C7 mov ebx, dword ptr fs:[00000030h]	4_2_03B6A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B6A6C7 mov eax, dword ptr fs:[00000030h]	4_2_03B6A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B4E627 mov eax, dword ptr fs:[00000030h]	4_2_03B4E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B66620 mov eax, dword ptr fs:[00000030h]	4_2_03B66620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B68620 mov eax, dword ptr fs:[00000030h]	4_2_03B68620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B3262C mov eax, dword ptr fs:[00000030h]	4_2_03B3262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B72619 mov eax, dword ptr fs:[00000030h]	4_2_03B72619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BAE609 mov eax, dword ptr fs:[00000030h]	4_2_03BAE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B4260B mov eax, dword ptr fs:[00000030h]	4_2_03B4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B4260B mov eax, dword ptr fs:[00000030h]	4_2_03B4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B4260B mov eax, dword ptr fs:[00000030h]	4_2_03B4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B4260B mov eax, dword ptr fs:[00000030h]	4_2_03B4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B4260B mov eax, dword ptr fs:[00000030h]	4_2_03B4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B4260B mov eax, dword ptr fs:[00000030h]	4_2_03B4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B4260B mov eax, dword ptr fs:[00000030h]	4_2_03B4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B62674 mov eax, dword ptr fs:[00000030h]	4_2_03B62674
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BF866E mov eax, dword ptr fs:[00000030h]	4_2_03BF866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BF866E mov eax, dword ptr fs:[00000030h]	4_2_03BF866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B6A660 mov eax, dword ptr fs:[00000030h]	4_2_03B6A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B6A660 mov eax, dword ptr fs:[00000030h]	4_2_03B6A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B4C640 mov eax, dword ptr fs:[00000030h]	4_2_03B4C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B545B1 mov eax, dword ptr fs:[00000030h]	4_2_03B545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B545B1 mov eax, dword ptr fs:[00000030h]	4_2_03B545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB05A7 mov eax, dword ptr fs:[00000030h]	4_2_03BB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB05A7 mov eax, dword ptr fs:[00000030h]	4_2_03BB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB05A7 mov eax, dword ptr fs:[00000030h]	4_2_03BB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B6E59C mov eax, dword ptr fs:[00000030h]	4_2_03B6E59C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B32582 mov eax, dword ptr fs:[00000030h]	4_2_03B32582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B32582 mov ecx, dword ptr fs:[00000030h]	4_2_03B32582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B64588 mov eax, dword ptr fs:[00000030h]	4_2_03B64588
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B5E5E7 mov eax, dword ptr fs:[00000030h]	4_2_03B5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B5E5E7 mov eax, dword ptr fs:[00000030h]	4_2_03B5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B5E5E7 mov eax, dword ptr fs:[00000030h]	4_2_03B5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B5E5E7 mov eax, dword ptr fs:[00000030h]	4_2_03B5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B5E5E7 mov eax, dword ptr fs:[00000030h]	4_2_03B5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B5E5E7 mov eax, dword ptr fs:[00000030h]	4_2_03B5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B5E5E7 mov eax, dword ptr fs:[00000030h]	4_2_03B5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B5E5E7 mov eax, dword ptr fs:[00000030h]	4_2_03B5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B325E0 mov eax, dword ptr fs:[00000030h]	4_2_03B325E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B6C5ED mov eax, dword ptr fs:[00000030h]	4_2_03B6C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B6C5ED mov eax, dword ptr fs:[00000030h]	4_2_03B6C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B365D0 mov eax, dword ptr fs:[00000030h]	4_2_03B365D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B6A5D0 mov eax, dword ptr fs:[00000030h]	4_2_03B6A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B6A5D0 mov eax, dword ptr fs:[00000030h]	4_2_03B6A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B6E5CF mov eax, dword ptr fs:[00000030h]	4_2_03B6E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B6E5CF mov eax, dword ptr fs:[00000030h]	4_2_03B6E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B40535 mov eax, dword ptr fs:[00000030h]	4_2_03B40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B40535 mov eax, dword ptr fs:[00000030h]	4_2_03B40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B40535 mov eax, dword ptr fs:[00000030h]	4_2_03B40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B40535 mov eax, dword ptr fs:[00000030h]	4_2_03B40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B40535 mov eax, dword ptr fs:[00000030h]	4_2_03B40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B40535 mov eax, dword ptr fs:[00000030h]	4_2_03B40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B5E53E mov eax, dword ptr fs:[00000030h]	4_2_03B5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B5E53E mov eax, dword ptr fs:[00000030h]	4_2_03B5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B5E53E mov eax, dword ptr fs:[00000030h]	4_2_03B5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B5E53E mov eax, dword ptr fs:[00000030h]	4_2_03B5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B5E53E mov eax, dword ptr fs:[00000030h]	4_2_03B5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BC6500 mov eax, dword ptr fs:[00000030h]	4_2_03BC6500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03C04500 mov eax, dword ptr fs:[00000030h]	4_2_03C04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03C04500 mov eax, dword ptr fs:[00000030h]	4_2_03C04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03C04500 mov eax, dword ptr fs:[00000030h]	4_2_03C04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03C04500 mov eax, dword ptr fs:[00000030h]	4_2_03C04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03C04500 mov eax, dword ptr fs:[00000030h]	4_2_03C04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03C04500 mov eax, dword ptr fs:[00000030h]	4_2_03C04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03C04500 mov eax, dword ptr fs:[00000030h]	4_2_03C04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B6656A mov eax, dword ptr fs:[00000030h]	4_2_03B6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B6656A mov eax, dword ptr fs:[00000030h]	4_2_03B6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B6656A mov eax, dword ptr fs:[00000030h]	4_2_03B6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B38550 mov eax, dword ptr fs:[00000030h]	4_2_03B38550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B38550 mov eax, dword ptr fs:[00000030h]	4_2_03B38550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B644B0 mov ecx, dword ptr fs:[00000030h]	4_2_03B644B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BBA4B0 mov eax, dword ptr fs:[00000030h]	4_2_03BBA4B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B364AB mov eax, dword ptr fs:[00000030h]	4_2_03B364AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BEA49A mov eax, dword ptr fs:[00000030h]	4_2_03BEA49A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B304E5 mov ecx, dword ptr fs:[00000030h]	4_2_03B304E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B6A430 mov eax, dword ptr fs:[00000030h]	4_2_03B6A430
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B2E420 mov eax, dword ptr fs:[00000030h]	4_2_03B2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B2E420 mov eax, dword ptr fs:[00000030h]	4_2_03B2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B2E420 mov eax, dword ptr fs:[00000030h]	4_2_03B2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B2C427 mov eax, dword ptr fs:[00000030h]	4_2_03B2C427
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB6420 mov eax, dword ptr fs:[00000030h]	4_2_03BB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB6420 mov eax, dword ptr fs:[00000030h]	4_2_03BB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB6420 mov eax, dword ptr fs:[00000030h]	4_2_03BB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB6420 mov eax, dword ptr fs:[00000030h]	4_2_03BB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB6420 mov eax, dword ptr fs:[00000030h]	4_2_03BB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB6420 mov eax, dword ptr fs:[00000030h]	4_2_03BB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB6420 mov eax, dword ptr fs:[00000030h]	4_2_03BB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B68402 mov eax, dword ptr fs:[00000030h]	4_2_03B68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B68402 mov eax, dword ptr fs:[00000030h]	4_2_03B68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B68402 mov eax, dword ptr fs:[00000030h]	4_2_03B68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B5A470 mov eax, dword ptr fs:[00000030h]	4_2_03B5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B5A470 mov eax, dword ptr fs:[00000030h]	4_2_03B5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B5A470 mov eax, dword ptr fs:[00000030h]	4_2_03B5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BBC460 mov ecx, dword ptr fs:[00000030h]	4_2_03BBC460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BEA456 mov eax, dword ptr fs:[00000030h]	4_2_03BEA456
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B2645D mov eax, dword ptr fs:[00000030h]	4_2_03B2645D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B5245A mov eax, dword ptr fs:[00000030h]	4_2_03B5245A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B6E443 mov eax, dword ptr fs:[00000030h]	4_2_03B6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B6E443 mov eax, dword ptr fs:[00000030h]	4_2_03B6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B6E443 mov eax, dword ptr fs:[00000030h]	4_2_03B6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B6E443 mov eax, dword ptr fs:[00000030h]	4_2_03B6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B6E443 mov eax, dword ptr fs:[00000030h]	4_2_03B6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B6E443 mov eax, dword ptr fs:[00000030h]	4_2_03B6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B6E443 mov eax, dword ptr fs:[00000030h]	4_2_03B6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B6E443 mov eax, dword ptr fs:[00000030h]	4_2_03B6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B40BBE mov eax, dword ptr fs:[00000030h]	4_2_03B40BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B40BBE mov eax, dword ptr fs:[00000030h]	4_2_03B40BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BE4BB0 mov eax, dword ptr fs:[00000030h]	4_2_03BE4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BE4BB0 mov eax, dword ptr fs:[00000030h]	4_2_03BE4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B38BF0 mov eax, dword ptr fs:[00000030h]	4_2_03B38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B38BF0 mov eax, dword ptr fs:[00000030h]	4_2_03B38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B38BF0 mov eax, dword ptr fs:[00000030h]	4_2_03B38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B5EBFC mov eax, dword ptr fs:[00000030h]	4_2_03B5EBFC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BBCBF0 mov eax, dword ptr fs:[00000030h]	4_2_03BBCBF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BDEBD0 mov eax, dword ptr fs:[00000030h]	4_2_03BDEBD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B50BCB mov eax, dword ptr fs:[00000030h]	4_2_03B50BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B50BCB mov eax, dword ptr fs:[00000030h]	4_2_03B50BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B50BCB mov eax, dword ptr fs:[00000030h]	4_2_03B50BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B30BCD mov eax, dword ptr fs:[00000030h]	4_2_03B30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B30BCD mov eax, dword ptr fs:[00000030h]	4_2_03B30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B30BCD mov eax, dword ptr fs:[00000030h]	4_2_03B30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B5EB20 mov eax, dword ptr fs:[00000030h]	4_2_03B5EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B5EB20 mov eax, dword ptr fs:[00000030h]	4_2_03B5EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BF8B28 mov eax, dword ptr fs:[00000030h]	4_2_03BF8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BF8B28 mov eax, dword ptr fs:[00000030h]	4_2_03BF8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03C02B57 mov eax, dword ptr fs:[00000030h]	4_2_03C02B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03C02B57 mov eax, dword ptr fs:[00000030h]	4_2_03C02B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03C02B57 mov eax, dword ptr fs:[00000030h]	4_2_03C02B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03C02B57 mov eax, dword ptr fs:[00000030h]	4_2_03C02B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BAEB1D mov eax, dword ptr fs:[00000030h]	4_2_03BAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BAEB1D mov eax, dword ptr fs:[00000030h]	4_2_03BAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BAEB1D mov eax, dword ptr fs:[00000030h]	4_2_03BAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BAEB1D mov eax, dword ptr fs:[00000030h]	4_2_03BAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BAEB1D mov eax, dword ptr fs:[00000030h]	4_2_03BAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BAEB1D mov eax, dword ptr fs:[00000030h]	4_2_03BAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BAEB1D mov eax, dword ptr fs:[00000030h]	4_2_03BAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BAEB1D mov eax, dword ptr fs:[00000030h]	4_2_03BAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BAEB1D mov eax, dword ptr fs:[00000030h]	4_2_03BAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03C04B00 mov eax, dword ptr fs:[00000030h]	4_2_03C04B00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B2CB7E mov eax, dword ptr fs:[00000030h]	4_2_03B2CB7E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B28B50 mov eax, dword ptr fs:[00000030h]	4_2_03B28B50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BDEB50 mov eax, dword ptr fs:[00000030h]	4_2_03BDEB50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BE4B4B mov eax, dword ptr fs:[00000030h]	4_2_03BE4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BE4B4B mov eax, dword ptr fs:[00000030h]	4_2_03BE4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BC6B40 mov eax, dword ptr fs:[00000030h]	4_2_03BC6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BC6B40 mov eax, dword ptr fs:[00000030h]	4_2_03BC6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BFAB40 mov eax, dword ptr fs:[00000030h]	4_2_03BFAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BD8B42 mov eax, dword ptr fs:[00000030h]	4_2_03BD8B42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B38AA0 mov eax, dword ptr fs:[00000030h]	4_2_03B38AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B38AA0 mov eax, dword ptr fs:[00000030h]	4_2_03B38AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B86AA4 mov eax, dword ptr fs:[00000030h]	4_2_03B86AA4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B68A90 mov edx, dword ptr fs:[00000030h]	4_2_03B68A90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B3EA80 mov eax, dword ptr fs:[00000030h]	4_2_03B3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B3EA80 mov eax, dword ptr fs:[00000030h]	4_2_03B3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B3EA80 mov eax, dword ptr fs:[00000030h]	4_2_03B3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B3EA80 mov eax, dword ptr fs:[00000030h]	4_2_03B3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B3EA80 mov eax, dword ptr fs:[00000030h]	4_2_03B3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B3EA80 mov eax, dword ptr fs:[00000030h]	4_2_03B3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B3EA80 mov eax, dword ptr fs:[00000030h]	4_2_03B3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B3EA80 mov eax, dword ptr fs:[00000030h]	4_2_03B3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B3EA80 mov eax, dword ptr fs:[00000030h]	4_2_03B3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03C04A80 mov eax, dword ptr fs:[00000030h]	4_2_03C04A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B6AAEE mov eax, dword ptr fs:[00000030h]	4_2_03B6AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B6AAEE mov eax, dword ptr fs:[00000030h]	4_2_03B6AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B30AD0 mov eax, dword ptr fs:[00000030h]	4_2_03B30AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B64AD0 mov eax, dword ptr fs:[00000030h]	4_2_03B64AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B64AD0 mov eax, dword ptr fs:[00000030h]	4_2_03B64AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B86ACC mov eax, dword ptr fs:[00000030h]	4_2_03B86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B86ACC mov eax, dword ptr fs:[00000030h]	4_2_03B86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B86ACC mov eax, dword ptr fs:[00000030h]	4_2_03B86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B54A35 mov eax, dword ptr fs:[00000030h]	4_2_03B54A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B54A35 mov eax, dword ptr fs:[00000030h]	4_2_03B54A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B6CA38 mov eax, dword ptr fs:[00000030h]	4_2_03B6CA38
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B6CA24 mov eax, dword ptr fs:[00000030h]	4_2_03B6CA24
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B5EA2E mov eax, dword ptr fs:[00000030h]	4_2_03B5EA2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BBCA11 mov eax, dword ptr fs:[00000030h]	4_2_03BBCA11
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BACA72 mov eax, dword ptr fs:[00000030h]	4_2_03BACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BACA72 mov eax, dword ptr fs:[00000030h]	4_2_03BACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B6CA6F mov eax, dword ptr fs:[00000030h]	4_2_03B6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B6CA6F mov eax, dword ptr fs:[00000030h]	4_2_03B6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B6CA6F mov eax, dword ptr fs:[00000030h]	4_2_03B6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BDEA60 mov eax, dword ptr fs:[00000030h]	4_2_03BDEA60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B36A50 mov eax, dword ptr fs:[00000030h]	4_2_03B36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B36A50 mov eax, dword ptr fs:[00000030h]	4_2_03B36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B36A50 mov eax, dword ptr fs:[00000030h]	4_2_03B36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B36A50 mov eax, dword ptr fs:[00000030h]	4_2_03B36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B36A50 mov eax, dword ptr fs:[00000030h]	4_2_03B36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B36A50 mov eax, dword ptr fs:[00000030h]	4_2_03B36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B36A50 mov eax, dword ptr fs:[00000030h]	4_2_03B36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B40A5B mov eax, dword ptr fs:[00000030h]	4_2_03B40A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B40A5B mov eax, dword ptr fs:[00000030h]	4_2_03B40A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB89B3 mov esi, dword ptr fs:[00000030h]	4_2_03BB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB89B3 mov eax, dword ptr fs:[00000030h]	4_2_03BB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB89B3 mov eax, dword ptr fs:[00000030h]	4_2_03BB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B429A0 mov eax, dword ptr fs:[00000030h]	4_2_03B429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B429A0 mov eax, dword ptr fs:[00000030h]	4_2_03B429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B429A0 mov eax, dword ptr fs:[00000030h]	4_2_03B429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B429A0 mov eax, dword ptr fs:[00000030h]	4_2_03B429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B429A0 mov eax, dword ptr fs:[00000030h]	4_2_03B429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B429A0 mov eax, dword ptr fs:[00000030h]	4_2_03B429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B429A0 mov eax, dword ptr fs:[00000030h]	4_2_03B429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B429A0 mov eax, dword ptr fs:[00000030h]	4_2_03B429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B429A0 mov eax, dword ptr fs:[00000030h]	4_2_03B429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B429A0 mov eax, dword ptr fs:[00000030h]	4_2_03B429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B429A0 mov eax, dword ptr fs:[00000030h]	4_2_03B429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B429A0 mov eax, dword ptr fs:[00000030h]	4_2_03B429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B429A0 mov eax, dword ptr fs:[00000030h]	4_2_03B429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B309AD mov eax, dword ptr fs:[00000030h]	4_2_03B309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B309AD mov eax, dword ptr fs:[00000030h]	4_2_03B309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B629F9 mov eax, dword ptr fs:[00000030h]	4_2_03B629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B629F9 mov eax, dword ptr fs:[00000030h]	4_2_03B629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BBE9E0 mov eax, dword ptr fs:[00000030h]	4_2_03BBE9E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B3A9D0 mov eax, dword ptr fs:[00000030h]	4_2_03B3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B3A9D0 mov eax, dword ptr fs:[00000030h]	4_2_03B3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B3A9D0 mov eax, dword ptr fs:[00000030h]	4_2_03B3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B3A9D0 mov eax, dword ptr fs:[00000030h]	4_2_03B3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B3A9D0 mov eax, dword ptr fs:[00000030h]	4_2_03B3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B3A9D0 mov eax, dword ptr fs:[00000030h]	4_2_03B3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B649D0 mov eax, dword ptr fs:[00000030h]	4_2_03B649D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BFA9D3 mov eax, dword ptr fs:[00000030h]	4_2_03BFA9D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BC69C0 mov eax, dword ptr fs:[00000030h]	4_2_03BC69C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03C04940 mov eax, dword ptr fs:[00000030h]	4_2_03C04940
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB892A mov eax, dword ptr fs:[00000030h]	4_2_03BB892A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BC892B mov eax, dword ptr fs:[00000030h]	4_2_03BC892B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BBC912 mov eax, dword ptr fs:[00000030h]	4_2_03BBC912
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B28918 mov eax, dword ptr fs:[00000030h]	4_2_03B28918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B28918 mov eax, dword ptr fs:[00000030h]	4_2_03B28918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BAE908 mov eax, dword ptr fs:[00000030h]	4_2_03BAE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BAE908 mov eax, dword ptr fs:[00000030h]	4_2_03BAE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BD4978 mov eax, dword ptr fs:[00000030h]	4_2_03BD4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BD4978 mov eax, dword ptr fs:[00000030h]	4_2_03BD4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BBC97C mov eax, dword ptr fs:[00000030h]	4_2_03BBC97C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B56962 mov eax, dword ptr fs:[00000030h]	4_2_03B56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B56962 mov eax, dword ptr fs:[00000030h]	4_2_03B56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B56962 mov eax, dword ptr fs:[00000030h]	4_2_03B56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B7096E mov eax, dword ptr fs:[00000030h]	4_2_03B7096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B7096E mov edx, dword ptr fs:[00000030h]	4_2_03B7096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B7096E mov eax, dword ptr fs:[00000030h]	4_2_03B7096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BB0946 mov eax, dword ptr fs:[00000030h]	4_2_03BB0946
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03C008C0 mov eax, dword ptr fs:[00000030h]	4_2_03C008C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BBC89D mov eax, dword ptr fs:[00000030h]	4_2_03BBC89D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B30887 mov eax, dword ptr fs:[00000030h]	4_2_03B30887
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B6C8F9 mov eax, dword ptr fs:[00000030h]	4_2_03B6C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B6C8F9 mov eax, dword ptr fs:[00000030h]	4_2_03B6C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03BFA8E4 mov eax, dword ptr fs:[00000030h]	4_2_03BFA8E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B5E8C0 mov eax, dword ptr fs:[00000030h]	4_2_03B5E8C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4_2_03B52835 mov eax, dword ptr fs:[00000030h]	4_2_03B52835

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe

Code function: 0_2_004580A9 GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,

0_2_004580A9

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_0042A155 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0042A155
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_0042A124 SetUnhandledExceptionFilter,	0_2_0042A124
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_02F91361 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_02F91361
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_02F94C7B SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_02F94C7B

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe

Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write

Writes to foreign memory regions

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 3053008

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe

Code function: 0_2_004587B1 LogonUserW,

0_2_004587B1

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe

Code function: 0_2_00403B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00403B3A

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe

Code function: 0_2_004048D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_004048D7

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe

Code function: 0_2_00464C53 mouse_event,

0_2_00464C53

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe

Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\LiuUGJK9vH.exe"

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe

Code function: 0_2_00457CAF GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00457CAF

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe

Code function: 0_2_0045874B AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_0045874B

Source: LiuUGJK9vH.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: LiuUGJK9vH.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe

Code function: 0_2_0042862B cpuid

0_2_0042862B

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe

Code function: 0_2_00434E87 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00434E87

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe

Code function: 0_2_00441E06 GetUserNameW,

0_2_00441E06

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe

Code function: 0_2_00433F3A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00433F3A

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe

Code function: 0_2_004049A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_004049A0

Stealing of Sensitive Information

Source: Yara match	File source: 4.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1792348155.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1793038630.0000000003950000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: LiuUGJK9vH.exe	Binary or memory string: WIN_81
Source: LiuUGJK9vH.exe	Binary or memory string: WIN_XP
Source: LiuUGJK9vH.exe	Binary or memory string: WIN_XPe
Source: LiuUGJK9vH.exe	Binary or memory string: WIN_VISTA
Source: LiuUGJK9vH.exe	Binary or memory string: WIN_7
Source: LiuUGJK9vH.exe	Binary or memory string: WIN_8
Source: LiuUGJK9vH.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Remote Access Functionality

Source: Yara match	File source: 4.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1792348155.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1793038630.0000000003950000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_00476283 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_00476283
Source: C:\Users\user\Desktop\LiuUGJK9vH.exe	Code function: 0_2_00476747 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00476747

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	2 Native API	1 LSASS Driver	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	1 Taint Shared Content	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Service Execution	1 DLL Side-Loading	1 LSASS Driver	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	2 Valid Accounts	1 DLL Side-Loading	3 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Windows Service	2 Valid Accounts	1 Software Packing	NTDS	125 System Information Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 Timestomp	LSA Secrets	151 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Windows Service	1 DLL Side-Loading	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	212 Process Injection	221 Masquerading	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Valid Accounts	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	21 Access Token Manipulation	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	212 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
LiuUGJK9vH.exe	92%	ReversingLabs	Win32.Virus.Expiro
LiuUGJK9vH.exe	100%	Avira	W32/Infector.Gen
LiuUGJK9vH.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	100%	Avira	W32/Infector.Gen
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	100%	Avira	W32/Infector.Gen
C:\Windows\System32\AppVClient.exe	100%	Avira	W32/Infector.Gen
C:\Windows\System32\alg.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	100%	Joe Sandbox ML
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	100%	Joe Sandbox ML
C:\Windows\System32\AppVClient.exe	100%	Joe Sandbox ML
C:\Windows\System32\alg.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://18.141.10.107:80/rai	0%	Avira URL Cloud	safe
http://54.244.188.177/	100%	Avira URL Cloud	malware
http://54.244.188.177/hdjf~A	100%	Avira URL Cloud	malware
http://54.244.188.177/hdjf	100%	Avira URL Cloud	malware
http://18.141.10.107/8	0%	Avira URL Cloud	safe
http://18.141.10.107/raie	0%	Avira URL Cloud	safe
http://18.141.10.107/x	0%	Avira URL Cloud	safe
http://18.141.10.107/raiI	0%	Avira URL Cloud	safe
http://18.141.10.107/rai	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ssbzmoy.biz	18.141.10.107	true	false		high
pywolwnvd.biz	54.244.188.177	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ssbzmoy.biz/rai	false		high
http://pywolwnvd.biz/hdjf	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://54.244.188.177/hdjf~A	LiuUGJK9vH.exe, 00000000.00000002.1480616556.0000000000AE6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://18.141.10.107/raie	LiuUGJK9vH.exe, 00000000.00000002.1480616556.0000000000AE6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://18.141.10.107/8	LiuUGJK9vH.exe, 00000000.00000002.1480829576.0000000000BBF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://18.141.10.107/x	LiuUGJK9vH.exe, 00000000.00000002.1480829576.0000000000BBF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://18.141.10.107/rai	LiuUGJK9vH.exe, 00000000.00000002.1480829576.0000000000BBF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://54.244.188.177/	LiuUGJK9vH.exe, 00000000.00000002.1480829576.0000000000BA6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://54.244.188.177/hdjf	LiuUGJK9vH.exe, 00000000.00000002.1480616556.0000000000AE6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://18.141.10.107/	LiuUGJK9vH.exe, 00000000.00000002.1480829576.0000000000BBF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://18.141.10.107/raiI	LiuUGJK9vH.exe, 00000000.00000002.1480829576.0000000000BBF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://18.141.10.107:80/rai	LiuUGJK9vH.exe, 00000000.00000002.1480829576.0000000000BB4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
54.244.188.177	pywolwnvd.biz	United States		16509	AMAZON-02US	false
18.141.10.107	ssbzmoy.biz	United States		16509	AMAZON-02US	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588299
Start date and time:	2025-01-10 23:39:52 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	3
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	LiuUGJK9vH.exe renamed because original name is a hash value
Original Sample Name:	1273e390eab2f69aa5ed380f296a7cd6c8ff01142367fe5dd76eae5f515947e2.exe
Detection:	MAL
Classification:	mal100.spre.troj.evad.winEXE@6/10@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 76% Number of executed functions: 73 Number of non-executed functions: 246
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 172.202.163.200, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
VT rate limit hit for: LiuUGJK9vH.exe

Simulations

Behavior and APIs

Time	Type	Description
17:40:53	API Interceptor	1x Sleep call for process: LiuUGJK9vH.exe modified
17:41:22	API Interceptor	3x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54.244.188.177	UaOJAOMxcU.exe	Get hash	malicious	FormBook	Browse	pywolwnvd.biz/rhimsaly
	SABXJ1B5c8.exe	Get hash	malicious	MassLogger RAT	Browse	cvgrf.biz/kmpia
	I3LPkQh2an.exe	Get hash	malicious	FormBook	Browse	lrxdmhrr.biz/rwlfutjcp
	OVZizpEU7Q.exe	Get hash	malicious	FormBook	Browse	pywolwnvd.biz/wlyolqts
	RJKUWSGxej.exe	Get hash	malicious	AgentTesla, RedLine	Browse	lrxdmhrr.biz/tbbwyfgx
	PO_2024_056209_MQ04865_ENQ_1045.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	lrxdmhrr.biz/fncvigkebkn
	REQUEST FOR QUOTATION 1307-RFQ.exe	Get hash	malicious	MassLogger RAT	Browse	cvgrf.biz/dy
	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	cvgrf.biz/ubwy
	INV_NE_02_2034388.exe	Get hash	malicious	FormBook	Browse	cvgrf.biz/mddjrljmh
	Shipment Notification.exe	Get hash	malicious	FormBook	Browse	cvgrf.biz/pm
18.141.10.107	SABXJ1B5c8.exe	Get hash	malicious	MassLogger RAT	Browse	knjghuig.biz/wmfptllh
	I3LPkQh2an.exe	Get hash	malicious	FormBook	Browse	warkcdu.biz/gloumaahxxajxf
	RJKUWSGxej.exe	Get hash	malicious	AgentTesla, RedLine	Browse	warkcdu.biz/d
	PO_2024_056209_MQ04865_ENQ_1045.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	vcddkls.biz/we
	REQUEST FOR QUOTATION 1307-RFQ.exe	Get hash	malicious	MassLogger RAT	Browse	vcddkls.biz/kknpblsbxdrrjko
	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	knjghuig.biz/nfm
	INV_NE_02_2034388.exe	Get hash	malicious	FormBook	Browse	vcddkls.biz/x
	Shipment Notification.exe	Get hash	malicious	FormBook	Browse	knjghuig.biz/hsyjdjsftfdjf
	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	vcddkls.biz/lqpvpf
	Request for Quotation.exe	Get hash	malicious	FormBook	Browse	vcddkls.biz/ytpebbldheutao

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ssbzmoy.biz	UaOJAOMxcU.exe	Get hash	malicious	FormBook	Browse	18.141.10.107
	SABXJ1B5c8.exe	Get hash	malicious	MassLogger RAT	Browse	18.141.10.107
	I3LPkQh2an.exe	Get hash	malicious	FormBook	Browse	18.141.10.107
	OVZizpEU7Q.exe	Get hash	malicious	FormBook	Browse	18.141.10.107
	RJKUWSGxej.exe	Get hash	malicious	AgentTesla, RedLine	Browse	18.141.10.107
	PO_2024_056209_MQ04865_ENQ_1045.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	18.141.10.107
	REQUEST FOR QUOTATION 1307-RFQ.exe	Get hash	malicious	MassLogger RAT	Browse	18.141.10.107
	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	18.141.10.107
	INV_NE_02_2034388.exe	Get hash	malicious	FormBook	Browse	18.141.10.107
	Shipment Notification.exe	Get hash	malicious	FormBook	Browse	18.141.10.107
pywolwnvd.biz	UaOJAOMxcU.exe	Get hash	malicious	FormBook	Browse	54.244.188.177
	SABXJ1B5c8.exe	Get hash	malicious	MassLogger RAT	Browse	54.244.188.177
	I3LPkQh2an.exe	Get hash	malicious	FormBook	Browse	54.244.188.177
	OVZizpEU7Q.exe	Get hash	malicious	FormBook	Browse	54.244.188.177
	RJKUWSGxej.exe	Get hash	malicious	AgentTesla, RedLine	Browse	54.244.188.177
	PO_2024_056209_MQ04865_ENQ_1045.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	54.244.188.177
	REQUEST FOR QUOTATION 1307-RFQ.exe	Get hash	malicious	MassLogger RAT	Browse	54.244.188.177
	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	54.244.188.177
	INV_NE_02_2034388.exe	Get hash	malicious	FormBook	Browse	54.244.188.177
	Shipment Notification.exe	Get hash	malicious	FormBook	Browse	54.244.188.177

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	5CTbduoXq4.exe	Get hash	malicious	FormBook	Browse	13.228.81.39
	gH3LlhcRzg.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	UaOJAOMxcU.exe	Get hash	malicious	FormBook	Browse	54.244.188.177
	0Wu31IhwGO.exe	Get hash	malicious	FormBook	Browse	18.139.62.226
	https://www.shinsengumiusa.com/mrloskie	Get hash	malicious	Unknown	Browse	3.120.85.61
	SABXJ1B5c8.exe	Get hash	malicious	MassLogger RAT	Browse	18.141.10.107
	fFoOcuxK7M.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	NFhRxwbegd.exe	Get hash	malicious	FormBook	Browse	18.139.62.226
	I3LPkQh2an.exe	Get hash	malicious	FormBook	Browse	18.141.10.107
	statement.doc	Get hash	malicious	KnowBe4	Browse	52.217.123.201
AMAZON-02US	5CTbduoXq4.exe	Get hash	malicious	FormBook	Browse	13.228.81.39
	gH3LlhcRzg.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	UaOJAOMxcU.exe	Get hash	malicious	FormBook	Browse	54.244.188.177
	0Wu31IhwGO.exe	Get hash	malicious	FormBook	Browse	18.139.62.226
	https://www.shinsengumiusa.com/mrloskie	Get hash	malicious	Unknown	Browse	3.120.85.61
	SABXJ1B5c8.exe	Get hash	malicious	MassLogger RAT	Browse	18.141.10.107
	fFoOcuxK7M.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	NFhRxwbegd.exe	Get hash	malicious	FormBook	Browse	18.139.62.226
	I3LPkQh2an.exe	Get hash	malicious	FormBook	Browse	18.141.10.107
	statement.doc	Get hash	malicious	KnowBe4	Browse	52.217.123.201

Process:	C:\Users\user\Desktop\LiuUGJK9vH.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1658880
Entropy (8bit):	4.312990393887855
Encrypted:	false
SSDEEP:	24576:JxGBcml8Vg9N9JMlDlfjRiVuVsWt5MJMs:vGy+cgFIDRRAubt5M
MD5:	1E28FD404AAE9396AA5D6A1141873E0E
SHA1:	1C46C05FB4E4792F1363F82274A529083BE024BB
SHA-256:	DD219EE79A5A8FD649127D90243C3631C275BFE581C85D8F6775B2427F66F38A
SHA-512:	D3580EBBA7B815E1D2B0677399D254B85C2FE23E79DBCBD2D27E4C58D54EC2981FC53930FA9FA71F79E2614040B4C705AE468D20ADBF3EF672AADC46C2104119
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........]...3...3...3...0...3...6.h.3.,.7...3.,.0...3.,.6...3...7...3...2...3...2.G.3.e.:...3.e....3.....3.e.1...3.Rich..3.................PE..L...}..d..........................................@.........................................................................`D......................................@...p...........................p...@....................B.......................text.............................. ..`.rdata..t...........................@..@.data........`.......@..............@....didat..4............N..............@....rsrc................P..............@..@.reloc...............`..............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Thebit

Process:	C:\Users\user\Desktop\LiuUGJK9vH.exe
File Type:	data
Category:	dropped
Size (bytes):	288768
Entropy (8bit):	7.996029064087877
Encrypted:	true
SSDEEP:	3072:9PvhbrrJ394XuFfmGOZrfsDjmkJ9uGaVKPkmig2C3+11IcEjIXfvnn4wb3xwTNqM:9d539dhIC59uxZH1gIXH4o2A3zGoG
MD5:	2E632CF2FD60FCFDA595613C1DDA8C83
SHA1:	4B341A13918BF2390C6FB4E50C9C66563484793E
SHA-256:	808E1F6C73AE2292BD8F99298F685B1A07E601892E6278397E36F97A9CEFCAFB
SHA-512:	D1410B18EC235230BAC3A7FBE6D2ED9F74A6755F4BAE170E4F534C27AFEAD2A752D50E29C289BF7E599B0E11F3D4B2FDCBF08BB7221A4BEEEF488DC9A47D6A9B
Malicious:	false
Reputation:	low
Preview:	...E4ROQMPNL..06.NSBTWCC.GHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNL.106HQ.LT.J.u.I..s.9 #n<+^WD'#s!59-, g* . :?i9 l.~c.+!7'zZNIpGHE7ROQ0QG.dQW.{.4.i7$.N...2(.S..eQW.\...h7$...+-.2(.IPNLY106..SB.VBC..m.7ROQIPNL.127MOXBT.GCTGHE7ROQIENLY!06F>WBTW.CTWHE7POQOPNLY106@NSBTWCCT7LE7POQIPNL[1p.FNCBTGCCTGXE7BOQIPNLI106FNSBTWCCTGHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNLY106FNSBTWCCz3-=CROQ..JLY!06F.WBTGCCTGHE7ROQIPNLy10VFNSBTWCCTGHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNLY106

C:\Users\user\AppData\Local\Temp\autC621.tmp

Process:	C:\Users\user\Desktop\LiuUGJK9vH.exe
File Type:	data
Category:	dropped
Size (bytes):	288768
Entropy (8bit):	7.996029064087877
Encrypted:	true
SSDEEP:	3072:9PvhbrrJ394XuFfmGOZrfsDjmkJ9uGaVKPkmig2C3+11IcEjIXfvnn4wb3xwTNqM:9d539dhIC59uxZH1gIXH4o2A3zGoG
MD5:	2E632CF2FD60FCFDA595613C1DDA8C83
SHA1:	4B341A13918BF2390C6FB4E50C9C66563484793E
SHA-256:	808E1F6C73AE2292BD8F99298F685B1A07E601892E6278397E36F97A9CEFCAFB
SHA-512:	D1410B18EC235230BAC3A7FBE6D2ED9F74A6755F4BAE170E4F534C27AFEAD2A752D50E29C289BF7E599B0E11F3D4B2FDCBF08BB7221A4BEEEF488DC9A47D6A9B
Malicious:	false
Reputation:	low
Preview:	...E4ROQMPNL..06.NSBTWCC.GHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNL.106HQ.LT.J.u.I..s.9 #n<+^WD'#s!59-, g* . :?i9 l.~c.+!7'zZNIpGHE7ROQ0QG.dQW.{.4.i7$.N...2(.S..eQW.\...h7$...+-.2(.IPNLY106..SB.VBC..m.7ROQIPNL.127MOXBT.GCTGHE7ROQIENLY!06F>WBTW.CTWHE7POQOPNLY106@NSBTWCCT7LE7POQIPNL[1p.FNCBTGCCTGXE7BOQIPNLI106FNSBTWCCTGHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNLY106FNSBTWCCz3-=CROQ..JLY!06F.WBTGCCTGHE7ROQIPNLy10VFNSBTWCCTGHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNLY106FNSBTWCCTGHE7ROQIPNLY106

C:\Users\user\AppData\Local\Temp\autC671.tmp

Process:	C:\Users\user\Desktop\LiuUGJK9vH.exe
File Type:	data
Category:	dropped
Size (bytes):	14596
Entropy (8bit):	7.634261998230472
Encrypted:	false
SSDEEP:	384:dTYznwMNeAOPPYLDfvWME/eTk5mUOYHvqmUoiGwfycSV:dAwJV8DfvWkOLHBiGw5C
MD5:	EA210CBB3DB8B138FB96C70BFA3F2452
SHA1:	5A9BF057A5CBB0B7A5E59F9B6B139166A38ACE52
SHA-256:	2C964FC828D78F33A0C823FBD610B1BCF74C801A09EDE5E82EEC0572928C423E
SHA-512:	22CDFF953B0732A8855550D2355880EF838844EA47D151149FB462CAC8388AA5B94C8395FF3DB639BE6FA6725FB1F91A156782BCC904E1655E1B878314021F7A
Malicious:	false
Reputation:	low
Preview:	EA06..0..Y&.y..+x..f....... .V......71...@.x..L........`......8............`.......Z\|3@...@.........K.X@0.2.Z..Z>)..w.e....l !..m..;...\| !.....;....;.....l.;.0./.<.;...m..rd.....@->.....4....f.C.5..;.............r.....X.<>`.O..p.........!.........h.=..........<\|3.....c...h.. -...... ...X.Z?......(...(.G..4.h....x....M@N.......Z?.I.......N@R... ...5.(..,.._...k`........R...._.K..?d...B.... 7W.......n.../.~.....)...@...!K....h\|!._....ga._.5.1.....`v/.......NA...,...7.7.,..!6.b...Z?.K(-...0.h..&.._....' -.............-..........G.6.....d_.T......"....d_.(M..57....n.....`...L....K.L..6.s.A.?..L.......Bg>...w.36.... !...L...}....\|V.4..r......$............r..9....>.....2... ...b....`......k.(.....!`....,......V1`..f....X.>i.v'.3c.........G.4....E.?......9..X.......7...l.`..."...\.61*........f.....\|.`.O.......,`........nl,....C.`....p...Y......`....@n?..;g....0...d...l ...P.?'....}...........0...4.X...>y.....1......x...L.\.i.....)...@n?............b...@.>y...

C:\Users\user\AppData\Local\Temp\teer

Process:	C:\Users\user\Desktop\LiuUGJK9vH.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	143378
Entropy (8bit):	2.792495449492762
Encrypted:	false
SSDEEP:	192:mNxyGyDZFuil7LDZGMMVQc3GkcVoudfSq5+vLkHVoqW4/qb35mwBgZihJahYDt0m:Y
MD5:	5EEC4E88617FFE9EBD1D4051C4E3DBDE
SHA1:	8FB94D41B8C241F186297A595E94C68CAACB9460
SHA-256:	658153BEC837A54A63CA3F65082A60455C0C58CFD891BECB00467E306F26748C
SHA-512:	EEBC8B2326C141B8B4B2C02EBCB64D38357E29F903399974795363D5C0FBCA22B36DB81068B2D5DD2CEA9DB46209D96AFEB5E09592728CE62E0783377944A879
Malicious:	false
Reputation:	low
Preview:	2d0w02d0wx2d0w52d0w52d0w82d0wb2d0we2d0wc2d0w82d0w12d0we2d0wc2d0wc2d0wc2d0w02d0w22d0w02d0w02d0w02d0w02d0w52d0w62d0w52d0w72d0wb2d0w82d0w62d0wb2d0w02d0w02d0w02d0w02d0w02d0w02d0w62d0w62d0w82d0w92d0w42d0w52d0w82d0w42d0wb2d0w92d0w62d0w52d0w02d0w02d0w02d0w02d0w02d0w02d0w62d0w62d0w82d0w92d0w42d0wd2d0w82d0w62d0wb2d0wa2d0w72d0w22d0w02d0w02d0w02d0w02d0w02d0w02d0w62d0w62d0w82d0w92d0w52d0w52d0w82d0w82d0wb2d0w82d0w62d0we2d0w02d0w02d0w02d0w02d0w02d0w02d0w62d0w62d0w82d0w92d0w42d0w52d0w82d0wa2d0wb2d0w92d0w62d0w52d0w02d0w02d0w02d0w02d0w02d0w02d0w62d0w62d0w82d0w92d0w42d0wd2d0w82d0wc2d0wb2d0wa2d0w62d0wc2d0w02d0w02d0w02d0w02d0w02d0w02d0w62d0w62d0w82d0w92d0w52d0w52d0w82d0we2d0wb2d0w82d0w32d0w32d0w02d0w02d0w02d0w02d0w02d0w02d0w62d0w62d0w82d0w92d0w42d0w52d0w92d0w02d0wb2d0w92d0w32d0w22d0w02d0w02d0w02d0w02d0w02d0w02d0w62d0w62d0w82d0w92d0w42d0wd2d0w92d0w22d0wb2d0wa2d0w22d0we2d0w02d0w02d0w02d0w02d0w02d0w02d0w62d0w62d0w82d0w92d0w52d0w52d0w92d0w42d0wb2d0w82d0w62d0w42d0w02d0w02d0w02d0w02d0w02d0w02d0w62d0w62d0w82d0w9

C:\Users\user\AppData\Roaming\a49546759c90d829.bin

Process:	C:\Users\user\Desktop\LiuUGJK9vH.exe
File Type:	data
Category:	dropped
Size (bytes):	12320
Entropy (8bit):	7.986916649895509
Encrypted:	false
SSDEEP:	384:TTKYsdO6qxT/dRdfETISZjklFb03G9MD+J:Tp6ordfET5ZjklFbBOD+J
MD5:	38B2A915F3D8A3C452C8CF889D74789F
SHA1:	FF4F7A010EF7EA4ADD0D91FD13F674329298EC24
SHA-256:	119AD7ABB337DAF843FAF4E2EEB2B7D3C84261EE798C42EFBF4070B1427A3154
SHA-512:	DEE7D7C354C5F0DDD6CCF909BD0116031B1F5C7C29A2DACA8E68E999588B84FBFA25D388061BC63789C4F6A649CABC09AD648B7862CFF68F91EBF0521262EB21
Malicious:	false
Preview:	\|.Sr.Y.v.$.....#y#..W.v..K.8......D0S....bx...n.ct....+...t.);...'.....5....8A.....:oJb_..44A.4.]. ....E.T>....{Gp..[......N.`.z)&!.......S....eU.............X....P."....L.9......L....._B/.x.thHczk...d.-.ip\|m~..q>...M...G .^....J....d....[..V.}.....b...dy.....w..$..!.i....@m.`...\x..~..B.....&D...b...84;w.Y.....2,..y...a..r..0.....yUz.X9{.y..=B=..~~.1.2..-....Z.j-N....._.....w......i.].\....8.......&....~Z!3....ph.~.$.sZ2.......q...i...6h.5.s.Sf~..kK2w.....Pn.bM.....p....a..!....u..?>Z\..........M..r.3H."...(..<\|Z..JhP4#rY.....9..O.o.#..f8M..v..=v&..9....>,.>\|M.d.0.F..1/....[{. .aO....1.wxY.e ....A.!....P.6Sz!c.A."L.m."dF..6.[..,0.........c...._x....Z....b.....6JXpx.e.nT...?..B.Es...N%9_.L.m... =..+.]....:......Gt.....0f..c......\.!...z... ..{.....".......y.-1..)b0.w..BM.a~......ST..O....L.-q.......\p...\.......hf]..%.4]2l7..7@.jX..q:.<..O5zl..e(..zQO.D..\|.n...~3..9..,.6.....-..H..]`...,.H"*UB.-}....s.3i>\.... }$'.K..8jV...J[.B..l.[...8..Rb..i..'.

C:\Windows\System32\AppVClient.exe

Process:	C:\Users\user\Desktop\LiuUGJK9vH.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1348608
Entropy (8bit):	7.251549984092639
Encrypted:	false
SSDEEP:	24576:5QW4qoNUgslKNX0Ip0MgHCpoMBOuZVg9N9JMlDlfjRiVuVsWt5MJMs:5QW9BKNX0IPgiKMBOujgFIDRRAubt5M
MD5:	04218364223ED3D355D0195140331BD0
SHA1:	41093B988F7A349B5C5CF9659268C794C1528C44
SHA-256:	47F32A26BCA35873C30A9AF5E6193AD2C09C3D7736EC0BB92C40768109DC1951
SHA-512:	D252908C9A179DD90CCBED1B820AB4CD47F886A5E37E9081DE776B01C9585AB826D1A565DA49BCC92314710E80506BFB735F241A2DDB764E5CE5391A25CA6F93
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g..=#p.n#p.n#p.n*.kn%p.n7..o(p.n7..o p.n7..o.p.n#p.n.u.n7..o.p.n7..o.p.n7..n"p.n7..n"p.n7..o"p.nRich#p.n........................PE..d....4............"..........$.......K.........@.......................................... .......... .......................................j..h....`...a... ...:..................0a..T....................%..(....$...............%..P............................text...L........................... ..`.rdata..............................@..@.data....z.......n..................@....pdata...:... ...<..................@..@.rsrc....a...`...b...2..............@..@.reloc..............................@...................................................................................................................................................................................................................................................

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

Process:	C:\Users\user\Desktop\LiuUGJK9vH.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	modified
Size (bytes):	1592832
Entropy (8bit):	4.174404050329403
Encrypted:	false
SSDEEP:	24576:g2G7AbHjkiVg9N9JMlDlfjRiVuVsWt5MJMs:g2G7AbHjNgFIDRRAubt5M
MD5:	96DFF145D8558851EB1FD0CBC6AB435E
SHA1:	3A1F6943051A3192C46AC6C8212CA71137D3B220
SHA-256:	22B199FB31575EB3664A953DCB71D0C38F337D0A77672E84AC0A74C1FF1F8C4C
SHA-512:	5E2ADE7AD7CEB32D262A90D1246571B691FEEAEEF8FC60D6D054C8FD4EDDA6C3EF13B6F2059D4A991AA3997B293787DD1C9BF5BB579768AA75322AA51D187723
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B6l0.W.c.W.c.W.c./.cPW.c.<.b.W.c.<.b.W.c.W.c.S.c.<.b.W.c.<.b.W.c.<.b.W.c.<.c.W.c.<.c.W.c.<.b.W.cRich.W.c................PE..d...^.Jw.........."............................@....................................K..... .......... ......................................p?...................................... #..T...................8...(... ...............`...H............................text............................... ..`.rdata...b.......d..................@..@.data...@....p.......P..............@....pdata...............T..............@..@.rsrc................b..............@..@.reloc...............n..............@...........................................................................................................................................................................................................................................................

C:\Windows\System32\alg.exe

Process:	C:\Users\user\Desktop\LiuUGJK9vH.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1594368
Entropy (8bit):	4.175676290670847
Encrypted:	false
SSDEEP:	12288:VEP3RFFV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:WFnVg9N9JMlDlfjRiVuVsWt5MJMs
MD5:	01FCE6399A1AC48F9D7931507B2534BB
SHA1:	42DC16CFCB45DBFA915EA7BFF66D2B0A365F7430
SHA-256:	54957CCD8EBE822DFEDBFE06D794610EDF5EC07B725B8CF200AC9D4E5DB293E3
SHA-512:	A79D645A2C60514029B4A342DE32F0CBF52C81D94EC2E4A89FD774ED0EF04302F3A884EE3A6018841C62EDA81F8A5568F901F0DF84B05D11D778235F0634C979
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........,..dB.dB.dB....dB..A.dB..F.dB.dC.,dB..C.dB..G.dB..J.dB....dB..@.dB.Rich.dB.........PE..d...E.~..........."............................@.....................................1.... .......... ......................................`E...............p.. ................... ...T...............................................8...TA.......................text............................... ..`.rdata..rV.......X..................@..@.data........`.......@..............@....pdata.. ....p.......D..............@..@.didat...............R..............@....rsrc............ ...T..............@..@.reloc...............t..............@...................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Roaming\a49546759c90d829.bin

Process:	C:\Windows\System32\AppVClient.exe
File Type:	data
Category:	dropped
Size (bytes):	12320
Entropy (8bit):	7.983876684762191
Encrypted:	false
SSDEEP:	384:N9wEvaejiV+fMOdbiQxgrjwiV+EhhpgUW6C:N9wEyu5fjzxajlF3LC
MD5:	5D06C092DF742A8D897D149EEEF6042E
SHA1:	68F4C1AC88A26B70BEFA5CBD80750C61303B292C
SHA-256:	E09DA206354507A9476B91661B926BEFD1E24E185CEDF088376CCBBF2461B01A
SHA-512:	80C7D18AB3B162E7EA4DCD672A4F2BFFDA2EAE3812E7A868600DF88A757B7654EC2D96AF2F58D1567CA0BA3BEB2F876D183D5BC31872EBD9C109E695A567B368
Malicious:	false
Preview:	m...B.9..f....\|..q.FD.......s.UtMS..\>.n\|..c..<.K....._#...}..6(.S/..$.&.3A...'.J:....X .\|3.&GC....U.up.^..g..v.j...C.]R...}..G.%.1.....<....Q.....S[.>.!`AT.W.I.I.....l.L.B..J.V_,....(.....Y....,....~....`.....&..z{.5.Ia..ST.VQ..,.j._=(ed..`.GG.......0."..c?..!R..i.Q.z.]..!.#}.4....].]N..<..f...e4.7.2.hk...5@;...:.Q.....{...":..\|.1.'......7>P../x...a...e0Et'.......2Z7.-..\|}.&.....a...7.X.Bq....8..#.W.!L._1p.....y..<I.]'d.."......Q..eq...m.:".x...5...t..m....hwJY..P.t.6n/T'..:.+Z.s..@...a1Rv.9[..v.N....J...k..E.q..n_.b.bi,.k+.../....Y=...A..hd........e)aJ.....fv};8..#.uS.....t.^1..nn.A...}.....n.+,.3...O.8.V.RQ)J.A...y..=D."...rr.A....r\|3.....4=_.s.m..."V.W...... .g......7.......[..H.l..j......a..v.q..h..;...h:E...^...y.../S....j.X..A.d$..q^.l-..ol./.JM...^..D.[.^\.......xa......n.G.X...(.... O...78...Z&....e...4.p.b9.D....V6h.5..[.$...g._b+..'(..B"4.l......T.Z..F.+.\|.pY...l..*.i1.W.\|,.[...0Z.c..F[(..?`.T.....;......p...iD+./.a.&,\8"

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.505116096201164
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	LiuUGJK9vH.exe
File size:	1'761'792 bytes
MD5:	690a2cbb7f785f6f90a0b510f31d40de
SHA1:	624e1b8b472706e33e7d9b90ac1626153854433f
SHA256:	1273e390eab2f69aa5ed380f296a7cd6c8ff01142367fe5dd76eae5f515947e2
SHA512:	8b36aead66b13820b0d298210edc319e043e2910bb3a7c23f22dfa0a55a535e7f668996e3a57c35b411b04d40cf9d1d7535959cd7be50ce7e84a7651c2f5bfd4
SSDEEP:	49152:Hd0c++OCvkGs9FaXVbf1deFYpgFIDRRAubt5M:9B3vkJ9mbf1deFHUf
TLSH:	9285E02273DDC370CB669173FF6AB7016EBB3C610630B95B2F980D79A960161162D7A3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r}..r}..r}..4,".p}......s}.../..A}.../#..}.../".G}..{.@.{}..{.P.W}..r}..R.....)."}......s}.../..s}..r}T.s}......s}..Richr}.

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x427dcd
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x6756D4C9 [Mon Dec 9 11:30:17 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007F8354D3494Ah
jmp 00007F8354D27714h
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F8354D2789Ah
cmp edi, eax
jc 00007F8354D27BFEh
bt dword ptr [004C31FCh], 01h
jnc 00007F8354D27899h
rep movsb
jmp 00007F8354D27BACh
cmp ecx, 00000080h
jc 00007F8354D27A64h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007F8354D278A0h
bt dword ptr [004BE324h], 01h
jc 00007F8354D27D70h
bt dword ptr [004C31FCh], 00000000h
jnc 00007F8354D27A3Dh
test edi, 00000003h
jne 00007F8354D27A4Eh
test esi, 00000003h
jne 00007F8354D27A2Dh
bt edi, 02h
jnc 00007F8354D2789Fh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007F8354D278A3h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007F8354D278F5h
bt esi, 03h
jnc 00007F8354D27948h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD4 build 31101
[RES] VS2013 build 21005
[LNK] VS2013 UPD4 build 31101

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xba44c	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc7000	0x57b24	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4870	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dcc4	0x8de00	3de9cc8884ce5b00bc2079b745b786a7	False	0.5728679102422908	data	6.676133860974604	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2e10e	0x2e200	79b14b254506b0dbc8cd0ad67fb70ad9	False	0.33535526761517614	OpenPGP Public Key	5.76010872795207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbe000	0x8f74	0x5200	9f9d6f746f1a415a63de45f8b7983d33	False	0.1017530487804878	data	1.198745897703538	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc7000	0x57b24	0x57c00	536b3a2dacb66be13de7645ab0e3eb9f	False	0.9249215411324786	data	7.887704577352067	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x11f000	0x96000	0x95000	0f4e3d5187d83a5598d2c68e6fef89e8	False	0.97575470585151	data	7.938033667934618	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc75a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc76d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc77f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc7920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc7c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc7d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc8bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xc9480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xc99e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xcbf90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xcd038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xcd4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xcd4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcda84	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xce110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xce5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xceb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xcf1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xcf660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xcf7b8	0x4edea	data			1.0003281225816436
RT_GROUP_ICON	0x11e5a4	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x11e61c	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x11e630	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x11e644	0x14	data	English	Great Britain	1.25
RT_VERSION	0x11e658	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x11e734	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T23:40:54.311918+0100	2850851	ETPRO MALWARE Win32/Expiro.NDO CnC Activity	1	192.168.2.8	49704	54.244.188.177	80	TCP
2025-01-10T23:40:54.447678+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	54.244.188.177	80	192.168.2.8	49704	TCP
2025-01-10T23:40:54.447678+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	54.244.188.177	80	192.168.2.8	49704	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:40:53.605201960 CET	49704	80	192.168.2.8	54.244.188.177
Jan 10, 2025 23:40:53.610069036 CET	80	49704	54.244.188.177	192.168.2.8
Jan 10, 2025 23:40:53.610153913 CET	49704	80	192.168.2.8	54.244.188.177
Jan 10, 2025 23:40:53.610929012 CET	49704	80	192.168.2.8	54.244.188.177
Jan 10, 2025 23:40:53.610950947 CET	49704	80	192.168.2.8	54.244.188.177
Jan 10, 2025 23:40:53.615739107 CET	80	49704	54.244.188.177	192.168.2.8
Jan 10, 2025 23:40:53.615782976 CET	80	49704	54.244.188.177	192.168.2.8
Jan 10, 2025 23:40:54.311741114 CET	80	49704	54.244.188.177	192.168.2.8
Jan 10, 2025 23:40:54.311844110 CET	80	49704	54.244.188.177	192.168.2.8
Jan 10, 2025 23:40:54.311918020 CET	49704	80	192.168.2.8	54.244.188.177
Jan 10, 2025 23:40:54.442912102 CET	49704	80	192.168.2.8	54.244.188.177
Jan 10, 2025 23:40:54.447678089 CET	80	49704	54.244.188.177	192.168.2.8
Jan 10, 2025 23:40:54.493932962 CET	49705	80	192.168.2.8	18.141.10.107
Jan 10, 2025 23:40:54.498838902 CET	80	49705	18.141.10.107	192.168.2.8
Jan 10, 2025 23:40:54.499140978 CET	49705	80	192.168.2.8	18.141.10.107
Jan 10, 2025 23:40:54.612068892 CET	49705	80	192.168.2.8	18.141.10.107
Jan 10, 2025 23:40:54.612068892 CET	49705	80	192.168.2.8	18.141.10.107
Jan 10, 2025 23:40:54.616995096 CET	80	49705	18.141.10.107	192.168.2.8
Jan 10, 2025 23:40:54.617012978 CET	80	49705	18.141.10.107	192.168.2.8
Jan 10, 2025 23:40:55.033266068 CET	49705	80	192.168.2.8	18.141.10.107

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:40:53.549143076 CET	51890	53	192.168.2.8	1.1.1.1
Jan 10, 2025 23:40:53.556240082 CET	53	51890	1.1.1.1	192.168.2.8
Jan 10, 2025 23:40:54.454590082 CET	52530	53	192.168.2.8	1.1.1.1
Jan 10, 2025 23:40:54.464338064 CET	53	52530	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 23:40:53.549143076 CET	192.168.2.8	1.1.1.1	0xe06b	Standard query (0)	pywolwnvd.biz	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:40:54.454590082 CET	192.168.2.8	1.1.1.1	0x9763	Standard query (0)	ssbzmoy.biz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 23:40:53.556240082 CET	1.1.1.1	192.168.2.8	0xe06b	No error (0)	pywolwnvd.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:40:54.464338064 CET	1.1.1.1	192.168.2.8	0x9763	No error (0)	ssbzmoy.biz		18.141.10.107	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

pywolwnvd.biz

ssbzmoy.biz

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	54.244.188.177	80	4452	C:\Users\user\Desktop\LiuUGJK9vH.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:40:53.610929012 CET	349	OUT	POST /hdjf HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: pywolwnvd.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 802
Jan 10, 2025 23:40:53.610950947 CET	802	OUT	Data Raw: 08 c1 b9 99 0d 24 7a d8 16 03 00 00 df f2 4d fc d3 a2 a1 05 fc 01 78 b3 bb 50 d2 04 20 2a 3b b6 f5 f7 37 a3 2d 60 27 49 d3 44 09 57 c2 07 e5 39 86 ad 13 78 f1 8a ba e7 98 60 3e 79 3b 69 01 c1 29 ea 3f dd 9a 19 77 06 ee cb e6 37 38 73 f4 8f 83 08 Data Ascii: $zMxP ;7-`'IDW9x`>y;i)?w78svi&V(=S0b`zN]Wu.74PqJNMi63@+9'%q{`3f"=jtL05 g;)=rX[ks0E`~x
Jan 10, 2025 23:40:54.311741114 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 22:40:54 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=33d1484f22f0d711475b852d9d00310b\|8.46.123.189\|1736548854\|1736548854\|0\|1\|0; path=/; domain=.pywolwnvd.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.189; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49705	18.141.10.107	80	4452	C:\Users\user\Desktop\LiuUGJK9vH.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:40:54.612068892 CET	346	OUT	POST /rai HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ssbzmoy.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 802
Jan 10, 2025 23:40:54.612068892 CET	802	OUT	Data Raw: 9a 05 ed 2b 44 6c cc 99 16 03 00 00 35 3e 9b 19 32 3f 7d 7e ea 92 2f 70 99 66 6f 1e d1 37 ee ce 4f b2 71 95 8d 8e a9 5a e1 d3 2f c5 6b a4 24 d9 71 e9 1b 02 d8 fc 7e fa 1a 3e 6c c2 57 b8 9a 63 04 be 05 09 e9 5f df 47 e5 29 4f bd fd 3b 6f 86 a7 08 Data Ascii: +Dl5>2?}~/pfo7OqZ/k$q~>lWc_G)O;oW8]^(]Wc$6u_D%Ju1X_l8*LvE?nsT'IMGC>O{ML\{Ns<`I`IcR)dacxJWXDT1H

Target ID:	0
Start time:	17:40:51
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\LiuUGJK9vH.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\LiuUGJK9vH.exe"
Imagebase:	0x400000
File size:	1'761'792 bytes
MD5 hash:	690A2CBB7F785F6F90A0B510F31D40DE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	17:40:51
Start date:	10/01/2025
Path:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
Imagebase:	0x400000
File size:	1'658'880 bytes
MD5 hash:	1E28FD404AAE9396AA5D6A1141873E0E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Target ID:	3
Start time:	17:40:52
Start date:	10/01/2025
Path:	C:\Windows\System32\alg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\alg.exe
Imagebase:	0x140000000
File size:	1'594'368 bytes
MD5 hash:	01FCE6399A1AC48F9D7931507B2534BB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Target ID:	4
Start time:	17:40:52
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\LiuUGJK9vH.exe"
Imagebase:	0x6e0000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.1792348155.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.1793038630.0000000003950000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	17:40:52
Start date:	10/01/2025
Path:	C:\Windows\System32\drivers\AppVStrm.sys
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	138'056 bytes
MD5 hash:	BDA55F89B69757320BC125FF1CB53B26
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Target ID:	6
Start time:	17:40:52
Start date:	10/01/2025
Path:	C:\Windows\System32\drivers\AppvVemgr.sys
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	174'408 bytes
MD5 hash:	E70EE9B57F8D771E2F4D6E6B535F6757
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Target ID:	7
Start time:	17:40:52
Start date:	10/01/2025
Path:	C:\Windows\System32\drivers\AppvVfs.sys
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	154'952 bytes
MD5 hash:	2CBABD729D5E746B6BD8DC1B4B4DB1E1
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Target ID:	8
Start time:	17:40:52
Start date:	10/01/2025
Path:	C:\Windows\System32\AppVClient.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\AppVClient.exe
Imagebase:	0x140000000
File size:	1'348'608 bytes
MD5 hash:	04218364223ED3D355D0195140331BD0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true