Windows Analysis Report
ur3RqLz9DB.exe

Overview

General Information

Sample name: ur3RqLz9DB.exe
renamed because original name is a hash value
Original sample name: d444a977328b0f1b5e792a794ccd9fd0.exe
Analysis ID: 1649319
MD5: d444a977328b0f1b5e792a794ccd9fd0
SHA1: 32a67b71ebb303ee25928a1eb76c548d384589b8
SHA256: 07610c4fda6b5d6e8920d8da44a58213ef6c4309c794978477e81ed50f885150
Tags: exeuser-abuse_ch
Infos:

Detection

FormBook
Score: 100
Range: 0 - 100
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected FormBook
Binary is likely a compiled AutoIt script file
Found direct / indirect Syscall (likely to bypass EDR)
Joe Sandbox ML detected suspicious sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found evasive API chain (date check)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
Potential key logger detected (key state polling based)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Uncommon Svchost Parent Process
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: ur3RqLz9DB.exe Avira: detected
Antivirus detection for URL or domain
Source: http://www.anyang-590303492.click/6npl/ Avira URL Cloud: Label: malware
Source: http://www.anyang-590303492.click/6npl/?cDdD=stP4ZplpaL&ozr468=/JYiv5NhO0tELAK9kKXvJIbNp1Br4DUvi5BuLmngF2OWbpzZErtHeLuo5nDg79GzI2QTdod40q0r+J2P58yW98aolaIPcHKB8C+VtOL9beJx1TxkdNAFgpzfmMcKyLG5UVY24PM= Avira URL Cloud: Label: malware
Source: http://www.anyang-590303492.click Avira URL Cloud: Label: malware
Multi AV Scanner detection for submitted file
Source: ur3RqLz9DB.exe Virustotal: Detection: 40% Perma Link
Source: ur3RqLz9DB.exe ReversingLabs: Detection: 61%
Yara detected FormBook
Source: Yara match File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000C.00000002.3666779868.0000000005710000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.1425846454.0000000003F50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.3664924343.0000000004F10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.1420312107.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.3664866008.0000000004EC0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.3664817618.00000000025D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.1425884986.0000000003FA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.3663223364.0000000003220000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Joe Sandbox ML detected suspicious sample
Source: Submited Sample Neural Call Log Analysis: 80.6%
Uses 32bit PE files
Source: ur3RqLz9DB.exe Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: Binary string: ATBroker.pdb source: svchost.exe, 00000002.00000003.1388900042.000000000341B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1388992036.000000000342B000.00000004.00000020.00020000.00000000.sdmp, H7Vvr2xxn9Re.exe, 00000009.00000002.3664098402.00000000008FE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdbUGP source: ur3RqLz9DB.exe, 00000000.00000003.1201571321.0000000003350000.00000004.00001000.00020000.00000000.sdmp, ur3RqLz9DB.exe, 00000000.00000003.1202318293.00000000034F0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1330876090.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1332437774.0000000003A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1424280577.0000000003D9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1424280577.0000000003C00000.00000040.00001000.00020000.00000000.sdmp, AtBroker.exe, 0000000B.00000003.1426469265.000000000512A000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000B.00000003.1421604729.0000000004F77000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000B.00000002.3665348862.000000000546E000.00000040.00001000.00020000.00000000.sdmp, AtBroker.exe, 0000000B.00000002.3665348862.00000000052D0000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: ur3RqLz9DB.exe, 00000000.00000003.1201571321.0000000003350000.00000004.00001000.00020000.00000000.sdmp, ur3RqLz9DB.exe, 00000000.00000003.1202318293.00000000034F0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.1330876090.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1332437774.0000000003A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1424280577.0000000003D9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1424280577.0000000003C00000.00000040.00001000.00020000.00000000.sdmp, AtBroker.exe, AtBroker.exe, 0000000B.00000003.1426469265.000000000512A000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000B.00000003.1421604729.0000000004F77000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000B.00000002.3665348862.000000000546E000.00000040.00001000.00020000.00000000.sdmp, AtBroker.exe, 0000000B.00000002.3665348862.00000000052D0000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: ATBroker.pdbGCTL source: svchost.exe, 00000002.00000003.1388900042.000000000341B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1388992036.000000000342B000.00000004.00000020.00020000.00000000.sdmp, H7Vvr2xxn9Re.exe, 00000009.00000002.3664098402.00000000008FE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Work\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: H7Vvr2xxn9Re.exe, 00000009.00000002.3663704781.00000000005CF000.00000002.00000001.01000000.00000007.sdmp, H7Vvr2xxn9Re.exe, 0000000C.00000000.1491580006.00000000005CF000.00000002.00000001.01000000.00000007.sdmp
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DD445A GetFileAttributesW,FindFirstFileW,FindClose, 0_2_00DD445A
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DDC6D1 FindFirstFileW,FindClose, 0_2_00DDC6D1
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DDC75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, 0_2_00DDC75C
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DDEF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 0_2_00DDEF95
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DDF0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 0_2_00DDF0F2
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DDF3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose, 0_2_00DDF3F3
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DD37EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 0_2_00DD37EF
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DD3B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 0_2_00DD3B12
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DDBCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose, 0_2_00DDBCBC
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0323C7B0 FindFirstFileW,FindNextFileW,FindClose, 11_2_0323C7B0
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 4x nop then xor eax, eax 11_2_03229F90
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 4x nop then pop edi 11_2_0322E388
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 4x nop then mov ebx, 00000004h 11_2_050204F0

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:49724 -> 156.237.132.252:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49734 -> 52.223.13.41:80
Source: Network traffic Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:49712 -> 52.223.13.41:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49723 -> 156.237.132.252:80
Source: Network traffic Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:49708 -> 45.56.79.23:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49730 -> 104.21.32.1:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49725 -> 159.198.64.72:80
Source: Network traffic Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:49720 -> 45.119.52.125:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49727 -> 159.198.64.72:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49705 -> 45.56.79.23:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49710 -> 52.223.13.41:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49702 -> 149.104.1.185:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49713 -> 76.223.54.146:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49714 -> 76.223.54.146:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49733 -> 52.223.13.41:80
Source: Network traffic Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:49703 -> 149.104.1.185:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49700 -> 149.104.1.185:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49711 -> 52.223.13.41:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49706 -> 45.56.79.23:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49709 -> 52.223.13.41:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49739 -> 199.59.243.160:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49721 -> 156.237.132.252:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49701 -> 149.104.1.185:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49707 -> 45.56.79.23:80
Source: Network traffic Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:49740 -> 199.59.243.160:80
Source: Network traffic Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:49716 -> 76.223.54.146:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49738 -> 199.59.243.160:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49722 -> 156.237.132.252:80
Source: Network traffic Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:49697 -> 75.2.103.23:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49717 -> 45.119.52.125:80
Source: Network traffic Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:49728 -> 159.198.64.72:80
Source: Network traffic Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:49736 -> 52.223.13.41:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49737 -> 199.59.243.160:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49715 -> 76.223.54.146:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49731 -> 104.21.32.1:80
Source: Network traffic Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:49732 -> 104.21.32.1:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49718 -> 45.119.52.125:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49729 -> 104.21.32.1:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49719 -> 45.119.52.125:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49735 -> 52.223.13.41:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49726 -> 159.198.64.72:80
Performs DNS queries to domains with low reputation
Source: DNS query: www.vczuahand.xyz
Source: DNS query: www.855696a.xyz
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 75.2.103.23 75.2.103.23
Source: Joe Sandbox View IP Address: 75.2.103.23 75.2.103.23
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: DXTL-HKDXTLTseungKwanOServiceHK DXTL-HKDXTLTseungKwanOServiceHK
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DE22EE InternetReadFile,InternetQueryDataAvailable,InternetReadFile, 0_2_00DE22EE
Source: global traffic HTTP traffic detected: GET /d4kl/?cDdD=stP4ZplpaL&ozr468=6y/7tod/VF/KHUQqfM/wfVXibkdmZeeslXhDnWhvAY/z/yk3pdRRAQekYBjFWPUzPUKr4nIOcHvctiu99XDhRThC3drFG1AKyOu1/GM/3foXIXDjLpVuiIMe4xDFitXr6UESTD8= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeHost: www.thykingdomwear.storeUser-Agent: Mozilla/5.0 (Linux; Android 4.0.4; Mystery Android Smart TV Build/MYSTERY.SMARTTV.20130816) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.107 Safari/537.36 OPR/29.0.1809.93516
Source: global traffic HTTP traffic detected: GET /1imc/?ozr468=GkZ+7lZN5ZbT6rZBuZ+pskfJL+6uT56R2eAXidPe90Y9rybDHdv8GRqVb6FfMfkpXSVDgNv2zaXT/X0CpEMH0N+STTXuzFNw3Wjf+jehbJrVtlfd/HcDvzHP8gjPYHuSisWP2uY=&cDdD=stP4ZplpaL HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeHost: www.worrr37.yachtsUser-Agent: Mozilla/5.0 (Linux; Android 4.0.4; Mystery Android Smart TV Build/MYSTERY.SMARTTV.20130816) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.107 Safari/537.36 OPR/29.0.1809.93516
Source: global traffic HTTP traffic detected: GET /ma0g/?cDdD=stP4ZplpaL&ozr468=H2S90RmziCMvLCuL5yTkJF203ndQbU/T+UjWuF5QkK5TSoHa4lhKP7xjBIvwYHsxlglzK0GWG6GIcHietPpq3u1xo8xOmDzYv29+zWu49xgJoIdTnmgsG6PvYBy+sv7ZAol6cbU= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeHost: www.soportemx-findmy.clickUser-Agent: Mozilla/5.0 (Linux; Android 4.0.4; Mystery Android Smart TV Build/MYSTERY.SMARTTV.20130816) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.107 Safari/537.36 OPR/29.0.1809.93516
Source: global traffic HTTP traffic detected: GET /04r3/?ozr468=n6ptdLvBCapBX+1eOVrY57v3fry5rNe0wfWRjljnFiAjsKOl5dK99Lywx+Nqo77d2RcdyHveJO2lBX31lOnFwP4DiaLEptsC1XkRtKVSKvMDZubQIvkodV1VkZmdBzb+FDEJdsk=&cDdD=stP4ZplpaL HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeHost: www.blackhat.chatUser-Agent: Mozilla/5.0 (Linux; Android 4.0.4; Mystery Android Smart TV Build/MYSTERY.SMARTTV.20130816) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.107 Safari/537.36 OPR/29.0.1809.93516
Source: global traffic HTTP traffic detected: GET /lvz4/?cDdD=stP4ZplpaL&ozr468=Xs1PCb/MaYPIPAxDxxaHIqF2/A8U3qhMCQOIGo7Nl8rFa4QZz+K5GgFtLYl71/JRpNHUa5jW6jDEqn+5iMTLSNLkc8YJlW5E2D1BSRT+HZ6nP/WGftokHNP7u6RzqEi71eoyHuI= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeHost: www.vczuahand.xyzUser-Agent: Mozilla/5.0 (Linux; Android 4.0.4; Mystery Android Smart TV Build/MYSTERY.SMARTTV.20130816) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.107 Safari/537.36 OPR/29.0.1809.93516
Source: global traffic HTTP traffic detected: GET /q86a/?ozr468=1RS/DLESjC/mKKX9C/bcN2l/5Bt+ZmCCo7MGFq+OZJ2Pg2HsdXdlDjVOv2U28y6Xqr87siUnw8FG4MQCr+RpC7pac3hRrF1oQLqjSje52VN+B6b6adpmSyob2sUKv/kGLVH3Cqc=&cDdD=stP4ZplpaL HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeHost: www.855696a.xyzUser-Agent: Mozilla/5.0 (Linux; Android 4.0.4; Mystery Android Smart TV Build/MYSTERY.SMARTTV.20130816) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.107 Safari/537.36 OPR/29.0.1809.93516
Source: global traffic HTTP traffic detected: GET /pl23/?cDdD=stP4ZplpaL&ozr468=pwQm/8Nry++CWhwRO+ejyUFgfXoh51ib9cWiDzs/wKG7gU2SU1fIaah3O92QYMu9f5MkpzQiI887Voc7ljrK/R3yynuYM58fVphvPJKYT3CABWaKCWuFCzEUpSJ0ILCgd/ynwhk= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeHost: www.headset2.onlineUser-Agent: Mozilla/5.0 (Linux; Android 4.0.4; Mystery Android Smart TV Build/MYSTERY.SMARTTV.20130816) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.107 Safari/537.36 OPR/29.0.1809.93516
Source: global traffic HTTP traffic detected: GET /q4wg/?ozr468=WxORhD4RgEO5uNW054qboO521K/0wGPJQFKGj9LBFcZ0l1e50YnvQ+dx8Uckd3rx1A/7IdNYVLsTEbVWPiDE8n0pQ78tBy34YYRsbULys/fjLZWWaxsBK8nxhK81YtojfvhT+HM=&cDdD=stP4ZplpaL HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeHost: www.futureedge.websiteUser-Agent: Mozilla/5.0 (Linux; Android 4.0.4; Mystery Android Smart TV Build/MYSTERY.SMARTTV.20130816) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.107 Safari/537.36 OPR/29.0.1809.93516
Source: global traffic HTTP traffic detected: GET /b8n0/?cDdD=stP4ZplpaL&ozr468=kyUzpDR/GXT4UV//iqvRLnY+eQXzbNV1bnrOTHFLjUDm6VF6u4qvCiKuxhi22xyg+3lxI6NA/7DjeYVJhJi67v5q4tTDAvXxPCq83WXZKr6TWx16frnB/g5qvZTiCz/SxNGe/N0= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeHost: www.meshki-co-uk.shopUser-Agent: Mozilla/5.0 (Linux; Android 4.0.4; Mystery Android Smart TV Build/MYSTERY.SMARTTV.20130816) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.107 Safari/537.36 OPR/29.0.1809.93516
Source: global traffic HTTP traffic detected: GET /c25v/?ozr468=cYQQc4YiFu4DU/POoXdW37/GhYioUbtBJdcMk5WX7gXoSnlFiQLvf2mm8gqHlRakhV+z//0r9RcnPHcD6pi3sDYiTEcusg55GsFJIP0GJUvkZSoStgEPqqD4HSdKtL3zEIrHQIE=&cDdD=stP4ZplpaL HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeHost: www.forjoyi.liveUser-Agent: Mozilla/5.0 (Linux; Android 4.0.4; Mystery Android Smart TV Build/MYSTERY.SMARTTV.20130816) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.107 Safari/537.36 OPR/29.0.1809.93516
Source: global traffic HTTP traffic detected: GET /6npl/?cDdD=stP4ZplpaL&ozr468=/JYiv5NhO0tELAK9kKXvJIbNp1Br4DUvi5BuLmngF2OWbpzZErtHeLuo5nDg79GzI2QTdod40q0r+J2P58yW98aolaIPcHKB8C+VtOL9beJx1TxkdNAFgpzfmMcKyLG5UVY24PM= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeHost: www.anyang-590303492.clickUser-Agent: Mozilla/5.0 (Linux; Android 4.0.4; Mystery Android Smart TV Build/MYSTERY.SMARTTV.20130816) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.107 Safari/537.36 OPR/29.0.1809.93516
Source: global traffic DNS traffic detected: DNS query: www.thykingdomwear.store
Source: global traffic DNS traffic detected: DNS query: www.worrr37.yachts
Source: global traffic DNS traffic detected: DNS query: www.soportemx-findmy.click
Source: global traffic DNS traffic detected: DNS query: www.blackhat.chat
Source: global traffic DNS traffic detected: DNS query: www.vczuahand.xyz
Source: global traffic DNS traffic detected: DNS query: www.855696a.xyz
Source: global traffic DNS traffic detected: DNS query: www.headset2.online
Source: global traffic DNS traffic detected: DNS query: www.futureedge.website
Source: global traffic DNS traffic detected: DNS query: www.meshki-co-uk.shop
Source: global traffic DNS traffic detected: DNS query: www.forjoyi.live
Source: global traffic DNS traffic detected: DNS query: www.anyang-590303492.click
Source: unknown HTTP traffic detected: POST /1imc/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.5Content-Length: 211Cache-Control: no-cacheConnection: closeContent-Type: application/x-www-form-urlencodedHost: www.worrr37.yachtsOrigin: http://www.worrr37.yachtsReferer: http://www.worrr37.yachts/1imc/User-Agent: Mozilla/5.0 (Linux; Android 4.0.4; Mystery Android Smart TV Build/MYSTERY.SMARTTV.20130816) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.107 Safari/537.36 OPR/29.0.1809.93516Data Raw: 6f 7a 72 34 36 38 3d 4c 6d 78 65 34 54 34 4a 6f 62 69 43 32 4b 42 56 35 63 79 37 76 6e 44 6e 4f 70 79 32 51 4b 61 75 77 39 34 75 30 4b 44 77 36 31 49 58 67 6c 4b 4c 46 6f 76 6b 48 46 6d 36 66 71 4e 54 47 71 64 57 4c 51 4e 57 70 64 44 4a 33 71 4b 47 39 6e 73 54 74 30 77 53 6d 4d 6d 66 64 77 53 39 6c 46 64 77 33 53 32 61 67 77 72 71 62 4f 4c 41 74 68 66 6e 2b 32 59 69 32 68 36 2b 6a 57 37 57 4f 31 48 54 74 75 44 43 32 72 59 67 52 2b 4f 2b 6b 66 56 71 64 35 51 50 6f 59 78 75 6e 32 77 78 46 32 74 75 73 52 58 2f 41 37 67 4e 70 7a 31 35 31 31 72 75 47 4e 69 4f 31 61 39 45 34 73 46 45 46 4c 50 2f 64 69 37 54 53 77 42 6b 43 4d 76 62 Data Ascii: ozr468=Lmxe4T4JobiC2KBV5cy7vnDnOpy2QKauw94u0KDw61IXglKLFovkHFm6fqNTGqdWLQNWpdDJ3qKG9nsTt0wSmMmfdwS9lFdw3S2agwrqbOLAthfn+2Yi2h6+jW7WO1HTtuDC2rYgR+O+kfVqd5QPoYxun2wxF2tusRX/A7gNpz1511ruGNiO1a9E4sFEFLP/di7TSwBkCMvb
Source: global traffic HTTP traffic detected: HTTP/1.1 403 Forbiddenserver: openresty/1.13.6.1date: Wed, 26 Mar 2025 15:47:15 GMTcontent-type: text/htmlcontent-length: 577x-fail-reason: Bad Actorconnection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 31 33 2e 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>openresty/1.13.6.1</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic HTTP traffic detected: HTTP/1.1 403 Forbiddenserver: openresty/1.13.6.1date: Wed, 26 Mar 2025 15:47:18 GMTcontent-type: text/htmlcontent-length: 577x-fail-reason: Bad Actorconnection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 31 33 2e 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>openresty/1.13.6.1</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic HTTP traffic detected: HTTP/1.1 403 Forbiddenserver: openresty/1.13.6.1date: Wed, 26 Mar 2025 15:47:20 GMTcontent-type: text/htmlcontent-length: 577x-fail-reason: Bad Actorconnection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 31 33 2e 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>openresty/1.13.6.1</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 26 Mar 2025 15:47:54 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "67c25548-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 26 Mar 2025 15:47:57 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "67c25548-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 26 Mar 2025 15:48:00 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "67c25548-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 26 Mar 2025 15:48:03 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "67c25548-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 26 Mar 2025 15:48:09 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 26 Mar 2025 15:48:12 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 26 Mar 2025 15:48:14 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 26 Mar 2025 15:48:17 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 26 Mar 2025 15:48:23 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 26 Mar 2025 15:48:26 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 26 Mar 2025 15:48:28 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 26 Mar 2025 15:48:31 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: H7Vvr2xxn9Re.exe, 0000000C.00000002.3666779868.0000000005764000.00000040.80000000.00040000.00000000.sdmp String found in binary or memory: http://www.anyang-590303492.click
Source: H7Vvr2xxn9Re.exe, 0000000C.00000002.3666779868.0000000005764000.00000040.80000000.00040000.00000000.sdmp String found in binary or memory: http://www.anyang-590303492.click/6npl/
Source: AtBroker.exe, 0000000B.00000003.1606205047.0000000008538000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org?q=
Source: AtBroker.exe, 0000000B.00000003.1606205047.0000000008538000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: AtBroker.exe, 0000000B.00000003.1606205047.0000000008538000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: AtBroker.exe, 0000000B.00000003.1606205047.0000000008538000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: AtBroker.exe, 0000000B.00000003.1606205047.0000000008538000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: AtBroker.exe, 0000000B.00000003.1606205047.0000000008538000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtabv20-
Source: AtBroker.exe, 0000000B.00000003.1606205047.0000000008538000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: AtBroker.exe, 0000000B.00000003.1606205047.0000000008538000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gemini.google.com/app?q=
Source: AtBroker.exe, 0000000B.00000002.3663511619.0000000003358000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: AtBroker.exe, 0000000B.00000002.3663511619.0000000003358000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: AtBroker.exe, 0000000B.00000003.1599632989.0000000008513000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srfhttps://login.
Source: AtBroker.exe, 0000000B.00000002.3663511619.0000000003358000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_desktop.srf
Source: AtBroker.exe, 0000000B.00000002.3663511619.0000000003358000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2LMEM
Source: AtBroker.exe, 0000000B.00000002.3663511619.0000000003358000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: AtBroker.exe, 0000000B.00000002.3663511619.0000000003358000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033LMEM
Source: AtBroker.exe, 0000000B.00000002.3663511619.0000000003358000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: AtBroker.exe, 0000000B.00000002.3663511619.0000000003358000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_desktop.srfvb$
Source: AtBroker.exe, 0000000B.00000002.3663511619.0000000003358000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: AtBroker.exe, 0000000B.00000002.3663511619.0000000003358000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: AtBroker.exe, 0000000B.00000003.1606205047.0000000008538000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/v20
Source: AtBroker.exe, 0000000B.00000002.3667456160.0000000008290000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 0000000B.00000002.3665802951.0000000006C98000.00000004.10000000.00040000.00000000.sdmp, H7Vvr2xxn9Re.exe, 0000000C.00000002.3665096491.0000000004678000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://www.google.com
Source: AtBroker.exe, 0000000B.00000003.1606205047.0000000008538000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DE4164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard, 0_2_00DE4164
Contains functionality to modify clipboard data
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DE4164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard, 0_2_00DE4164
Contains functionality to read the clipboard data
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DE3F66 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard, 0_2_00DE3F66
Contains functionality to retrieve information about pressed keystrokes
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DD001C GetKeyboardState,SetKeyboardState,GetAsyncKeyState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState, 0_2_00DD001C
Potential key logger detected (key state polling based)
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DFCABC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW, 0_2_00DFCABC

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000C.00000002.3666779868.0000000005710000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.1425846454.0000000003F50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.3664924343.0000000004F10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.1420312107.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.3664866008.0000000004EC0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.3664817618.00000000025D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.1425884986.0000000003FA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.3663223364.0000000003220000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

System Summary
barindex
Binary is likely a compiled AutoIt script file
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: This is a third-party compiled AutoIt script. 0_2_00D73B3A
Source: ur3RqLz9DB.exe String found in binary or memory: This is a third-party compiled AutoIt script.
Source: ur3RqLz9DB.exe, 00000000.00000002.1206579755.0000000000E24000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: This is a third-party compiled AutoIt script. memstr_35648b79-5
Source: ur3RqLz9DB.exe, 00000000.00000002.1206579755.0000000000E24000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer` memstr_3852e6fe-2
Source: ur3RqLz9DB.exe String found in binary or memory: This is a third-party compiled AutoIt script. memstr_c7c2f42f-2
Source: ur3RqLz9DB.exe String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer` memstr_2c6e94be-a
Contains functionality to call native functions
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_0042CA23 NtClose, 2_2_0042CA23
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72B60 NtClose,LdrInitializeThunk, 2_2_03C72B60
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72DF0 NtQuerySystemInformation,LdrInitializeThunk, 2_2_03C72DF0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C735C0 NtCreateMutant,LdrInitializeThunk, 2_2_03C735C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C74340 NtSetContextThread, 2_2_03C74340
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C74650 NtSuspendThread, 2_2_03C74650
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72BE0 NtQueryValueKey, 2_2_03C72BE0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72BF0 NtAllocateVirtualMemory, 2_2_03C72BF0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72B80 NtQueryInformationFile, 2_2_03C72B80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72BA0 NtEnumerateValueKey, 2_2_03C72BA0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72AD0 NtReadFile, 2_2_03C72AD0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72AF0 NtWriteFile, 2_2_03C72AF0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72AB0 NtWaitForSingleObject, 2_2_03C72AB0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72FE0 NtCreateFile, 2_2_03C72FE0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72F90 NtProtectVirtualMemory, 2_2_03C72F90
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72FA0 NtQuerySection, 2_2_03C72FA0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72FB0 NtResumeThread, 2_2_03C72FB0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72F60 NtCreateProcessEx, 2_2_03C72F60
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72F30 NtCreateSection, 2_2_03C72F30
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72EE0 NtQueueApcThread, 2_2_03C72EE0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72E80 NtReadVirtualMemory, 2_2_03C72E80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72EA0 NtAdjustPrivilegesToken, 2_2_03C72EA0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72E30 NtWriteVirtualMemory, 2_2_03C72E30
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72DD0 NtDelayExecution, 2_2_03C72DD0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72DB0 NtEnumerateKey, 2_2_03C72DB0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72D00 NtSetInformationFile, 2_2_03C72D00
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72D10 NtMapViewOfSection, 2_2_03C72D10
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72D30 NtUnmapViewOfSection, 2_2_03C72D30
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72CC0 NtQueryVirtualMemory, 2_2_03C72CC0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72CF0 NtOpenProcess, 2_2_03C72CF0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72CA0 NtQueryInformationToken, 2_2_03C72CA0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72C60 NtCreateKey, 2_2_03C72C60
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72C70 NtFreeVirtualMemory, 2_2_03C72C70
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72C00 NtQueryInformationProcess, 2_2_03C72C00
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C73090 NtSetValueKey, 2_2_03C73090
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C73010 NtOpenDirectoryObject, 2_2_03C73010
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C739B0 NtGetContextThread, 2_2_03C739B0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C73D70 NtOpenThread, 2_2_03C73D70
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C73D10 NtOpenProcessToken, 2_2_03C73D10
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05344650 NtSuspendThread,LdrInitializeThunk, 11_2_05344650
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05344340 NtSetContextThread,LdrInitializeThunk, 11_2_05344340
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05342D30 NtUnmapViewOfSection,LdrInitializeThunk, 11_2_05342D30
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05342D10 NtMapViewOfSection,LdrInitializeThunk, 11_2_05342D10
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05342DF0 NtQuerySystemInformation,LdrInitializeThunk, 11_2_05342DF0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05342DD0 NtDelayExecution,LdrInitializeThunk, 11_2_05342DD0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05342C70 NtFreeVirtualMemory,LdrInitializeThunk, 11_2_05342C70
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05342C60 NtCreateKey,LdrInitializeThunk, 11_2_05342C60
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05342CA0 NtQueryInformationToken,LdrInitializeThunk, 11_2_05342CA0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05342F30 NtCreateSection,LdrInitializeThunk, 11_2_05342F30
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05342FB0 NtResumeThread,LdrInitializeThunk, 11_2_05342FB0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05342FE0 NtCreateFile,LdrInitializeThunk, 11_2_05342FE0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05342E80 NtReadVirtualMemory,LdrInitializeThunk, 11_2_05342E80
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05342EE0 NtQueueApcThread,LdrInitializeThunk, 11_2_05342EE0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05342B60 NtClose,LdrInitializeThunk, 11_2_05342B60
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05342BA0 NtEnumerateValueKey,LdrInitializeThunk, 11_2_05342BA0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05342BF0 NtAllocateVirtualMemory,LdrInitializeThunk, 11_2_05342BF0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05342BE0 NtQueryValueKey,LdrInitializeThunk, 11_2_05342BE0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05342AF0 NtWriteFile,LdrInitializeThunk, 11_2_05342AF0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05342AD0 NtReadFile,LdrInitializeThunk, 11_2_05342AD0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_053435C0 NtCreateMutant,LdrInitializeThunk, 11_2_053435C0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_053439B0 NtGetContextThread,LdrInitializeThunk, 11_2_053439B0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05342D00 NtSetInformationFile, 11_2_05342D00
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05342DB0 NtEnumerateKey, 11_2_05342DB0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05342C00 NtQueryInformationProcess, 11_2_05342C00
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05342CF0 NtOpenProcess, 11_2_05342CF0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05342CC0 NtQueryVirtualMemory, 11_2_05342CC0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05342F60 NtCreateProcessEx, 11_2_05342F60
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05342FA0 NtQuerySection, 11_2_05342FA0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05342F90 NtProtectVirtualMemory, 11_2_05342F90
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05342E30 NtWriteVirtualMemory, 11_2_05342E30
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05342EA0 NtAdjustPrivilegesToken, 11_2_05342EA0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05342B80 NtQueryInformationFile, 11_2_05342B80
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05342AB0 NtWaitForSingleObject, 11_2_05342AB0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05343010 NtOpenDirectoryObject, 11_2_05343010
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05343090 NtSetValueKey, 11_2_05343090
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05343D10 NtOpenProcessToken, 11_2_05343D10
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05343D70 NtOpenThread, 11_2_05343D70
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_032492F0 NtCreateFile, 11_2_032492F0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_03249750 NtAllocateVirtualMemory, 11_2_03249750
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_03249550 NtDeleteFile, 11_2_03249550
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_032495F0 NtClose, 11_2_032495F0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_03249460 NtReadFile, 11_2_03249460
Contains functionality to communicate with device drivers
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DDA1EF: GetFullPathNameW,__swprintf,CreateDirectoryW,CreateFileW,_memset,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle, 0_2_00DDA1EF
Contains functionality to launch a process as a different user
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DC8310 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock, 0_2_00DC8310
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DD51BD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState, 0_2_00DD51BD
Detected potential crypto function
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00D9D975 0_2_00D9D975
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00D921C5 0_2_00D921C5
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DA62D2 0_2_00DA62D2
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DF03DA 0_2_00DF03DA
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DA242E 0_2_00DA242E
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00D925FA 0_2_00D925FA
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00D866E1 0_2_00D866E1
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00D7E6A0 0_2_00D7E6A0
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DCE616 0_2_00DCE616
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DA878F 0_2_00DA878F
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DD8889 0_2_00DD8889
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DF0857 0_2_00DF0857
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DA6844 0_2_00DA6844
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00D88808 0_2_00D88808
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00D9CB21 0_2_00D9CB21
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DA6DB6 0_2_00DA6DB6
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00D86F9E 0_2_00D86F9E
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00D83030 0_2_00D83030
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00D9F1D9 0_2_00D9F1D9
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00D93187 0_2_00D93187
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00D71287 0_2_00D71287
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00D91484 0_2_00D91484
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00D85520 0_2_00D85520
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00D97696 0_2_00D97696
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00D85760 0_2_00D85760
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00D91978 0_2_00D91978
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DA9AB5 0_2_00DA9AB5
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00D7FCE0 0_2_00D7FCE0
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DF7DDB 0_2_00DF7DDB
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00D91D90 0_2_00D91D90
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00D9BDA6 0_2_00D9BDA6
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00D83FE0 0_2_00D83FE0
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00D7DF00 0_2_00D7DF00
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00911B08 0_2_00911B08
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_00418993 2_2_00418993
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_0042F043 2_2_0042F043
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_00402870 2_2_00402870
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_0041017A 2_2_0041017A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_00410183 2_2_00410183
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_00403190 2_2_00403190
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_00401240 2_2_00401240
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_0040E383 2_2_0040E383
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_00416B8F 2_2_00416B8F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_00416B93 2_2_00416B93
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_004103A3 2_2_004103A3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_00402C74 2_2_00402C74
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_0040E4C7 2_2_0040E4C7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_0040E4D3 2_2_0040E4D3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_00402C80 2_2_00402C80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_0040E51C 2_2_0040E51C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_004045E4 2_2_004045E4
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_004047A5 2_2_004047A5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4E3F0 2_2_03C4E3F0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D003E6 2_2_03D003E6
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CFA352 2_2_03CFA352
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC02C0 2_2_03CC02C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE0274 2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF81CC 2_2_03CF81CC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF41A2 2_2_03CF41A2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D001AA 2_2_03D001AA
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC8158 2_2_03CC8158
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C30100 2_2_03C30100
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDA118 2_2_03CDA118
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CD2000 2_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3C7C0 2_2_03C3C7C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C64750 2_2_03C64750
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40770 2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5C6E0 2_2_03C5C6E0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D00591 2_2_03D00591
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40535 2_2_03C40535
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CEE4F6 2_2_03CEE4F6
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF2446 2_2_03CF2446
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE4420 2_2_03CE4420
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF6BD7 2_2_03CF6BD7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CFAB40 2_2_03CFAB40
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3EA80 2_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D0A9A6 2_2_03D0A9A6
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C56962 2_2_03C56962
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6E8F0 2_2_03C6E8F0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C268B8 2_2_03C268B8
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4A840 2_2_03C4A840
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C32FC8 2_2_03C32FC8
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4CFE0 2_2_03C4CFE0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CBEFA0 2_2_03CBEFA0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB4F40 2_2_03CB4F40
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C82F28 2_2_03C82F28
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C60F30 2_2_03C60F30
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE2F30 2_2_03CE2F30
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CFEEDB 2_2_03CFEEDB
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C52E90 2_2_03C52E90
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CFCE93 2_2_03CFCE93
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40E59 2_2_03C40E59
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CFEE26 2_2_03CFEE26
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3ADE0 2_2_03C3ADE0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C58DBF 2_2_03C58DBF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4AD00 2_2_03C4AD00
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDCD1F 2_2_03CDCD1F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C30CF2 2_2_03C30CF2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE0CB5 2_2_03CE0CB5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40C00 2_2_03C40C00
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C8739A 2_2_03C8739A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2D34C 2_2_03C2D34C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF132D 2_2_03CF132D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5B2C0 2_2_03C5B2C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE12ED 2_2_03CE12ED
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C452A0 2_2_03C452A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4B1B0 2_2_03C4B1B0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C7516C 2_2_03C7516C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2F172 2_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D0B16B 2_2_03D0B16B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CEF0CC 2_2_03CEF0CC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF70E9 2_2_03CF70E9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CFF0E0 2_2_03CFF0E0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CFF7B0 2_2_03CFF7B0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF16CC 2_2_03CF16CC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C85630 2_2_03C85630
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D095C3 2_2_03D095C3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDD5B0 2_2_03CDD5B0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF7571 2_2_03CF7571
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C31460 2_2_03C31460
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CFF43F 2_2_03CFF43F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB5BF0 2_2_03CB5BF0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C7DBF9 2_2_03C7DBF9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5FB80 2_2_03C5FB80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CFFB76 2_2_03CFFB76
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CEDAC6 2_2_03CEDAC6
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C85AA0 2_2_03C85AA0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE1AA3 2_2_03CE1AA3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CFFA49 2_2_03CFFA49
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF7A46 2_2_03CF7A46
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB3A6C 2_2_03CB3A6C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C49950 2_2_03C49950
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5B950 2_2_03C5B950
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CD5910 2_2_03CD5910
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C438E0 2_2_03C438E0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAD800 2_2_03CAD800
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C03FD2 2_2_03C03FD2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C03FD5 2_2_03C03FD5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C41F92 2_2_03C41F92
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CFFFB1 2_2_03CFFFB1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CFFF09 2_2_03CFFF09
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C49EB0 2_2_03C49EB0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5FDC0 2_2_03C5FDC0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C43D40 2_2_03C43D40
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF1D5A 2_2_03CF1D5A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF7D73 2_2_03CF7D73
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CFFCF2 2_2_03CFFCF2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB9C32 2_2_03CB9C32
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe Code function: 9_2_0281F5DC 9_2_0281F5DC
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe Code function: 9_2_028402FA 9_2_028402FA
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe Code function: 9_2_02827E46 9_2_02827E46
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe Code function: 9_2_02827E4A 9_2_02827E4A
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe Code function: 9_2_0282165A 9_2_0282165A
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe Code function: 9_2_02815A5C 9_2_02815A5C
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe Code function: 9_2_0281F78A 9_2_0281F78A
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe Code function: 9_2_0281F7D3 9_2_0281F7D3
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe Code function: 9_2_0281589B 9_2_0281589B
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe Code function: 9_2_02821431 9_2_02821431
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe Code function: 9_2_0282143A 9_2_0282143A
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05310535 11_2_05310535
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_053D0591 11_2_053D0591
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_053B4420 11_2_053B4420
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_053C2446 11_2_053C2446
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_053BE4F6 11_2_053BE4F6
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05310770 11_2_05310770
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05334750 11_2_05334750
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0530C7C0 11_2_0530C7C0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0532C6E0 11_2_0532C6E0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_053AA118 11_2_053AA118
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05300100 11_2_05300100
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05398158 11_2_05398158
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_053D01AA 11_2_053D01AA
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_053C41A2 11_2_053C41A2
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_053C81CC 11_2_053C81CC
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_053A2000 11_2_053A2000
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_053CA352 11_2_053CA352
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0531E3F0 11_2_0531E3F0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_053D03E6 11_2_053D03E6
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_053B0274 11_2_053B0274
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_053902C0 11_2_053902C0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_053ACD1F 11_2_053ACD1F
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0531AD00 11_2_0531AD00
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05328DBF 11_2_05328DBF
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0530ADE0 11_2_0530ADE0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05310C00 11_2_05310C00
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_053B0CB5 11_2_053B0CB5
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05300CF2 11_2_05300CF2
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05330F30 11_2_05330F30
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_053B2F30 11_2_053B2F30
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05352F28 11_2_05352F28
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05384F40 11_2_05384F40
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0538EFA0 11_2_0538EFA0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0531CFE0 11_2_0531CFE0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05302FC8 11_2_05302FC8
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_053CEE26 11_2_053CEE26
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05310E59 11_2_05310E59
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05322E90 11_2_05322E90
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_053CCE93 11_2_053CCE93
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_053CEEDB 11_2_053CEEDB
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05326962 11_2_05326962
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_053DA9A6 11_2_053DA9A6
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0531A840 11_2_0531A840
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_052F68B8 11_2_052F68B8
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0533E8F0 11_2_0533E8F0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_053CAB40 11_2_053CAB40
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_053C6BD7 11_2_053C6BD7
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0530EA80 11_2_0530EA80
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_053C7571 11_2_053C7571
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_053AD5B0 11_2_053AD5B0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_053D95C3 11_2_053D95C3
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_053CF43F 11_2_053CF43F
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05301460 11_2_05301460
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_053CF7B0 11_2_053CF7B0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05355630 11_2_05355630
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_053C16CC 11_2_053C16CC
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_053DB16B 11_2_053DB16B
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0534516C 11_2_0534516C
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_052FF172 11_2_052FF172
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0531B1B0 11_2_0531B1B0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_053C70E9 11_2_053C70E9
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_053CF0E0 11_2_053CF0E0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_053BF0CC 11_2_053BF0CC
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_053C132D 11_2_053C132D
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_052FD34C 11_2_052FD34C
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0535739A 11_2_0535739A
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_053152A0 11_2_053152A0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_053B12ED 11_2_053B12ED
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0532B2C0 11_2_0532B2C0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_053C7D73 11_2_053C7D73
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_053C1D5A 11_2_053C1D5A
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05313D40 11_2_05313D40
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0532FDC0 11_2_0532FDC0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05389C32 11_2_05389C32
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_053CFCF2 11_2_053CFCF2
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_053CFF09 11_2_053CFF09
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_053CFFB1 11_2_053CFFB1
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05311F92 11_2_05311F92
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05319EB0 11_2_05319EB0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_053A5910 11_2_053A5910
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05319950 11_2_05319950
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0532B950 11_2_0532B950
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0537D800 11_2_0537D800
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_053138E0 11_2_053138E0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_053CFB76 11_2_053CFB76
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0532FB80 11_2_0532FB80
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05385BF0 11_2_05385BF0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0534DBF9 11_2_0534DBF9
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05383A6C 11_2_05383A6C
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_053CFA49 11_2_053CFA49
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_053C7A46 11_2_053C7A46
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_05355AA0 11_2_05355AA0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_053B1AA3 11_2_053B1AA3
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_053BDAC6 11_2_053BDAC6
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_03231E90 11_2_03231E90
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0322CF70 11_2_0322CF70
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0322AF50 11_2_0322AF50
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0322CD47 11_2_0322CD47
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0322CD50 11_2_0322CD50
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_03221372 11_2_03221372
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_032211B1 11_2_032211B1
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0322B0A0 11_2_0322B0A0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0322B094 11_2_0322B094
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0322B0E9 11_2_0322B0E9
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_03233760 11_2_03233760
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0323375C 11_2_0323375C
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_03235560 11_2_03235560
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0324BC10 11_2_0324BC10
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0502E503 11_2_0502E503
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0502E3E4 11_2_0502E3E4
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0502D968 11_2_0502D968
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0502E89C 11_2_0502E89C
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: String function: 05357E54 appears 110 times
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: String function: 0537EA12 appears 86 times
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: String function: 05345130 appears 58 times
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: String function: 052FB970 appears 250 times
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: String function: 0538F290 appears 105 times
Source: C:\Windows\SysWOW64\svchost.exe Code function: String function: 03C87E54 appears 110 times
Source: C:\Windows\SysWOW64\svchost.exe Code function: String function: 03CBF290 appears 105 times
Source: C:\Windows\SysWOW64\svchost.exe Code function: String function: 03C75130 appears 58 times
Source: C:\Windows\SysWOW64\svchost.exe Code function: String function: 03C2B970 appears 250 times
Source: C:\Windows\SysWOW64\svchost.exe Code function: String function: 03CAEA12 appears 86 times
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: String function: 00D98900 appears 42 times
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: String function: 00D77DE1 appears 35 times
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: String function: 00D90AE3 appears 70 times
Sample file is different than original file name gathered from version info
Source: ur3RqLz9DB.exe, 00000000.00000003.1203526211.00000000034C3000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs ur3RqLz9DB.exe
Source: ur3RqLz9DB.exe, 00000000.00000003.1201257470.000000000361D000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs ur3RqLz9DB.exe
Uses 32bit PE files
Source: ur3RqLz9DB.exe Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@7/3@11/10
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DDA06A GetLastError,FormatMessageW, 0_2_00DDA06A
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DC81CB AdjustTokenPrivileges,CloseHandle, 0_2_00DC81CB
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DC87E1 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError, 0_2_00DC87E1
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DDB3FB SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode, 0_2_00DDB3FB
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DEEE0D CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle, 0_2_00DEEE0D
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DDC397 CoInitialize,CoCreateInstance,CoUninitialize, 0_2_00DDC397
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00D74E89 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource, 0_2_00D74E89
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe File created: C:\Users\user\AppData\Local\Temp\aut9976.tmp Jump to behavior
Source: ur3RqLz9DB.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Program Files\Mozilla Firefox\firefox.exe File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: AtBroker.exe, 0000000B.00000003.1604401529.00000000033C2000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000B.00000002.3663511619.00000000033B8000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000B.00000003.1600748500.0000000003396000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000B.00000003.1600868346.00000000033B8000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000B.00000002.3663511619.00000000033E4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: ur3RqLz9DB.exe Virustotal: Detection: 40%
Source: ur3RqLz9DB.exe ReversingLabs: Detection: 61%
Source: unknown Process created: C:\Users\user\Desktop\ur3RqLz9DB.exe "C:\Users\user\Desktop\ur3RqLz9DB.exe"
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\ur3RqLz9DB.exe"
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe Process created: C:\Windows\SysWOW64\AtBroker.exe "C:\Windows\SysWOW64\AtBroker.exe"
Source: C:\Windows\SysWOW64\AtBroker.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\ur3RqLz9DB.exe" Jump to behavior
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe Process created: C:\Windows\SysWOW64\AtBroker.exe "C:\Windows\SysWOW64\AtBroker.exe" Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe" Jump to behavior
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: mlang.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: winsqlite3.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\InProcServer32 Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\ Jump to behavior
Source: ur3RqLz9DB.exe Static file information: File size 1197056 > 1048576
Source: ur3RqLz9DB.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: ur3RqLz9DB.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: ur3RqLz9DB.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: ur3RqLz9DB.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: ur3RqLz9DB.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: ur3RqLz9DB.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: ur3RqLz9DB.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: ATBroker.pdb source: svchost.exe, 00000002.00000003.1388900042.000000000341B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1388992036.000000000342B000.00000004.00000020.00020000.00000000.sdmp, H7Vvr2xxn9Re.exe, 00000009.00000002.3664098402.00000000008FE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdbUGP source: ur3RqLz9DB.exe, 00000000.00000003.1201571321.0000000003350000.00000004.00001000.00020000.00000000.sdmp, ur3RqLz9DB.exe, 00000000.00000003.1202318293.00000000034F0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1330876090.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1332437774.0000000003A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1424280577.0000000003D9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1424280577.0000000003C00000.00000040.00001000.00020000.00000000.sdmp, AtBroker.exe, 0000000B.00000003.1426469265.000000000512A000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000B.00000003.1421604729.0000000004F77000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000B.00000002.3665348862.000000000546E000.00000040.00001000.00020000.00000000.sdmp, AtBroker.exe, 0000000B.00000002.3665348862.00000000052D0000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: ur3RqLz9DB.exe, 00000000.00000003.1201571321.0000000003350000.00000004.00001000.00020000.00000000.sdmp, ur3RqLz9DB.exe, 00000000.00000003.1202318293.00000000034F0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.1330876090.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1332437774.0000000003A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1424280577.0000000003D9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1424280577.0000000003C00000.00000040.00001000.00020000.00000000.sdmp, AtBroker.exe, AtBroker.exe, 0000000B.00000003.1426469265.000000000512A000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000B.00000003.1421604729.0000000004F77000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000B.00000002.3665348862.000000000546E000.00000040.00001000.00020000.00000000.sdmp, AtBroker.exe, 0000000B.00000002.3665348862.00000000052D0000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: ATBroker.pdbGCTL source: svchost.exe, 00000002.00000003.1388900042.000000000341B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1388992036.000000000342B000.00000004.00000020.00020000.00000000.sdmp, H7Vvr2xxn9Re.exe, 00000009.00000002.3664098402.00000000008FE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Work\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: H7Vvr2xxn9Re.exe, 00000009.00000002.3663704781.00000000005CF000.00000002.00000001.01000000.00000007.sdmp, H7Vvr2xxn9Re.exe, 0000000C.00000000.1491580006.00000000005CF000.00000002.00000001.01000000.00000007.sdmp
Source: ur3RqLz9DB.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: ur3RqLz9DB.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: ur3RqLz9DB.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: ur3RqLz9DB.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: ur3RqLz9DB.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00D74B37 LoadLibraryA,GetProcAddress, 0_2_00D74B37
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00D98945 push ecx; ret 0_2_00D98958
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_0041E85A push cs; ret 2_2_0041E85D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_0041A963 push edi; retf 2_2_0041A96E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_00411BB0 pushfd ; ret 2_2_00411BB1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_0041EC21 push 00000043h; iretd 2_2_0041EC23
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_00403430 push eax; ret 2_2_00403432
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_00414483 push edi; retf 2_2_0041448E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_00418566 push esp; ret 2_2_00418567
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_004015D0 push esp; ret 2_2_004015D2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C0225F pushad ; ret 2_2_03C027F9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C027FA pushad ; ret 2_2_03C027F9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C309AD push ecx; mov dword ptr [esp], ecx 2_2_03C309B6
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C0283D push eax; iretd 2_2_03C02858
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C01368 push eax; iretd 2_2_03C01369
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C01065 push edi; ret 2_2_03C0108A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C018F3 push edx; iretd 2_2_03C01906
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe Code function: 9_2_0282A21F push 0000007Eh; retf 9_2_0282A22E
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe Code function: 9_2_02822E67 pushfd ; ret 9_2_02822E68
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe Code function: 9_2_0282573A push edi; retf 9_2_02825745
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe Code function: 9_2_0282981D push esp; ret 9_2_0282981E
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_052D27FA pushad ; ret 11_2_052D27F9
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_052D225F pushad ; ret 11_2_052D27F9
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_053009AD push ecx; mov dword ptr [esp], ecx 11_2_053009B6
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_052D283D push eax; iretd 11_2_052D2858
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_052D1368 push eax; iretd 11_2_052D1369
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0322E3A2 push esi; retf 11_2_0322E3B7
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0322E3B0 push esi; retf 11_2_0322E3B7
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0323C25A push 00000033h; iretd 11_2_0323C263
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0323C194 push ebp; ret 11_2_0323C195
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0322E77D pushfd ; ret 11_2_0322E77E
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0323C63E push ecx; retf 11_2_0323C63F
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00D748D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput, 0_2_00D748D7
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DF5376 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed, 0_2_00DF5376
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00D93187 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 0_2_00D93187
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Switches to a custom stack to bypass stack traces
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe API/Special instruction interceptor: Address: 91172C
Source: C:\Windows\SysWOW64\AtBroker.exe API/Special instruction interceptor: Address: 7FF9105CD324
Source: C:\Windows\SysWOW64\AtBroker.exe API/Special instruction interceptor: Address: 7FF9105CD7E4
Source: C:\Windows\SysWOW64\AtBroker.exe API/Special instruction interceptor: Address: 7FF9105CD944
Source: C:\Windows\SysWOW64\AtBroker.exe API/Special instruction interceptor: Address: 7FF9105CD504
Source: C:\Windows\SysWOW64\AtBroker.exe API/Special instruction interceptor: Address: 7FF9105CD544
Source: C:\Windows\SysWOW64\AtBroker.exe API/Special instruction interceptor: Address: 7FF9105CD1E4
Source: C:\Windows\SysWOW64\AtBroker.exe API/Special instruction interceptor: Address: 7FF9105D0154
Source: C:\Windows\SysWOW64\AtBroker.exe API/Special instruction interceptor: Address: 7FF9105CDA44
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C7096E rdtsc 2_2_03C7096E
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\AtBroker.exe Window / User API: threadDelayed 1194 Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Window / User API: threadDelayed 8778 Jump to behavior
Found evasive API chain (date check)
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe API coverage: 4.4 %
Source: C:\Windows\SysWOW64\svchost.exe API coverage: 0.7 %
Source: C:\Windows\SysWOW64\AtBroker.exe API coverage: 2.7 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\SysWOW64\AtBroker.exe TID: 2436 Thread sleep count: 1194 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe TID: 2436 Thread sleep time: -2388000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe TID: 2436 Thread sleep count: 8778 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe TID: 2436 Thread sleep time: -17556000s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe TID: 5316 Thread sleep time: -65000s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe TID: 5316 Thread sleep time: -43500s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\SysWOW64\AtBroker.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\AtBroker.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DD445A GetFileAttributesW,FindFirstFileW,FindClose, 0_2_00DD445A
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DDC6D1 FindFirstFileW,FindClose, 0_2_00DDC6D1
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DDC75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, 0_2_00DDC75C
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DDEF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 0_2_00DDEF95
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DDF0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 0_2_00DDF0F2
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DDF3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose, 0_2_00DDF3F3
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DD37EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 0_2_00DD37EF
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DD3B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 0_2_00DD3B12
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DDBCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose, 0_2_00DDBCBC
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0323C7B0 FindFirstFileW,FindNextFileW,FindClose, 11_2_0323C7B0
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00D749A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo, 0_2_00D749A0
Source: 79T-I8k4c.11.dr Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: AtBroker.exe, 0000000B.00000002.3667580696.00000000085A4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: rdVMware20,11696487552
Source: 79T-I8k4c.11.dr Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: 79T-I8k4c.11.dr Binary or memory string: secure.bankofamerica.comVMware20,11696487552|UE
Source: 79T-I8k4c.11.dr Binary or memory string: discord.comVMware20,11696487552f
Source: 79T-I8k4c.11.dr Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: firefox.exe, 0000000D.00000002.1712906374.0000016191E60000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll;;,
Source: 79T-I8k4c.11.dr Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: 79T-I8k4c.11.dr Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: 79T-I8k4c.11.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: 79T-I8k4c.11.dr Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: 79T-I8k4c.11.dr Binary or memory string: global block list test formVMware20,11696487552
Source: 79T-I8k4c.11.dr Binary or memory string: tasks.office.comVMware20,11696487552o
Source: 79T-I8k4c.11.dr Binary or memory string: AMC password management pageVMware20,11696487552
Source: AtBroker.exe, 0000000B.00000002.3663511619.0000000003349000.00000004.00000020.00020000.00000000.sdmp, H7Vvr2xxn9Re.exe, 0000000C.00000002.3664344965.00000000013E9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: AtBroker.exe, 0000000B.00000002.3667580696.00000000085A4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - EU East & CentralVMware20,116964875
Source: 79T-I8k4c.11.dr Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: 79T-I8k4c.11.dr Binary or memory string: dev.azure.comVMware20,11696487552j
Source: 79T-I8k4c.11.dr Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: 79T-I8k4c.11.dr Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: AtBroker.exe, 0000000B.00000002.3667580696.00000000085A4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Transaction PasswordVMware20,11696487552}
Source: 79T-I8k4c.11.dr Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: 79T-I8k4c.11.dr Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: 79T-I8k4c.11.dr Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: 79T-I8k4c.11.dr Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: AtBroker.exe, 0000000B.00000002.3667580696.00000000085A4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: microsoft.visualstudio.comVMware20,116b=
Source: 79T-I8k4c.11.dr Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: 79T-I8k4c.11.dr Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: 79T-I8k4c.11.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: 79T-I8k4c.11.dr Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: 79T-I8k4c.11.dr Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: 79T-I8k4c.11.dr Binary or memory string: outlook.office.comVMware20,11696487552s
Source: 79T-I8k4c.11.dr Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: 79T-I8k4c.11.dr Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: 79T-I8k4c.11.dr Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: AtBroker.exe, 0000000B.00000002.3667580696.00000000085A4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ive Brokers - GDCDYNVMware20,11696487552X<
Source: 79T-I8k4c.11.dr Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: 79T-I8k4c.11.dr Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
Source: C:\Windows\SysWOW64\svchost.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Windows\SysWOW64\svchost.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C7096E rdtsc 2_2_03C7096E
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_00417B23 LdrLoadDll, 2_2_00417B23
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DE3F09 BlockInput, 0_2_00DE3F09
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00D73B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW, 0_2_00D73B3A
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DA5A7C EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, 0_2_00DA5A7C
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00D74B37 LoadLibraryA,GetProcAddress, 0_2_00D74B37
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00910378 mov eax, dword ptr fs:[00000030h] 0_2_00910378
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00911998 mov eax, dword ptr fs:[00000030h] 0_2_00911998
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_009119F8 mov eax, dword ptr fs:[00000030h] 0_2_009119F8
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CEC3CD mov eax, dword ptr fs:[00000030h] 2_2_03CEC3CD
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3A3C0 mov eax, dword ptr fs:[00000030h] 2_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3A3C0 mov eax, dword ptr fs:[00000030h] 2_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3A3C0 mov eax, dword ptr fs:[00000030h] 2_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3A3C0 mov eax, dword ptr fs:[00000030h] 2_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3A3C0 mov eax, dword ptr fs:[00000030h] 2_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3A3C0 mov eax, dword ptr fs:[00000030h] 2_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C383C0 mov eax, dword ptr fs:[00000030h] 2_2_03C383C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C383C0 mov eax, dword ptr fs:[00000030h] 2_2_03C383C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C383C0 mov eax, dword ptr fs:[00000030h] 2_2_03C383C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C383C0 mov eax, dword ptr fs:[00000030h] 2_2_03C383C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB63C0 mov eax, dword ptr fs:[00000030h] 2_2_03CB63C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDE3DB mov eax, dword ptr fs:[00000030h] 2_2_03CDE3DB
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDE3DB mov eax, dword ptr fs:[00000030h] 2_2_03CDE3DB
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDE3DB mov ecx, dword ptr fs:[00000030h] 2_2_03CDE3DB
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDE3DB mov eax, dword ptr fs:[00000030h] 2_2_03CDE3DB
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CD43D4 mov eax, dword ptr fs:[00000030h] 2_2_03CD43D4
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CD43D4 mov eax, dword ptr fs:[00000030h] 2_2_03CD43D4
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C403E9 mov eax, dword ptr fs:[00000030h] 2_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C403E9 mov eax, dword ptr fs:[00000030h] 2_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C403E9 mov eax, dword ptr fs:[00000030h] 2_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C403E9 mov eax, dword ptr fs:[00000030h] 2_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C403E9 mov eax, dword ptr fs:[00000030h] 2_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C403E9 mov eax, dword ptr fs:[00000030h] 2_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C403E9 mov eax, dword ptr fs:[00000030h] 2_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C403E9 mov eax, dword ptr fs:[00000030h] 2_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4E3F0 mov eax, dword ptr fs:[00000030h] 2_2_03C4E3F0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4E3F0 mov eax, dword ptr fs:[00000030h] 2_2_03C4E3F0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4E3F0 mov eax, dword ptr fs:[00000030h] 2_2_03C4E3F0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C663FF mov eax, dword ptr fs:[00000030h] 2_2_03C663FF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2E388 mov eax, dword ptr fs:[00000030h] 2_2_03C2E388
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2E388 mov eax, dword ptr fs:[00000030h] 2_2_03C2E388
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2E388 mov eax, dword ptr fs:[00000030h] 2_2_03C2E388
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5438F mov eax, dword ptr fs:[00000030h] 2_2_03C5438F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5438F mov eax, dword ptr fs:[00000030h] 2_2_03C5438F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C28397 mov eax, dword ptr fs:[00000030h] 2_2_03C28397
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C28397 mov eax, dword ptr fs:[00000030h] 2_2_03C28397
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C28397 mov eax, dword ptr fs:[00000030h] 2_2_03C28397
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h] 2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h] 2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h] 2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h] 2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h] 2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h] 2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h] 2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h] 2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h] 2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h] 2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h] 2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h] 2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h] 2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h] 2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h] 2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB035C mov eax, dword ptr fs:[00000030h] 2_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB035C mov eax, dword ptr fs:[00000030h] 2_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB035C mov eax, dword ptr fs:[00000030h] 2_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB035C mov ecx, dword ptr fs:[00000030h] 2_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB035C mov eax, dword ptr fs:[00000030h] 2_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB035C mov eax, dword ptr fs:[00000030h] 2_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CFA352 mov eax, dword ptr fs:[00000030h] 2_2_03CFA352
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D0634F mov eax, dword ptr fs:[00000030h] 2_2_03D0634F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CD437C mov eax, dword ptr fs:[00000030h] 2_2_03CD437C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6A30B mov eax, dword ptr fs:[00000030h] 2_2_03C6A30B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6A30B mov eax, dword ptr fs:[00000030h] 2_2_03C6A30B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6A30B mov eax, dword ptr fs:[00000030h] 2_2_03C6A30B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2C310 mov ecx, dword ptr fs:[00000030h] 2_2_03C2C310
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C50310 mov ecx, dword ptr fs:[00000030h] 2_2_03C50310
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3A2C3 mov eax, dword ptr fs:[00000030h] 2_2_03C3A2C3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3A2C3 mov eax, dword ptr fs:[00000030h] 2_2_03C3A2C3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3A2C3 mov eax, dword ptr fs:[00000030h] 2_2_03C3A2C3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3A2C3 mov eax, dword ptr fs:[00000030h] 2_2_03C3A2C3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3A2C3 mov eax, dword ptr fs:[00000030h] 2_2_03C3A2C3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D062D6 mov eax, dword ptr fs:[00000030h] 2_2_03D062D6
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C402E1 mov eax, dword ptr fs:[00000030h] 2_2_03C402E1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C402E1 mov eax, dword ptr fs:[00000030h] 2_2_03C402E1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C402E1 mov eax, dword ptr fs:[00000030h] 2_2_03C402E1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6E284 mov eax, dword ptr fs:[00000030h] 2_2_03C6E284
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6E284 mov eax, dword ptr fs:[00000030h] 2_2_03C6E284
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB0283 mov eax, dword ptr fs:[00000030h] 2_2_03CB0283
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB0283 mov eax, dword ptr fs:[00000030h] 2_2_03CB0283
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB0283 mov eax, dword ptr fs:[00000030h] 2_2_03CB0283
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C402A0 mov eax, dword ptr fs:[00000030h] 2_2_03C402A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C402A0 mov eax, dword ptr fs:[00000030h] 2_2_03C402A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC62A0 mov eax, dword ptr fs:[00000030h] 2_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC62A0 mov ecx, dword ptr fs:[00000030h] 2_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC62A0 mov eax, dword ptr fs:[00000030h] 2_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC62A0 mov eax, dword ptr fs:[00000030h] 2_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC62A0 mov eax, dword ptr fs:[00000030h] 2_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC62A0 mov eax, dword ptr fs:[00000030h] 2_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB8243 mov eax, dword ptr fs:[00000030h] 2_2_03CB8243
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB8243 mov ecx, dword ptr fs:[00000030h] 2_2_03CB8243
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D0625D mov eax, dword ptr fs:[00000030h] 2_2_03D0625D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2A250 mov eax, dword ptr fs:[00000030h] 2_2_03C2A250
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C36259 mov eax, dword ptr fs:[00000030h] 2_2_03C36259
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CEA250 mov eax, dword ptr fs:[00000030h] 2_2_03CEA250
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CEA250 mov eax, dword ptr fs:[00000030h] 2_2_03CEA250
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C34260 mov eax, dword ptr fs:[00000030h] 2_2_03C34260
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C34260 mov eax, dword ptr fs:[00000030h] 2_2_03C34260
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C34260 mov eax, dword ptr fs:[00000030h] 2_2_03C34260
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2826B mov eax, dword ptr fs:[00000030h] 2_2_03C2826B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h] 2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h] 2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h] 2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h] 2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h] 2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h] 2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h] 2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h] 2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h] 2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h] 2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h] 2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h] 2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2823B mov eax, dword ptr fs:[00000030h] 2_2_03C2823B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF61C3 mov eax, dword ptr fs:[00000030h] 2_2_03CF61C3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF61C3 mov eax, dword ptr fs:[00000030h] 2_2_03CF61C3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAE1D0 mov eax, dword ptr fs:[00000030h] 2_2_03CAE1D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAE1D0 mov eax, dword ptr fs:[00000030h] 2_2_03CAE1D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAE1D0 mov ecx, dword ptr fs:[00000030h] 2_2_03CAE1D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAE1D0 mov eax, dword ptr fs:[00000030h] 2_2_03CAE1D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAE1D0 mov eax, dword ptr fs:[00000030h] 2_2_03CAE1D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D061E5 mov eax, dword ptr fs:[00000030h] 2_2_03D061E5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C601F8 mov eax, dword ptr fs:[00000030h] 2_2_03C601F8
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C70185 mov eax, dword ptr fs:[00000030h] 2_2_03C70185
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CEC188 mov eax, dword ptr fs:[00000030h] 2_2_03CEC188
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CEC188 mov eax, dword ptr fs:[00000030h] 2_2_03CEC188
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CD4180 mov eax, dword ptr fs:[00000030h] 2_2_03CD4180
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CD4180 mov eax, dword ptr fs:[00000030h] 2_2_03CD4180
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB019F mov eax, dword ptr fs:[00000030h] 2_2_03CB019F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB019F mov eax, dword ptr fs:[00000030h] 2_2_03CB019F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB019F mov eax, dword ptr fs:[00000030h] 2_2_03CB019F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB019F mov eax, dword ptr fs:[00000030h] 2_2_03CB019F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2A197 mov eax, dword ptr fs:[00000030h] 2_2_03C2A197
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2A197 mov eax, dword ptr fs:[00000030h] 2_2_03C2A197
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2A197 mov eax, dword ptr fs:[00000030h] 2_2_03C2A197
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC4144 mov eax, dword ptr fs:[00000030h] 2_2_03CC4144
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC4144 mov eax, dword ptr fs:[00000030h] 2_2_03CC4144
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC4144 mov ecx, dword ptr fs:[00000030h] 2_2_03CC4144
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC4144 mov eax, dword ptr fs:[00000030h] 2_2_03CC4144
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC4144 mov eax, dword ptr fs:[00000030h] 2_2_03CC4144
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2C156 mov eax, dword ptr fs:[00000030h] 2_2_03C2C156
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC8158 mov eax, dword ptr fs:[00000030h] 2_2_03CC8158
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C36154 mov eax, dword ptr fs:[00000030h] 2_2_03C36154
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C36154 mov eax, dword ptr fs:[00000030h] 2_2_03C36154
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D04164 mov eax, dword ptr fs:[00000030h] 2_2_03D04164
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D04164 mov eax, dword ptr fs:[00000030h] 2_2_03D04164
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDE10E mov eax, dword ptr fs:[00000030h] 2_2_03CDE10E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDE10E mov ecx, dword ptr fs:[00000030h] 2_2_03CDE10E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDE10E mov eax, dword ptr fs:[00000030h] 2_2_03CDE10E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDE10E mov eax, dword ptr fs:[00000030h] 2_2_03CDE10E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDE10E mov ecx, dword ptr fs:[00000030h] 2_2_03CDE10E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDE10E mov eax, dword ptr fs:[00000030h] 2_2_03CDE10E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDE10E mov eax, dword ptr fs:[00000030h] 2_2_03CDE10E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDE10E mov ecx, dword ptr fs:[00000030h] 2_2_03CDE10E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDE10E mov eax, dword ptr fs:[00000030h] 2_2_03CDE10E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDE10E mov ecx, dword ptr fs:[00000030h] 2_2_03CDE10E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDA118 mov ecx, dword ptr fs:[00000030h] 2_2_03CDA118
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDA118 mov eax, dword ptr fs:[00000030h] 2_2_03CDA118
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDA118 mov eax, dword ptr fs:[00000030h] 2_2_03CDA118
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDA118 mov eax, dword ptr fs:[00000030h] 2_2_03CDA118
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF0115 mov eax, dword ptr fs:[00000030h] 2_2_03CF0115
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C60124 mov eax, dword ptr fs:[00000030h] 2_2_03C60124
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB20DE mov eax, dword ptr fs:[00000030h] 2_2_03CB20DE
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2A0E3 mov ecx, dword ptr fs:[00000030h] 2_2_03C2A0E3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C380E9 mov eax, dword ptr fs:[00000030h] 2_2_03C380E9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB60E0 mov eax, dword ptr fs:[00000030h] 2_2_03CB60E0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2C0F0 mov eax, dword ptr fs:[00000030h] 2_2_03C2C0F0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C720F0 mov ecx, dword ptr fs:[00000030h] 2_2_03C720F0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3208A mov eax, dword ptr fs:[00000030h] 2_2_03C3208A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C280A0 mov eax, dword ptr fs:[00000030h] 2_2_03C280A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC80A8 mov eax, dword ptr fs:[00000030h] 2_2_03CC80A8
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF60B8 mov eax, dword ptr fs:[00000030h] 2_2_03CF60B8
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF60B8 mov ecx, dword ptr fs:[00000030h] 2_2_03CF60B8
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C32050 mov eax, dword ptr fs:[00000030h] 2_2_03C32050
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB6050 mov eax, dword ptr fs:[00000030h] 2_2_03CB6050
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5C073 mov eax, dword ptr fs:[00000030h] 2_2_03C5C073
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB4000 mov ecx, dword ptr fs:[00000030h] 2_2_03CB4000
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CD2000 mov eax, dword ptr fs:[00000030h] 2_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CD2000 mov eax, dword ptr fs:[00000030h] 2_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CD2000 mov eax, dword ptr fs:[00000030h] 2_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CD2000 mov eax, dword ptr fs:[00000030h] 2_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CD2000 mov eax, dword ptr fs:[00000030h] 2_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CD2000 mov eax, dword ptr fs:[00000030h] 2_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CD2000 mov eax, dword ptr fs:[00000030h] 2_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CD2000 mov eax, dword ptr fs:[00000030h] 2_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4E016 mov eax, dword ptr fs:[00000030h] 2_2_03C4E016
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4E016 mov eax, dword ptr fs:[00000030h] 2_2_03C4E016
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4E016 mov eax, dword ptr fs:[00000030h] 2_2_03C4E016
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4E016 mov eax, dword ptr fs:[00000030h] 2_2_03C4E016
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2A020 mov eax, dword ptr fs:[00000030h] 2_2_03C2A020
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2C020 mov eax, dword ptr fs:[00000030h] 2_2_03C2C020
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC6030 mov eax, dword ptr fs:[00000030h] 2_2_03CC6030
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3C7C0 mov eax, dword ptr fs:[00000030h] 2_2_03C3C7C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB07C3 mov eax, dword ptr fs:[00000030h] 2_2_03CB07C3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C527ED mov eax, dword ptr fs:[00000030h] 2_2_03C527ED
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C527ED mov eax, dword ptr fs:[00000030h] 2_2_03C527ED
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C527ED mov eax, dword ptr fs:[00000030h] 2_2_03C527ED
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CBE7E1 mov eax, dword ptr fs:[00000030h] 2_2_03CBE7E1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C347FB mov eax, dword ptr fs:[00000030h] 2_2_03C347FB
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C347FB mov eax, dword ptr fs:[00000030h] 2_2_03C347FB
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CD678E mov eax, dword ptr fs:[00000030h] 2_2_03CD678E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C307AF mov eax, dword ptr fs:[00000030h] 2_2_03C307AF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE47A0 mov eax, dword ptr fs:[00000030h] 2_2_03CE47A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6674D mov esi, dword ptr fs:[00000030h] 2_2_03C6674D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6674D mov eax, dword ptr fs:[00000030h] 2_2_03C6674D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6674D mov eax, dword ptr fs:[00000030h] 2_2_03C6674D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C30750 mov eax, dword ptr fs:[00000030h] 2_2_03C30750
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CBE75D mov eax, dword ptr fs:[00000030h] 2_2_03CBE75D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72750 mov eax, dword ptr fs:[00000030h] 2_2_03C72750
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72750 mov eax, dword ptr fs:[00000030h] 2_2_03C72750
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB4755 mov eax, dword ptr fs:[00000030h] 2_2_03CB4755
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C38770 mov eax, dword ptr fs:[00000030h] 2_2_03C38770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h] 2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h] 2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h] 2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h] 2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h] 2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h] 2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h] 2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h] 2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h] 2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h] 2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h] 2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h] 2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6C700 mov eax, dword ptr fs:[00000030h] 2_2_03C6C700
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C30710 mov eax, dword ptr fs:[00000030h] 2_2_03C30710
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C60710 mov eax, dword ptr fs:[00000030h] 2_2_03C60710
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6C720 mov eax, dword ptr fs:[00000030h] 2_2_03C6C720
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6C720 mov eax, dword ptr fs:[00000030h] 2_2_03C6C720
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6273C mov eax, dword ptr fs:[00000030h] 2_2_03C6273C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6273C mov ecx, dword ptr fs:[00000030h] 2_2_03C6273C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6273C mov eax, dword ptr fs:[00000030h] 2_2_03C6273C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAC730 mov eax, dword ptr fs:[00000030h] 2_2_03CAC730
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6A6C7 mov ebx, dword ptr fs:[00000030h] 2_2_03C6A6C7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6A6C7 mov eax, dword ptr fs:[00000030h] 2_2_03C6A6C7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAE6F2 mov eax, dword ptr fs:[00000030h] 2_2_03CAE6F2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAE6F2 mov eax, dword ptr fs:[00000030h] 2_2_03CAE6F2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAE6F2 mov eax, dword ptr fs:[00000030h] 2_2_03CAE6F2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAE6F2 mov eax, dword ptr fs:[00000030h] 2_2_03CAE6F2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB06F1 mov eax, dword ptr fs:[00000030h] 2_2_03CB06F1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB06F1 mov eax, dword ptr fs:[00000030h] 2_2_03CB06F1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C34690 mov eax, dword ptr fs:[00000030h] 2_2_03C34690
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C34690 mov eax, dword ptr fs:[00000030h] 2_2_03C34690
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6C6A6 mov eax, dword ptr fs:[00000030h] 2_2_03C6C6A6
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C666B0 mov eax, dword ptr fs:[00000030h] 2_2_03C666B0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4C640 mov eax, dword ptr fs:[00000030h] 2_2_03C4C640
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF866E mov eax, dword ptr fs:[00000030h] 2_2_03CF866E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF866E mov eax, dword ptr fs:[00000030h] 2_2_03CF866E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6A660 mov eax, dword ptr fs:[00000030h] 2_2_03C6A660
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6A660 mov eax, dword ptr fs:[00000030h] 2_2_03C6A660
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C62674 mov eax, dword ptr fs:[00000030h] 2_2_03C62674
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAE609 mov eax, dword ptr fs:[00000030h] 2_2_03CAE609
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4260B mov eax, dword ptr fs:[00000030h] 2_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4260B mov eax, dword ptr fs:[00000030h] 2_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4260B mov eax, dword ptr fs:[00000030h] 2_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4260B mov eax, dword ptr fs:[00000030h] 2_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4260B mov eax, dword ptr fs:[00000030h] 2_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4260B mov eax, dword ptr fs:[00000030h] 2_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4260B mov eax, dword ptr fs:[00000030h] 2_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72619 mov eax, dword ptr fs:[00000030h] 2_2_03C72619
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4E627 mov eax, dword ptr fs:[00000030h] 2_2_03C4E627
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C66620 mov eax, dword ptr fs:[00000030h] 2_2_03C66620
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C68620 mov eax, dword ptr fs:[00000030h] 2_2_03C68620
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3262C mov eax, dword ptr fs:[00000030h] 2_2_03C3262C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6E5CF mov eax, dword ptr fs:[00000030h] 2_2_03C6E5CF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6E5CF mov eax, dword ptr fs:[00000030h] 2_2_03C6E5CF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C365D0 mov eax, dword ptr fs:[00000030h] 2_2_03C365D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6A5D0 mov eax, dword ptr fs:[00000030h] 2_2_03C6A5D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6A5D0 mov eax, dword ptr fs:[00000030h] 2_2_03C6A5D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5E5E7 mov eax, dword ptr fs:[00000030h] 2_2_03C5E5E7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5E5E7 mov eax, dword ptr fs:[00000030h] 2_2_03C5E5E7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5E5E7 mov eax, dword ptr fs:[00000030h] 2_2_03C5E5E7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5E5E7 mov eax, dword ptr fs:[00000030h] 2_2_03C5E5E7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5E5E7 mov eax, dword ptr fs:[00000030h] 2_2_03C5E5E7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5E5E7 mov eax, dword ptr fs:[00000030h] 2_2_03C5E5E7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5E5E7 mov eax, dword ptr fs:[00000030h] 2_2_03C5E5E7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5E5E7 mov eax, dword ptr fs:[00000030h] 2_2_03C5E5E7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C325E0 mov eax, dword ptr fs:[00000030h] 2_2_03C325E0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6C5ED mov eax, dword ptr fs:[00000030h] 2_2_03C6C5ED
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6C5ED mov eax, dword ptr fs:[00000030h] 2_2_03C6C5ED
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C32582 mov eax, dword ptr fs:[00000030h] 2_2_03C32582
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C32582 mov ecx, dword ptr fs:[00000030h] 2_2_03C32582
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C64588 mov eax, dword ptr fs:[00000030h] 2_2_03C64588
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6E59C mov eax, dword ptr fs:[00000030h] 2_2_03C6E59C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB05A7 mov eax, dword ptr fs:[00000030h] 2_2_03CB05A7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB05A7 mov eax, dword ptr fs:[00000030h] 2_2_03CB05A7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB05A7 mov eax, dword ptr fs:[00000030h] 2_2_03CB05A7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C545B1 mov eax, dword ptr fs:[00000030h] 2_2_03C545B1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C545B1 mov eax, dword ptr fs:[00000030h] 2_2_03C545B1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C38550 mov eax, dword ptr fs:[00000030h] 2_2_03C38550
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C38550 mov eax, dword ptr fs:[00000030h] 2_2_03C38550
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6656A mov eax, dword ptr fs:[00000030h] 2_2_03C6656A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6656A mov eax, dword ptr fs:[00000030h] 2_2_03C6656A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6656A mov eax, dword ptr fs:[00000030h] 2_2_03C6656A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC6500 mov eax, dword ptr fs:[00000030h] 2_2_03CC6500
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D04500 mov eax, dword ptr fs:[00000030h] 2_2_03D04500
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D04500 mov eax, dword ptr fs:[00000030h] 2_2_03D04500
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D04500 mov eax, dword ptr fs:[00000030h] 2_2_03D04500
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D04500 mov eax, dword ptr fs:[00000030h] 2_2_03D04500
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D04500 mov eax, dword ptr fs:[00000030h] 2_2_03D04500
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D04500 mov eax, dword ptr fs:[00000030h] 2_2_03D04500
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D04500 mov eax, dword ptr fs:[00000030h] 2_2_03D04500
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40535 mov eax, dword ptr fs:[00000030h] 2_2_03C40535
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40535 mov eax, dword ptr fs:[00000030h] 2_2_03C40535
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40535 mov eax, dword ptr fs:[00000030h] 2_2_03C40535
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40535 mov eax, dword ptr fs:[00000030h] 2_2_03C40535
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40535 mov eax, dword ptr fs:[00000030h] 2_2_03C40535
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40535 mov eax, dword ptr fs:[00000030h] 2_2_03C40535
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5E53E mov eax, dword ptr fs:[00000030h] 2_2_03C5E53E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5E53E mov eax, dword ptr fs:[00000030h] 2_2_03C5E53E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5E53E mov eax, dword ptr fs:[00000030h] 2_2_03C5E53E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5E53E mov eax, dword ptr fs:[00000030h] 2_2_03C5E53E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5E53E mov eax, dword ptr fs:[00000030h] 2_2_03C5E53E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C304E5 mov ecx, dword ptr fs:[00000030h] 2_2_03C304E5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CEA49A mov eax, dword ptr fs:[00000030h] 2_2_03CEA49A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C364AB mov eax, dword ptr fs:[00000030h] 2_2_03C364AB
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C644B0 mov ecx, dword ptr fs:[00000030h] 2_2_03C644B0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CBA4B0 mov eax, dword ptr fs:[00000030h] 2_2_03CBA4B0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6E443 mov eax, dword ptr fs:[00000030h] 2_2_03C6E443
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6E443 mov eax, dword ptr fs:[00000030h] 2_2_03C6E443
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6E443 mov eax, dword ptr fs:[00000030h] 2_2_03C6E443
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6E443 mov eax, dword ptr fs:[00000030h] 2_2_03C6E443
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6E443 mov eax, dword ptr fs:[00000030h] 2_2_03C6E443
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6E443 mov eax, dword ptr fs:[00000030h] 2_2_03C6E443
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6E443 mov eax, dword ptr fs:[00000030h] 2_2_03C6E443
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6E443 mov eax, dword ptr fs:[00000030h] 2_2_03C6E443
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CEA456 mov eax, dword ptr fs:[00000030h] 2_2_03CEA456
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2645D mov eax, dword ptr fs:[00000030h] 2_2_03C2645D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5245A mov eax, dword ptr fs:[00000030h] 2_2_03C5245A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CBC460 mov ecx, dword ptr fs:[00000030h] 2_2_03CBC460
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5A470 mov eax, dword ptr fs:[00000030h] 2_2_03C5A470
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5A470 mov eax, dword ptr fs:[00000030h] 2_2_03C5A470
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5A470 mov eax, dword ptr fs:[00000030h] 2_2_03C5A470
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C68402 mov eax, dword ptr fs:[00000030h] 2_2_03C68402
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C68402 mov eax, dword ptr fs:[00000030h] 2_2_03C68402
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C68402 mov eax, dword ptr fs:[00000030h] 2_2_03C68402
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2E420 mov eax, dword ptr fs:[00000030h] 2_2_03C2E420
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2E420 mov eax, dword ptr fs:[00000030h] 2_2_03C2E420
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2E420 mov eax, dword ptr fs:[00000030h] 2_2_03C2E420
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2C427 mov eax, dword ptr fs:[00000030h] 2_2_03C2C427
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB6420 mov eax, dword ptr fs:[00000030h] 2_2_03CB6420
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB6420 mov eax, dword ptr fs:[00000030h] 2_2_03CB6420
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB6420 mov eax, dword ptr fs:[00000030h] 2_2_03CB6420
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB6420 mov eax, dword ptr fs:[00000030h] 2_2_03CB6420
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB6420 mov eax, dword ptr fs:[00000030h] 2_2_03CB6420
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB6420 mov eax, dword ptr fs:[00000030h] 2_2_03CB6420
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB6420 mov eax, dword ptr fs:[00000030h] 2_2_03CB6420
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6A430 mov eax, dword ptr fs:[00000030h] 2_2_03C6A430
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C50BCB mov eax, dword ptr fs:[00000030h] 2_2_03C50BCB
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C50BCB mov eax, dword ptr fs:[00000030h] 2_2_03C50BCB
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C50BCB mov eax, dword ptr fs:[00000030h] 2_2_03C50BCB
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C30BCD mov eax, dword ptr fs:[00000030h] 2_2_03C30BCD
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C30BCD mov eax, dword ptr fs:[00000030h] 2_2_03C30BCD
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C30BCD mov eax, dword ptr fs:[00000030h] 2_2_03C30BCD
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDEBD0 mov eax, dword ptr fs:[00000030h] 2_2_03CDEBD0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C38BF0 mov eax, dword ptr fs:[00000030h] 2_2_03C38BF0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C38BF0 mov eax, dword ptr fs:[00000030h] 2_2_03C38BF0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C38BF0 mov eax, dword ptr fs:[00000030h] 2_2_03C38BF0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5EBFC mov eax, dword ptr fs:[00000030h] 2_2_03C5EBFC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CBCBF0 mov eax, dword ptr fs:[00000030h] 2_2_03CBCBF0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40BBE mov eax, dword ptr fs:[00000030h] 2_2_03C40BBE
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40BBE mov eax, dword ptr fs:[00000030h] 2_2_03C40BBE
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE4BB0 mov eax, dword ptr fs:[00000030h] 2_2_03CE4BB0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE4BB0 mov eax, dword ptr fs:[00000030h] 2_2_03CE4BB0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE4B4B mov eax, dword ptr fs:[00000030h] 2_2_03CE4B4B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE4B4B mov eax, dword ptr fs:[00000030h] 2_2_03CE4B4B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D02B57 mov eax, dword ptr fs:[00000030h] 2_2_03D02B57
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D02B57 mov eax, dword ptr fs:[00000030h] 2_2_03D02B57
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D02B57 mov eax, dword ptr fs:[00000030h] 2_2_03D02B57
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D02B57 mov eax, dword ptr fs:[00000030h] 2_2_03D02B57
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC6B40 mov eax, dword ptr fs:[00000030h] 2_2_03CC6B40
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC6B40 mov eax, dword ptr fs:[00000030h] 2_2_03CC6B40
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CFAB40 mov eax, dword ptr fs:[00000030h] 2_2_03CFAB40
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CD8B42 mov eax, dword ptr fs:[00000030h] 2_2_03CD8B42
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C28B50 mov eax, dword ptr fs:[00000030h] 2_2_03C28B50
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDEB50 mov eax, dword ptr fs:[00000030h] 2_2_03CDEB50
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2CB7E mov eax, dword ptr fs:[00000030h] 2_2_03C2CB7E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D04B00 mov eax, dword ptr fs:[00000030h] 2_2_03D04B00
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAEB1D mov eax, dword ptr fs:[00000030h] 2_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAEB1D mov eax, dword ptr fs:[00000030h] 2_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAEB1D mov eax, dword ptr fs:[00000030h] 2_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAEB1D mov eax, dword ptr fs:[00000030h] 2_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAEB1D mov eax, dword ptr fs:[00000030h] 2_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAEB1D mov eax, dword ptr fs:[00000030h] 2_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAEB1D mov eax, dword ptr fs:[00000030h] 2_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAEB1D mov eax, dword ptr fs:[00000030h] 2_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAEB1D mov eax, dword ptr fs:[00000030h] 2_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5EB20 mov eax, dword ptr fs:[00000030h] 2_2_03C5EB20
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5EB20 mov eax, dword ptr fs:[00000030h] 2_2_03C5EB20
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF8B28 mov eax, dword ptr fs:[00000030h] 2_2_03CF8B28
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF8B28 mov eax, dword ptr fs:[00000030h] 2_2_03CF8B28
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C86ACC mov eax, dword ptr fs:[00000030h] 2_2_03C86ACC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C86ACC mov eax, dword ptr fs:[00000030h] 2_2_03C86ACC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C86ACC mov eax, dword ptr fs:[00000030h] 2_2_03C86ACC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C30AD0 mov eax, dword ptr fs:[00000030h] 2_2_03C30AD0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C64AD0 mov eax, dword ptr fs:[00000030h] 2_2_03C64AD0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C64AD0 mov eax, dword ptr fs:[00000030h] 2_2_03C64AD0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6AAEE mov eax, dword ptr fs:[00000030h] 2_2_03C6AAEE
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6AAEE mov eax, dword ptr fs:[00000030h] 2_2_03C6AAEE
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3EA80 mov eax, dword ptr fs:[00000030h] 2_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3EA80 mov eax, dword ptr fs:[00000030h] 2_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3EA80 mov eax, dword ptr fs:[00000030h] 2_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3EA80 mov eax, dword ptr fs:[00000030h] 2_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3EA80 mov eax, dword ptr fs:[00000030h] 2_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3EA80 mov eax, dword ptr fs:[00000030h] 2_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3EA80 mov eax, dword ptr fs:[00000030h] 2_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3EA80 mov eax, dword ptr fs:[00000030h] 2_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3EA80 mov eax, dword ptr fs:[00000030h] 2_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D04A80 mov eax, dword ptr fs:[00000030h] 2_2_03D04A80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C68A90 mov edx, dword ptr fs:[00000030h] 2_2_03C68A90
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C38AA0 mov eax, dword ptr fs:[00000030h] 2_2_03C38AA0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C38AA0 mov eax, dword ptr fs:[00000030h] 2_2_03C38AA0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C86AA4 mov eax, dword ptr fs:[00000030h] 2_2_03C86AA4
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C36A50 mov eax, dword ptr fs:[00000030h] 2_2_03C36A50
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C36A50 mov eax, dword ptr fs:[00000030h] 2_2_03C36A50
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C36A50 mov eax, dword ptr fs:[00000030h] 2_2_03C36A50
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C36A50 mov eax, dword ptr fs:[00000030h] 2_2_03C36A50
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C36A50 mov eax, dword ptr fs:[00000030h] 2_2_03C36A50
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C36A50 mov eax, dword ptr fs:[00000030h] 2_2_03C36A50
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C36A50 mov eax, dword ptr fs:[00000030h] 2_2_03C36A50
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40A5B mov eax, dword ptr fs:[00000030h] 2_2_03C40A5B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40A5B mov eax, dword ptr fs:[00000030h] 2_2_03C40A5B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6CA6F mov eax, dword ptr fs:[00000030h] 2_2_03C6CA6F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6CA6F mov eax, dword ptr fs:[00000030h] 2_2_03C6CA6F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6CA6F mov eax, dword ptr fs:[00000030h] 2_2_03C6CA6F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDEA60 mov eax, dword ptr fs:[00000030h] 2_2_03CDEA60
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CACA72 mov eax, dword ptr fs:[00000030h] 2_2_03CACA72
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CACA72 mov eax, dword ptr fs:[00000030h] 2_2_03CACA72
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CBCA11 mov eax, dword ptr fs:[00000030h] 2_2_03CBCA11
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6CA24 mov eax, dword ptr fs:[00000030h] 2_2_03C6CA24
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5EA2E mov eax, dword ptr fs:[00000030h] 2_2_03C5EA2E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C54A35 mov eax, dword ptr fs:[00000030h] 2_2_03C54A35
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C54A35 mov eax, dword ptr fs:[00000030h] 2_2_03C54A35
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6CA38 mov eax, dword ptr fs:[00000030h] 2_2_03C6CA38
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC69C0 mov eax, dword ptr fs:[00000030h] 2_2_03CC69C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3A9D0 mov eax, dword ptr fs:[00000030h] 2_2_03C3A9D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3A9D0 mov eax, dword ptr fs:[00000030h] 2_2_03C3A9D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3A9D0 mov eax, dword ptr fs:[00000030h] 2_2_03C3A9D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3A9D0 mov eax, dword ptr fs:[00000030h] 2_2_03C3A9D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3A9D0 mov eax, dword ptr fs:[00000030h] 2_2_03C3A9D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3A9D0 mov eax, dword ptr fs:[00000030h] 2_2_03C3A9D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C649D0 mov eax, dword ptr fs:[00000030h] 2_2_03C649D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CFA9D3 mov eax, dword ptr fs:[00000030h] 2_2_03CFA9D3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CBE9E0 mov eax, dword ptr fs:[00000030h] 2_2_03CBE9E0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C629F9 mov eax, dword ptr fs:[00000030h] 2_2_03C629F9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C629F9 mov eax, dword ptr fs:[00000030h] 2_2_03C629F9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C309AD mov eax, dword ptr fs:[00000030h] 2_2_03C309AD
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C309AD mov eax, dword ptr fs:[00000030h] 2_2_03C309AD
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB89B3 mov esi, dword ptr fs:[00000030h] 2_2_03CB89B3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB89B3 mov eax, dword ptr fs:[00000030h] 2_2_03CB89B3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB89B3 mov eax, dword ptr fs:[00000030h] 2_2_03CB89B3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB0946 mov eax, dword ptr fs:[00000030h] 2_2_03CB0946
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D04940 mov eax, dword ptr fs:[00000030h] 2_2_03D04940
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C56962 mov eax, dword ptr fs:[00000030h] 2_2_03C56962
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C56962 mov eax, dword ptr fs:[00000030h] 2_2_03C56962
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C56962 mov eax, dword ptr fs:[00000030h] 2_2_03C56962
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C7096E mov eax, dword ptr fs:[00000030h] 2_2_03C7096E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C7096E mov edx, dword ptr fs:[00000030h] 2_2_03C7096E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C7096E mov eax, dword ptr fs:[00000030h] 2_2_03C7096E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CD4978 mov eax, dword ptr fs:[00000030h] 2_2_03CD4978
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CD4978 mov eax, dword ptr fs:[00000030h] 2_2_03CD4978
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CBC97C mov eax, dword ptr fs:[00000030h] 2_2_03CBC97C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAE908 mov eax, dword ptr fs:[00000030h] 2_2_03CAE908
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAE908 mov eax, dword ptr fs:[00000030h] 2_2_03CAE908
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CBC912 mov eax, dword ptr fs:[00000030h] 2_2_03CBC912
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C28918 mov eax, dword ptr fs:[00000030h] 2_2_03C28918
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C28918 mov eax, dword ptr fs:[00000030h] 2_2_03C28918
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB892A mov eax, dword ptr fs:[00000030h] 2_2_03CB892A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC892B mov eax, dword ptr fs:[00000030h] 2_2_03CC892B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5E8C0 mov eax, dword ptr fs:[00000030h] 2_2_03C5E8C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D008C0 mov eax, dword ptr fs:[00000030h] 2_2_03D008C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CFA8E4 mov eax, dword ptr fs:[00000030h] 2_2_03CFA8E4
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6C8F9 mov eax, dword ptr fs:[00000030h] 2_2_03C6C8F9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6C8F9 mov eax, dword ptr fs:[00000030h] 2_2_03C6C8F9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C30887 mov eax, dword ptr fs:[00000030h] 2_2_03C30887
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CBC89D mov eax, dword ptr fs:[00000030h] 2_2_03CBC89D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C60854 mov eax, dword ptr fs:[00000030h] 2_2_03C60854
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C34859 mov eax, dword ptr fs:[00000030h] 2_2_03C34859
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C34859 mov eax, dword ptr fs:[00000030h] 2_2_03C34859
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CBE872 mov eax, dword ptr fs:[00000030h] 2_2_03CBE872
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CBE872 mov eax, dword ptr fs:[00000030h] 2_2_03CBE872
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC6870 mov eax, dword ptr fs:[00000030h] 2_2_03CC6870
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC6870 mov eax, dword ptr fs:[00000030h] 2_2_03CC6870
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CBC810 mov eax, dword ptr fs:[00000030h] 2_2_03CBC810
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C52835 mov eax, dword ptr fs:[00000030h] 2_2_03C52835
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C52835 mov eax, dword ptr fs:[00000030h] 2_2_03C52835
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C52835 mov eax, dword ptr fs:[00000030h] 2_2_03C52835
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C52835 mov ecx, dword ptr fs:[00000030h] 2_2_03C52835
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C52835 mov eax, dword ptr fs:[00000030h] 2_2_03C52835
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C52835 mov eax, dword ptr fs:[00000030h] 2_2_03C52835
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6A830 mov eax, dword ptr fs:[00000030h] 2_2_03C6A830
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CD483A mov eax, dword ptr fs:[00000030h] 2_2_03CD483A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CD483A mov eax, dword ptr fs:[00000030h] 2_2_03CD483A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C32FC8 mov eax, dword ptr fs:[00000030h] 2_2_03C32FC8
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C32FC8 mov eax, dword ptr fs:[00000030h] 2_2_03C32FC8
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C32FC8 mov eax, dword ptr fs:[00000030h] 2_2_03C32FC8
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C32FC8 mov eax, dword ptr fs:[00000030h] 2_2_03C32FC8
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2EFD8 mov eax, dword ptr fs:[00000030h] 2_2_03C2EFD8
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DC80A9 GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation, 0_2_00DC80A9
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00D9A155 SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00D9A155
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00D9A124 SetUnhandledExceptionFilter, 0_2_00D9A124

HIPS / PFW / Operating System Protection Evasion
barindex
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe NtAllocateVirtualMemory: Direct from: 0x77172BFC Jump to behavior
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe NtDelayExecution: Direct from: 0x77172DDC Jump to behavior
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe NtQuerySystemInformation: Direct from: 0x77172DFC Jump to behavior
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe NtReadFile: Direct from: 0x77172ADC Jump to behavior
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe NtQueryInformationProcess: Direct from: 0x77172C26 Jump to behavior
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe NtResumeThread: Direct from: 0x77172FBC Jump to behavior
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe NtWriteVirtualMemory: Direct from: 0x7717490C Jump to behavior
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe NtCreateUserProcess: Direct from: 0x7717371C Jump to behavior
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe NtOpenKeyEx: Direct from: 0x77172B9C Jump to behavior
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe NtNotifyChangeKey: Direct from: 0x77173C2C Jump to behavior
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe NtSetInformationProcess: Direct from: 0x77172C5C Jump to behavior
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe NtProtectVirtualMemory: Direct from: 0x77172F9C Jump to behavior
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe NtResumeThread: Direct from: 0x771736AC Jump to behavior
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe NtMapViewOfSection: Direct from: 0x77172D1C Jump to behavior
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe NtWriteVirtualMemory: Direct from: 0x77172E3C Jump to behavior
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe NtUnmapViewOfSection: Direct from: 0x77172D3C Jump to behavior
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe NtCreateMutant: Direct from: 0x771735CC Jump to behavior
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe NtDeviceIoControlFile: Direct from: 0x77172AEC Jump to behavior
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe NtAllocateVirtualMemory: Direct from: 0x77172BEC Jump to behavior
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe NtTerminateThread: Direct from: 0x77172FCC Jump to behavior
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe NtQueryInformationToken: Direct from: 0x77172CAC Jump to behavior
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe NtCreateFile: Direct from: 0x77172FEC Jump to behavior
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe NtOpenFile: Direct from: 0x77172DCC Jump to behavior
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe NtClose: Direct from: 0x77172B6C
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe NtSetInformationThread: Direct from: 0x771663F9 Jump to behavior
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe NtAllocateVirtualMemory: Direct from: 0x77173C9C Jump to behavior
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe NtQueryAttributesFile: Direct from: 0x77172E6C Jump to behavior
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe NtSetInformationThread: Direct from: 0x77172B4C Jump to behavior
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe NtReadVirtualMemory: Direct from: 0x77172E8C Jump to behavior
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe NtCreateKey: Direct from: 0x77172C6C Jump to behavior
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe NtQueryVolumeInformationFile: Direct from: 0x77172F2C Jump to behavior
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe NtAllocateVirtualMemory: Direct from: 0x771748EC Jump to behavior
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe NtQuerySystemInformation: Direct from: 0x771748CC Jump to behavior
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe NtOpenSection: Direct from: 0x77172E0C Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe Section loaded: NULL target: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe Section loaded: NULL target: C:\Windows\SysWOW64\AtBroker.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: NULL target: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: NULL target: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Windows\SysWOW64\AtBroker.exe Thread register set: target process: 2548 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Windows\SysWOW64\AtBroker.exe Thread APC queued: target process: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Memory written: C:\Windows\SysWOW64\svchost.exe base: 3189008 Jump to behavior
Contains functionality to execute programs as a different user
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DC87B1 LogonUserW, 0_2_00DC87B1
Contains functionality to launch a program with higher privileges
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00D73B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW, 0_2_00D73B3A
Contains functionality to simulate keystroke presses
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00D748D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput, 0_2_00D748D7
Contains functionality to simulate mouse events
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DD4C53 mouse_event, 0_2_00DD4C53
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\ur3RqLz9DB.exe" Jump to behavior
Source: C:\Program Files (x86)\RirgXuyeGEsHGIzwHSBrhSJlrADTONVxdjBNxVQBiXdNQjsXyavsWYhyqRByszQUsKcpLyspVDX\H7Vvr2xxn9Re.exe Process created: C:\Windows\SysWOW64\AtBroker.exe "C:\Windows\SysWOW64\AtBroker.exe" Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe" Jump to behavior
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DC7CAF GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity, 0_2_00DC7CAF
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DC874B AllocateAndInitializeSid,CheckTokenMembership,FreeSid, 0_2_00DC874B
Source: ur3RqLz9DB.exe Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: ur3RqLz9DB.exe, H7Vvr2xxn9Re.exe, 00000009.00000000.1346978178.0000000000E81000.00000002.00000001.00040000.00000000.sdmp, H7Vvr2xxn9Re.exe, 00000009.00000002.3664418443.0000000000E81000.00000002.00000001.00040000.00000000.sdmp, H7Vvr2xxn9Re.exe, 0000000C.00000000.1492069900.0000000001951000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: H7Vvr2xxn9Re.exe, 00000009.00000000.1346978178.0000000000E81000.00000002.00000001.00040000.00000000.sdmp, H7Vvr2xxn9Re.exe, 00000009.00000002.3664418443.0000000000E81000.00000002.00000001.00040000.00000000.sdmp, H7Vvr2xxn9Re.exe, 0000000C.00000000.1492069900.0000000001951000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progman
Source: H7Vvr2xxn9Re.exe, 00000009.00000000.1346978178.0000000000E81000.00000002.00000001.00040000.00000000.sdmp, H7Vvr2xxn9Re.exe, 00000009.00000002.3664418443.0000000000E81000.00000002.00000001.00040000.00000000.sdmp, H7Vvr2xxn9Re.exe, 0000000C.00000000.1492069900.0000000001951000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Program ManagerW
Source: H7Vvr2xxn9Re.exe, 00000009.00000000.1346978178.0000000000E81000.00000002.00000001.00040000.00000000.sdmp, H7Vvr2xxn9Re.exe, 00000009.00000002.3664418443.0000000000E81000.00000002.00000001.00040000.00000000.sdmp, H7Vvr2xxn9Re.exe, 0000000C.00000000.1492069900.0000000001951000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00D9862B cpuid 0_2_00D9862B
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DA4E87 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 0_2_00DA4E87
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DB1E06 GetUserNameW, 0_2_00DB1E06
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DA3F3A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte, 0_2_00DA3F3A
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00D749A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo, 0_2_00D749A0

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000C.00000002.3666779868.0000000005710000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.1425846454.0000000003F50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.3664924343.0000000004F10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.1420312107.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.3664866008.0000000004EC0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.3664817618.00000000025D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.1425884986.0000000003FA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.3663223364.0000000003220000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\SysWOW64\AtBroker.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\SysWOW64\AtBroker.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ Jump to behavior
OS version to string mapping found (often used in BOTs)
Source: ur3RqLz9DB.exe Binary or memory string: WIN_81
Source: ur3RqLz9DB.exe Binary or memory string: WIN_XP
Source: ur3RqLz9DB.exe Binary or memory string: WIN_XPe
Source: ur3RqLz9DB.exe Binary or memory string: WIN_VISTA
Source: ur3RqLz9DB.exe Binary or memory string: WIN_7
Source: ur3RqLz9DB.exe Binary or memory string: WIN_8
Source: ur3RqLz9DB.exe Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000C.00000002.3666779868.0000000005710000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.1425846454.0000000003F50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.3664924343.0000000004F10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.1420312107.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.3664866008.0000000004EC0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.3664817618.00000000025D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.1425884986.0000000003FA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.3663223364.0000000003220000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DE6283 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket, 0_2_00DE6283
Source: C:\Users\user\Desktop\ur3RqLz9DB.exe Code function: 0_2_00DE6747 socket,WSAGetLastError,bind,WSAGetLastError,closesocket, 0_2_00DE6747
windows-stand
Behavior
Click here to start
Slideshow Behavior Animation
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1649319 Sample: ur3RqLz9DB.exe Startdate: 26/03/2025 Architecture: WINDOWS Score: 100 28 www.855696a.xyz 2->28 30 www.vczuahand.xyz 2->30 32 10 other IPs or domains 2->32 42 Suricata IDS alerts for network traffic 2->42 44 Antivirus detection for URL or domain 2->44 46 Antivirus / Scanner detection for submitted sample 2->46 50 4 other signatures 2->50 10 ur3RqLz9DB.exe 2 2->10         started        signatures3 48 Performs DNS queries to domains with low reputation 30->48 process4 signatures5 62 Binary is likely a compiled AutoIt script file 10->62 64 Writes to foreign memory regions 10->64 66 Maps a DLL or memory area into another process 10->66 68 Switches to a custom stack to bypass stack traces 10->68 13 svchost.exe 10->13         started        process6 signatures7 70 Maps a DLL or memory area into another process 13->70 16 H7Vvr2xxn9Re.exe 13->16 injected process8 signatures9 40 Found direct / indirect Syscall (likely to bypass EDR) 16->40 19 AtBroker.exe 13 16->19         started        process10 signatures11 52 Tries to steal Mail credentials (via file / registry access) 19->52 54 Tries to harvest and steal browser information (history, passwords, etc) 19->54 56 Modifies the context of a thread in another process (thread injection) 19->56 58 3 other signatures 19->58 22 H7Vvr2xxn9Re.exe 19->22 injected 26 firefox.exe 19->26         started        process12 dnsIp13 34 www.soportemx-findmy.click 45.56.79.23, 49705, 49706, 49707 LINODE-APLinodeLLCUS United States 22->34 36 www.headset2.online 156.237.132.252, 49721, 49722, 49723 DXTL-HKDXTLTseungKwanOServiceHK Seychelles 22->36 38 8 other IPs or domains 22->38 60 Found direct / indirect Syscall (likely to bypass EDR) 22->60 signatures14
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
75.2.103.23
 www.thykingdomwear.store United States
16509 AMAZON-02US false
156.237.132.252
 www.headset2.online Seychelles
134548 DXTL-HKDXTLTseungKwanOServiceHK true
149.104.1.185
 www.worrr37.yachts United States
174 COGENT-174US false
199.59.243.160
 www.anyang-590303492.click United States
395082 BODIS-NJUS false
76.223.54.146
 www.vczuahand.xyz United States
16509 AMAZON-02US false
104.21.32.1
 www.meshki-co-uk.shop United States
13335 CLOUDFLARENETUS true
159.198.64.72
 www.futureedge.website United States
131090 CAT-IDC-4BYTENET-AS-APCATTELECOMPublicCompanyLtdCATT true
45.119.52.125
 ns195.l4y.cn China
55933 CLOUDIE-AS-APCloudieLimitedHK true
45.56.79.23
 www.soportemx-findmy.click United States
63949 LINODE-APLinodeLLCUS true
52.223.13.41
 www.forjoyi.live United States
8987 AMAZONEXPANSIONGB false

Contacted Domains

Name IP Active
www.worrr37.yachts 149.104.1.185 true
www.anyang-590303492.click 199.59.243.160 true
www.headset2.online 156.237.132.252 true
ns195.l4y.cn 45.119.52.125 true
www.vczuahand.xyz 76.223.54.146 true
www.futureedge.website 159.198.64.72 true
www.meshki-co-uk.shop 104.21.32.1 true
www.forjoyi.live 52.223.13.41 true
www.soportemx-findmy.click 45.56.79.23 true
www.blackhat.chat 52.223.13.41 true
www.thykingdomwear.store 75.2.103.23 true
www.855696a.xyz unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.blackhat.chat/04r3/?ozr468=n6ptdLvBCapBX+1eOVrY57v3fry5rNe0wfWRjljnFiAjsKOl5dK99Lywx+Nqo77d2RcdyHveJO2lBX31lOnFwP4DiaLEptsC1XkRtKVSKvMDZubQIvkodV1VkZmdBzb+FDEJdsk=&cDdD=stP4ZplpaL true
  • Avira URL Cloud: safe
 unknown
http://www.855696a.xyz/q86a/ true
  • Avira URL Cloud: safe
 unknown
http://www.vczuahand.xyz/lvz4/?cDdD=stP4ZplpaL&ozr468=Xs1PCb/MaYPIPAxDxxaHIqF2/A8U3qhMCQOIGo7Nl8rFa4QZz+K5GgFtLYl71/JRpNHUa5jW6jDEqn+5iMTLSNLkc8YJlW5E2D1BSRT+HZ6nP/WGftokHNP7u6RzqEi71eoyHuI= true
  • Avira URL Cloud: safe
 unknown
http://www.headset2.online/pl23/?cDdD=stP4ZplpaL&ozr468=pwQm/8Nry++CWhwRO+ejyUFgfXoh51ib9cWiDzs/wKG7gU2SU1fIaah3O92QYMu9f5MkpzQiI887Voc7ljrK/R3yynuYM58fVphvPJKYT3CABWaKCWuFCzEUpSJ0ILCgd/ynwhk= true
  • Avira URL Cloud: safe
 unknown
http://www.futureedge.website/q4wg/ true
  • Avira URL Cloud: safe
 unknown
http://www.anyang-590303492.click/6npl/?cDdD=stP4ZplpaL&ozr468=/JYiv5NhO0tELAK9kKXvJIbNp1Br4DUvi5BuLmngF2OWbpzZErtHeLuo5nDg79GzI2QTdod40q0r+J2P58yW98aolaIPcHKB8C+VtOL9beJx1TxkdNAFgpzfmMcKyLG5UVY24PM= true
  • Avira URL Cloud: malware
 unknown
http://www.meshki-co-uk.shop/b8n0/ true
  • Avira URL Cloud: safe
 unknown
http://www.anyang-590303492.click/6npl/ true
  • Avira URL Cloud: malware
 unknown
http://www.soportemx-findmy.click/ma0g/ true
  • Avira URL Cloud: safe
 unknown
http://www.futureedge.website/q4wg/?ozr468=WxORhD4RgEO5uNW054qboO521K/0wGPJQFKGj9LBFcZ0l1e50YnvQ+dx8Uckd3rx1A/7IdNYVLsTEbVWPiDE8n0pQ78tBy34YYRsbULys/fjLZWWaxsBK8nxhK81YtojfvhT+HM=&cDdD=stP4ZplpaL true
  • Avira URL Cloud: safe
 unknown
http://www.worrr37.yachts/1imc/ true
  • Avira URL Cloud: safe
 unknown
http://www.forjoyi.live/c25v/ true
  • Avira URL Cloud: safe
 unknown
http://www.thykingdomwear.store/d4kl/?cDdD=stP4ZplpaL&ozr468=6y/7tod/VF/KHUQqfM/wfVXibkdmZeeslXhDnWhvAY/z/yk3pdRRAQekYBjFWPUzPUKr4nIOcHvctiu99XDhRThC3drFG1AKyOu1/GM/3foXIXDjLpVuiIMe4xDFitXr6UESTD8= true
  • Avira URL Cloud: safe
 unknown
http://www.worrr37.yachts/1imc/?ozr468=GkZ+7lZN5ZbT6rZBuZ+pskfJL+6uT56R2eAXidPe90Y9rybDHdv8GRqVb6FfMfkpXSVDgNv2zaXT/X0CpEMH0N+STTXuzFNw3Wjf+jehbJrVtlfd/HcDvzHP8gjPYHuSisWP2uY=&cDdD=stP4ZplpaL true
  • Avira URL Cloud: safe
 unknown
http://www.blackhat.chat/04r3/ true
  • Avira URL Cloud: safe
 unknown
http://www.headset2.online/pl23/ true
  • Avira URL Cloud: safe
 unknown
http://www.forjoyi.live/c25v/?ozr468=cYQQc4YiFu4DU/POoXdW37/GhYioUbtBJdcMk5WX7gXoSnlFiQLvf2mm8gqHlRakhV+z//0r9RcnPHcD6pi3sDYiTEcusg55GsFJIP0GJUvkZSoStgEPqqD4HSdKtL3zEIrHQIE=&cDdD=stP4ZplpaL true
  • Avira URL Cloud: safe
 unknown
http://www.855696a.xyz/q86a/?ozr468=1RS/DLESjC/mKKX9C/bcN2l/5Bt+ZmCCo7MGFq+OZJ2Pg2HsdXdlDjVOv2U28y6Xqr87siUnw8FG4MQCr+RpC7pac3hRrF1oQLqjSje52VN+B6b6adpmSyob2sUKv/kGLVH3Cqc=&cDdD=stP4ZplpaL true
  • Avira URL Cloud: safe
 unknown
http://www.vczuahand.xyz/lvz4/ true
  • Avira URL Cloud: safe
 unknown
http://www.soportemx-findmy.click/ma0g/?cDdD=stP4ZplpaL&ozr468=H2S90RmziCMvLCuL5yTkJF203ndQbU/T+UjWuF5QkK5TSoHa4lhKP7xjBIvwYHsxlglzK0GWG6GIcHietPpq3u1xo8xOmDzYv29+zWu49xgJoIdTnmgsG6PvYBy+sv7ZAol6cbU= true
  • Avira URL Cloud: safe
 unknown