Windows Analysis Report
QUOTATION#0072395.exe

AV Detection

Source: http://www.anyang-590303492.click/5asc/	Avira URL Cloud: Label: malware
Source: http://www.progressreport.sbs/fm0t/	Avira URL Cloud: Label: malware
Source: http://www.progressreport.sbs/fm0t/?7rPThJ=HN0FJPMJqE54WuoAC9rBg+iyPy7iUGoE0RypB5g7CfrFeifDFflhbSZNtLTs7U15HZnIBVPqsxfpJr9ggZsB8iS8+pGcmwu0pBOXUzcYKWnGwaepyA==&LFuLP=N8sLH430A	Avira URL Cloud: Label: malware

Source: QUOTATION#0072395.exe	Virustotal: Detection: 54%			Perma Link
Source: QUOTATION#0072395.exe	ReversingLabs: Detection: 50%

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1033597823.0000000003A40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3362772946.0000000002C40000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3363106058.0000000002EE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3366385136.00000000049F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1033133393.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3364472057.0000000003040000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3364674637.0000000003780000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1034080368.0000000005350000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Compliance

Source: QUOTATION#0072395.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: RmClient.pdbGCTL source: svchost.exe, 00000001.00000002.1033461515.0000000003412000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1033437509.0000000003400000.00000004.00000020.00020000.00000000.sdmp, 2i4KSAeQqjs.exe, 00000002.00000002.3364018433.000000000064E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: QUOTATION#0072395.exe, 00000000.00000003.917243212.00000000038E0000.00000004.00001000.00020000.00000000.sdmp, QUOTATION#0072395.exe, 00000000.00000003.916725943.0000000003740000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.921630428.0000000003700000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1033636351.0000000003C9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1033636351.0000000003B00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.923734916.0000000003900000.00000004.00000020.00020000.00000000.sdmp, RmClient.exe, 00000003.00000003.1035701452.00000000032AB000.00000004.00000020.00020000.00000000.sdmp, RmClient.exe, 00000003.00000002.3364782266.0000000003460000.00000040.00001000.00020000.00000000.sdmp, RmClient.exe, 00000003.00000002.3364782266.00000000035FE000.00000040.00001000.00020000.00000000.sdmp, RmClient.exe, 00000003.00000003.1033423958.00000000030F8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: QUOTATION#0072395.exe, 00000000.00000003.917243212.00000000038E0000.00000004.00001000.00020000.00000000.sdmp, QUOTATION#0072395.exe, 00000000.00000003.916725943.0000000003740000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000003.921630428.0000000003700000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1033636351.0000000003C9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1033636351.0000000003B00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.923734916.0000000003900000.00000004.00000020.00020000.00000000.sdmp, RmClient.exe, RmClient.exe, 00000003.00000003.1035701452.00000000032AB000.00000004.00000020.00020000.00000000.sdmp, RmClient.exe, 00000003.00000002.3364782266.0000000003460000.00000040.00001000.00020000.00000000.sdmp, RmClient.exe, 00000003.00000002.3364782266.00000000035FE000.00000040.00001000.00020000.00000000.sdmp, RmClient.exe, 00000003.00000003.1033423958.00000000030F8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: RmClient.exe, 00000003.00000002.3365180467.0000000003A8C000.00000004.10000000.00040000.00000000.sdmp, RmClient.exe, 00000003.00000002.3363225227.0000000002F4D000.00000004.00000020.00020000.00000000.sdmp, 2i4KSAeQqjs.exe, 00000005.00000002.3364677712.00000000025BC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.1334592778.0000000033A0C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: RmClient.exe, 00000003.00000002.3365180467.0000000003A8C000.00000004.10000000.00040000.00000000.sdmp, RmClient.exe, 00000003.00000002.3363225227.0000000002F4D000.00000004.00000020.00020000.00000000.sdmp, 2i4KSAeQqjs.exe, 00000005.00000002.3364677712.00000000025BC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.1334592778.0000000033A0C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: RmClient.pdb source: svchost.exe, 00000001.00000002.1033461515.0000000003412000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1033437509.0000000003400000.00000004.00000020.00020000.00000000.sdmp, 2i4KSAeQqjs.exe, 00000002.00000002.3364018433.000000000064E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Work\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: 2i4KSAeQqjs.exe, 00000002.00000002.3362769174.000000000006F000.00000002.00000001.01000000.00000004.sdmp, 2i4KSAeQqjs.exe, 00000005.00000000.1106759411.000000000006F000.00000002.00000001.01000000.00000004.sdmp

Spreading

Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_00E5445A GetFileAttributesW,FindFirstFileW,FindClose,		0_2_00E5445A
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_00E5C6D1 FindFirstFileW,FindClose,		0_2_00E5C6D1
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_00E5C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,		0_2_00E5C75C
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_00E5F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,		0_2_00E5F3F3
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_00E537EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,		0_2_00E537EF
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_00E53B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,		0_2_00E53B12
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_02C5C970 FindFirstFileW,FindNextFileW,FindClose,		3_2_02C5C970

Software Vulnerabilities

Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 4x nop then xor eax, eax		3_2_02C49FC0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 4x nop then pop edi		3_2_02C4E583

Networking

Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49715 -> 104.166.89.204:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49727 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49699 -> 199.59.243.228:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49700 -> 199.59.243.228:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49716 -> 104.166.89.204:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49733 -> 199.59.243.228:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49697 -> 104.21.9.169:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49729 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49713 -> 199.59.243.160:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49701 -> 199.59.243.228:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49732 -> 199.59.243.228:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49705 -> 38.180.96.83:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49704 -> 38.180.96.83:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.9:49702 -> 199.59.243.228:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:49702 -> 199.59.243.228:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49703 -> 38.180.96.83:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49717 -> 104.166.89.204:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49731 -> 199.59.243.228:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.9:49730 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.9:49718 -> 104.166.89.204:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49748 -> 104.21.9.169:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:49718 -> 104.166.89.204:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:49730 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49707 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49696 -> 104.21.9.169:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.9:49738 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:49738 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.9:49698 -> 104.21.9.169:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49695 -> 104.21.9.169:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:49698 -> 104.21.9.169:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49741 -> 52.223.13.41:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49725 -> 77.245.159.55:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.9:49714 -> 199.59.243.160:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:49714 -> 199.59.243.160:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.9:49722 -> 203.161.38.186:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:49722 -> 203.161.38.186:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.9:49688 -> 172.64.80.1:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:49688 -> 172.64.80.1:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49712 -> 199.59.243.160:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49752 -> 199.59.243.228:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49744 -> 104.21.11.37:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49740 -> 52.223.13.41:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49745 -> 104.21.11.37:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49709 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49739 -> 52.223.13.41:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49750 -> 104.21.9.169:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49728 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49749 -> 104.21.9.169:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49720 -> 203.161.38.186:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.9:49726 -> 77.245.159.55:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.9:49710 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:49710 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.9:49746 -> 104.21.11.37:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:49746 -> 104.21.11.37:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49719 -> 203.161.38.186:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49724 -> 77.245.159.55:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49711 -> 199.59.243.160:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.9:49706 -> 38.180.96.83:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:49726 -> 77.245.159.55:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:49706 -> 38.180.96.83:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49743 -> 104.21.11.37:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49723 -> 77.245.159.55:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.9:49751 -> 104.21.9.169:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:49751 -> 104.21.9.169:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49708 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.9:49742 -> 52.223.13.41:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:49742 -> 52.223.13.41:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.9:49747 -> 172.64.80.1:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49721 -> 203.161.38.186:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:49747 -> 172.64.80.1:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.9:49734 -> 199.59.243.228:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:49734 -> 199.59.243.228:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49735 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49737 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49736 -> 84.32.84.32:80

Source:	DNS query: www.link6-tesla-nd6.xyz
Source:	DNS query: www.dubaicarpark.xyz

Source: Joe Sandbox View	IP Address: 38.180.96.83 38.180.96.83
Source: Joe Sandbox View	IP Address: 13.248.169.48 13.248.169.48

Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: NIOBEBILISIMHIZMETLERITR NIOBEBILISIMHIZMETLERITR

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\QUOTATION#0072395.exe

Code function: 0_2_00E622EE InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_00E622EE

Source: global traffic	HTTP traffic detected: GET /ncfq/?7rPThJ=+3ITSOfBVIny1mTavZs17Q9376/klX3H2+I+HyXDj8rxQfoe7x2MXudpkRNTSK9fou3Tb2u3jId7JTCKoKkkCzX48YyJuF2dJHe/jxnO9LYgSB71Ug==&LFuLP=N8sLH430A HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.link6-tesla-nd6.xyzConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.130 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /pr5c/?7rPThJ=Xi/LK6kwyXQKhjKCQL9Nuw5sgizlPuHS/HlWEmGvuZuMTg5EdAzzL2AF+0bP2fPPzrXK77OIZiUqo3lfgNtbTbj92abcsvZHjy0utSJscyN9WqL1tg==&LFuLP=N8sLH430A HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.xiongsupported.shopConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.130 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /q18c/?7rPThJ=aDm6GKOYr0XmGF3Nrvz8r4CnGLFy+8A+Hc3l0PWcafPryfk5HY5KCLAngANtOU40Me4kyF9duAdDeiOy56Plugnlhf5N/+krQEa+M2Az8zjwMtt53w==&LFuLP=N8sLH430A HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.v153cbo9xcl49.buzzConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.130 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /fm0t/?7rPThJ=HN0FJPMJqE54WuoAC9rBg+iyPy7iUGoE0RypB5g7CfrFeifDFflhbSZNtLTs7U15HZnIBVPqsxfpJr9ggZsB8iS8+pGcmwu0pBOXUzcYKWnGwaepyA==&LFuLP=N8sLH430A HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.progressreport.sbsConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.130 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /v7hg/?7rPThJ=WZWKJ9Qw4GKZhbn8MUB5iivld8cr89J1rzv/5bsAiDwAi3JULUOModzom5VDkHubiOmOghqBmGr3eKIIMQjX9xd0/CFEX0Y7c1deF3t41j0imtNA6Q==&LFuLP=N8sLH430A HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.dubaicarpark.xyzConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.130 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /5asc/?LFuLP=N8sLH430A&7rPThJ=aFiBmGBHqEtSRV8Cg0RlGSi5TQ6JNnuZv4EZqPlz8fbXA74/mH2vwX8Y+jkph8wmDySORnJ3hzzoOxdxucHl3qSJNGKOJXkU0AMFG91AbX73pxpFBg== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.anyang-590303492.clickConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.130 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /wgp3/?7rPThJ=FbCmunup9JzbyjawoaUYO20YqMz5RcKn1ZlSYbA9NhRQ5NLtX0xVMyAtOROfqSjnxhBC7hrmjJ3peAjGixZUW37xxv92Q15xJEtRXUSux5KrPQ7zjw==&LFuLP=N8sLH430A HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.cjokfbvd.netConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.130 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /avb4/?LFuLP=N8sLH430A&7rPThJ=s2d3SC9lVJJUD8xe34VAue8k/+/AHjZGzRlBhbfBEvZuVO2d91Pp1hTzVUJD49EBlr7ZA9kxaeDAcbJrPuTT2aW4cK5lD9NBnukVaox++l/A0/qSFA== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.apexpoint.topConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.130 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /scnj/?7rPThJ=la6mruIiTl7jT5t2EcPRjP0WeEe/LFy3MvqxRRXa8eFDOUG5BAmqw6OJnO+J4HgW3FZhvM95BaNPh+FihBC2bfyHMY7kHvwDTHUc9ZYpad+3gLWM+Q==&LFuLP=N8sLH430A HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.lefkosaturklisesi.netConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.130 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /t52t/?7rPThJ=yEQzVPits0NhHU2gr4RI6lK78RLVs+xCfKL87vgTtuIHzz1j5f1H41/t+dWnccE+luCcZRKiXFUeFx6af2BraP/lEgrHKr98nHo8dWtfCka+aBwNIQ==&LFuLP=N8sLH430A HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.motherrucker.shopConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.130 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /kiwx/?7rPThJ=dwrs7e0nshlLwNStdR2kT1v9YE2v1YHtMO32SGCbnOGQbDovHXh4qK/Lb2CeIfWj/mVHBuYbUbIN17xrS6dZTqkf7Ug1so88Ql3E+azXa+6KG8ukHQ==&LFuLP=N8sLH430A HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.eioo.orgConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.130 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /3ps2/?7rPThJ=WXwa1ouCQFjltjxkAh/CTZI/QJYnZJ7RiFZntFtqJtxG/4+QtIGBFRyOqvXMEZndomF/0dELBX9B3HZcejPcmi7S8oopbgz/RS4sN9Yxn/DETEJlNg==&LFuLP=N8sLH430A HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.strappix.onlineConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.130 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /vtfe/?7rPThJ=0BWSKxZteIMvdWwbkh91oKbL4NvnBT/QlXyZVmxR8bAmAzD3t+OZfnLHg22q5MNh4SOsF0UzniEhEnuUD2V13vLlz1qbIQ4OAllzLwZGc+w0xCltDw==&LFuLP=N8sLH430A HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.iborn.orgConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.130 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /zswz/?7rPThJ=edOAwx+0dO4+2suuLvgQpqVnVXSx9YqMGT0O7vLJtqT0uFAfmU6RRfcBg+Pcx7SToF08/52RkEv4Bt7+jrP35cPAiM1wPbiguJUEB3H9phTlt8qMtA==&LFuLP=N8sLH430A HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.vitalbiteb.infoConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.130 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /ncfq/?7rPThJ=+3ITSOfBVIny1mTavZs17Q9376/klX3H2+I+HyXDj8rxQfoe7x2MXudpkRNTSK9fou3Tb2u3jId7JTCKoKkkCzX48YyJuF2dJHe/jxnO9LYgSB71Ug==&LFuLP=N8sLH430A HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.link6-tesla-nd6.xyzConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.130 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /pr5c/?7rPThJ=Xi/LK6kwyXQKhjKCQL9Nuw5sgizlPuHS/HlWEmGvuZuMTg5EdAzzL2AF+0bP2fPPzrXK77OIZiUqo3lfgNtbTbj92abcsvZHjy0utSJscyN9WqL1tg==&LFuLP=N8sLH430A HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.xiongsupported.shopConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.130 Safari/537.36

Source: global traffic	DNS traffic detected: DNS query: www.link6-tesla-nd6.xyz
Source: global traffic	DNS traffic detected: DNS query: www.xiongsupported.shop
Source: global traffic	DNS traffic detected: DNS query: www.v153cbo9xcl49.buzz
Source: global traffic	DNS traffic detected: DNS query: www.progressreport.sbs
Source: global traffic	DNS traffic detected: DNS query: www.dubaicarpark.xyz
Source: global traffic	DNS traffic detected: DNS query: www.tzurik.click
Source: global traffic	DNS traffic detected: DNS query: www.anyang-590303492.click
Source: global traffic	DNS traffic detected: DNS query: www.cjokfbvd.net
Source: global traffic	DNS traffic detected: DNS query: www.apexpoint.top
Source: global traffic	DNS traffic detected: DNS query: www.lefkosaturklisesi.net
Source: global traffic	DNS traffic detected: DNS query: www.motherrucker.shop
Source: global traffic	DNS traffic detected: DNS query: www.eioo.org
Source: global traffic	DNS traffic detected: DNS query: www.strappix.online
Source: global traffic	DNS traffic detected: DNS query: www.iborn.org
Source: global traffic	DNS traffic detected: DNS query: www.ogbos88.cyou
Source: global traffic	DNS traffic detected: DNS query: www.vitalbiteb.info

Source: unknown

HTTP traffic detected: POST /pr5c/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateHost: www.xiongsupported.shopOrigin: http://www.xiongsupported.shopReferer: http://www.xiongsupported.shop/pr5c/Content-Length: 195Cache-Control: max-age=0Connection: closeContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.130 Safari/537.36Data Raw: 37 72 50 54 68 4a 3d 61 67 58 72 4a 4e 49 37 33 57 67 41 69 56 7a 6a 4a 2b 55 6f 6f 52 5a 44 6a 43 72 67 5a 37 57 51 6f 6d 30 33 45 56 71 51 67 59 53 36 4f 48 31 76 4d 78 76 49 4f 45 74 35 79 30 33 45 2f 74 58 32 2f 34 2f 67 35 62 4b 39 58 6c 45 65 35 58 5a 63 32 76 68 62 63 2b 54 4c 2f 64 69 6e 6e 4f 5a 47 31 69 5a 53 7a 44 52 6d 56 6b 63 67 4b 76 76 4e 75 50 34 68 68 7a 79 6b 48 76 56 57 7a 50 75 55 33 4f 2b 30 58 68 57 6c 6e 70 33 43 70 6b 54 33 38 79 69 78 63 79 69 69 52 45 38 45 52 31 4f 63 35 31 47 61 46 6c 69 51 36 71 44 6d 4b 7a 59 73 2b 78 65 76 51 35 65 64 30 4f 6c 4b Data Ascii: 7rPThJ=agXrJNI73WgAiVzjJ+UooRZDjCrgZ7WQom03EVqQgYS6OH1vMxvIOEt5y03E/tX2/4/g5bK9XlEe5XZc2vhbc+TL/dinnOZG1iZSzDRmVkcgKvvNuP4hhzykHvVWzPuU3O+0XhWlnp3CpkT38yixcyiiRE8ER1Oc51GaFliQ6qDmKzYs+xevQ5ed0OlK

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 27 Mar 2025 10:33:51 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8CQjmxWSShy0SGbFCPlo6eoUa2uRoTHFhFd1rNF%2Fxb8BBlv09onCPMZegooXiu2VRwOQqpbUhyhz0W%2FaRZ7Igws3JQa1HaIf42tkHv2M7ZoM%2F08uhSeaD%2F7TNDC9O5RzOHNjmdFIQo4HyQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 926e3b5f6cde437b-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=85563&min_rtt=85563&rtt_var=42781&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=514&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 Data Ascii: 224<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 27 Mar 2025 10:34:07 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3oHyExe6RO1NWnWhjEhmR9risGxm4Tv1YG9ZMjXkoNoP5hZI4C5Ec49f5MkqAcY2iuTjb9rkbdLdpNf2evLxVUQ3VrgEZ%2FwZG6xO4Us2xNmERhdp9eXwyz2bCkLwHcUCxwHsyG5j6iU2nQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 926e3bc1e9804328-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=85784&min_rtt=85784&rtt_var=42892&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=785&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 85 de 61 3c 40 88 85 2e 87 6c 44 c1 85 6e 3c 41 ea 8c 4d 20 9d 94 31 82 bd bd 54 2d 88 6b 97 ae 1e bc 9f 8f 87 a1 0c c9 d5 15 06 f6 e4 b0 c4 92 d8 b5 eb 16 8e b9 c0 2e df 84 d0 be 4c b4 cf 4a 5d 61 97 69 9a f5 cc 52 58 1d 86 e6 7b 11 1a 87 f6 1d cf 6c 75 4b 59 fa 28 f7 cf cc 2e 34 bb 3c 59 19 03 1e 46 4f 14 a5 87 92 81 e2 d5 77 89 e1 70 da 6f c1 0b c1 26 68 1e 18 2e 1a 59 28 4d c0 aa 59 61 f4 3d 83 31 7f c4 af 11 0f 27 a7 bf a8 24 02 00 00 0d 0a Data Ascii: a7M0a<@.lDn<AM 1T-k.LJ]aiRX{luKY(.4<YFOwpo&h.Y(MYa=1'$
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 27 Mar 2025 10:34:09 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FrdSOUM%2Bg5daYFjbKBsjE7qt%2FvNd0%2FuV6xdzd4ZKNMmBemygeDQ61J2a5DFg144kmnX7VF9AUZBcvAiX8eB69e8k%2BHhmY%2BYFqgg%2Bcleki1EBBlNP7pvSoRSk2PYfYQhZadrjz0vEUOp2%2BA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 926e3bd25b774302-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=88523&min_rtt=88523&rtt_var=44261&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=809&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 85 de 61 3c 40 88 85 2e 87 6c 44 c1 85 6e 3c 41 ea 8c 4d 20 9d 94 31 82 bd bd 54 2d 88 6b 97 ae 1e bc 9f 8f 87 a1 0c c9 d5 15 06 f6 e4 b0 c4 92 d8 b5 eb 16 8e b9 c0 2e df 84 d0 be 4c b4 cf 4a 5d 61 97 69 9a f5 cc 52 58 1d 86 e6 7b 11 1a 87 f6 1d cf 6c 75 4b 59 fa 28 f7 cf cc 2e 34 bb 3c 59 19 03 1e 46 4f 14 a5 87 92 81 e2 d5 77 89 e1 70 da 6f c1 0b c1 26 68 1e 18 2e 1a 59 28 4d c0 aa 59 61 f4 3d 83 31 7f c4 af 11 0f 27 a7 bf a8 24 02 00 00 0d 0a Data Ascii: a7M0a<@.lDn<AM 1T-k.LJ]aiRX{luKY(.4<YFOwpo&h.Y(MYa=1'$
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 27 Mar 2025 10:34:12 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=88V9e%2FZuY5WNqsGhug0M4l0R0bhPCdWk2iF4C1SaBw%2F0vutuADGYhAKDbDQz0CVT7Rrm3Krj6uh4D0cQOq%2F34sobmfridYXLj%2Fi8S1P4zLzwP25thXBN72yOAQE9GWk3llFHxhUoMWrfyA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 926e3be2cb6b8c84-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=86360&min_rtt=86360&rtt_var=43180&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=969&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 85 de 61 3c 40 88 85 2e 87 6c 44 c1 85 6e 3c 41 ea 8c 4d 20 9d 94 31 82 bd bd 54 2d 88 6b 97 ae 1e bc 9f 8f 87 a1 0c c9 d5 15 06 f6 e4 b0 c4 92 d8 b5 eb 16 8e b9 c0 2e df 84 d0 be 4c b4 cf 4a 5d 61 97 69 9a f5 cc 52 58 1d 86 e6 7b 11 1a 87 f6 1d cf 6c 75 4b 59 fa 28 f7 cf cc 2e 34 bb 3c 59 19 03 1e 46 4f 14 a5 87 92 81 e2 d5 77 89 e1 70 da 6f c1 0b c1 26 68 1e 18 2e 1a 59 28 4d c0 aa 59 61 f4 3d 83 31 7f c4 af 11 0f 27 a7 bf a8 24 02 00 00 0d 0a Data Ascii: a7M0a<@.lDn<AM 1T-k.LJ]aiRX{luKY(.4<YFOwpo&h.Y(MYa=1'$
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 27 Mar 2025 10:34:15 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UnNOey4DDgE7cftpDKi0N937Unada%2BGgItAeTf3UTNleDdQDBNE0PeCAi5Sdqjwnp3D9mB1X1ngUSOMq1upFpArQuvVRu%2F4ZcxSKgIvGMqoBc783ZvEcmGay85tCS30LypUK4q47lgB7lw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 926e3bf32c13daac-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=85827&min_rtt=85827&rtt_var=42913&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=514&delivery_rate=0&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 Data Ascii: 224<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSI
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Thu, 27 Mar 2025 10:35:22 GMTContent-Type: text/htmlContent-Length: 166Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Thu, 27 Mar 2025 10:35:24 GMTContent-Type: text/htmlContent-Length: 166Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Thu, 27 Mar 2025 10:35:27 GMTContent-Type: text/htmlContent-Length: 166Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 27 Mar 2025 10:35:35 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 27 Mar 2025 10:35:38 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 27 Mar 2025 10:35:41 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 27 Mar 2025 10:35:43 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeexpires: Wed, 11 Jan 1984 05:00:00 GMTcache-control: no-cache, must-revalidate, max-age=0content-type: text/html; charset=UTF-8link: <https://lefkosaturklisesi.net/wp-json/>; rel="https://api.w.org/"content-length: 11681content-encoding: gzipvary: Accept-Encodingdate: Thu, 27 Mar 2025 10:35:49 GMTserver: LiteSpeedData Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 7d 5d 77 db 46 b2 e0 b3 fd 2b da f0 19 8b 4c 40 10 00 29 4a 22 4d 65 12 c7 be 77 76 93 4d 76 9c d9 7b 76 63 af 0f 48 34 45 58 20 80 01 40 7d 0c 47 bf e5 3e ce eb ce fb 7d 9b ec ff da aa ee 06 d0 00 1a 20 48 69 e6 de dc b3 71 24 91 e8 ea aa ea ea ea fa e8 2f bc 7e f1 ed 0f 6f 7e fa 9f 3f be 25 eb 74 e3 5f 3e 7f 8d 7f 88 ef 04 57 73 2d 8d 35 7c 40 1d f7 f2 f9 b3 d7 1b 9a 3a 64 b9 76 e2 84 a6 73 ed 0f 3f bd 1b 9c 6b 64 98 97 04 ce 86 ce b5 1b 8f de 46 61 9c 6a 64 19 06 29 0d 00 f2 d6 73 d3 f5 dc a5 37 de 92 0e d8 17 9d 78 81 97 7a 8e 3f 48 96 8e 4f e7 16 c3 23 a1 39 89 c3 45 98 26 27 39 92 93 8d 73 37 f0 36 ce 15 1d 44 31 45 22 53 df 89 af e8 09 67 20 49 ef 7d 7a e9 6d ae a6 5e d2 fb 39 f1 fe 44 93 b9 e6 6c d3 50 23 de 47 9d f0 27 ff 9b 3f d2 f1 59 9f ec 18 6e c7 0b 06 5e 90 c6 5e 90 78 cb 01 82 4d c9 c8 34 cd e8 8e 58 a7 ec cf c3 eb 21 c7 0e 64 52 2f 85 0f ef 9d fb 95 43 16 5b 7f 0b bc 3a ee 2f 7f 25 af 5e 9e db 96 35 23 df df 93 6f fc f0 ea f5 90 03 3e 7f ed 7b c1 35 89 a9 3f 3f 71 83 04 39 5f d1 74 b9 3e 21 6b f8 34 3f 19 0e 7d ba ba 0e 13 27 dd c6 d7 be 97 d0 c4 33 02 9a b2 36 15 55 35 c7 4f 69 1c 38 29 d5 48 7a 1f 81 8c 9d 28 f2 bd a5 93 7a 61 30 8c 93 e4 cb bb 8d 0f 45 48 72 ae 09 16 c8 ab d8 f9 e3 36 9c 11 e7 fa 97 bf fe df 7f fd e5 af 1a a7 a9 ad d3 34 4a a6 0d 94 87 2b 4a dd a1 f6 94 f4 ef c3 78 bb 39 90 8b 65 b8 d9 40 a7 27 32 3b c9 32 f6 a2 f4 f2 f9 ad 17 b8 e1 ad f1 e9 36 a2 9b f0 b3 f7 9e a6 a9 17 5c 25 64 4e 76 da c2 49 e8 1f 62 5f 9b 0a fc 1f 86 1f 86 89 71 6b 84 f1 d5 87 21 53 9e e4 03 20 8f e9 87 21 ab fc 61 68 9d 1a a6 31 fa 30 3c b3 ef ce ec 0f 43 4d d7 e8 5d 0a f5 8d 28 b8 82 2f c9 cd d5 71 f8 a0 22 c3 06 7f df 72 84 f0 09 bf 87 db 78 49 b5 e9 4e 03 e5 03 09 b2 6a 02 3f 43 af 14 c8 87 e1 6d 04 5a ba f4 b7 2e 52 fc 9c b0 07 ac ee 00 7a 88 42 b3 8d 8d 17 18 9f 93 af 6e 68 3c 9f 18 67 86 ad 3d 3c cc 9e 0f bf 78 41 7e 5a 7b 09 59 79 3e 25 f0 17 f5 7f 70 45 03 1a 03 6d 97 7c 31 7c Data Ascii: }]wF+L@)J"MewvMv{vcH4EX @}G>} Hiq$/~o~?%t_>Ws-5|@:dvs?kdFajd)s7xz?HO#9E&'9s76D1E"Sg I}zm^9DlP#G'?Yn^^xM4X!dR/C[:/%^5#o>{5??q9_t>!k4?}'36U5Oi8)Hz(za0EHr64J+Jx9e@'2;26\%dNvIb_qk!S !ah10<CM](/q"rxINj?CmZ.RzBnh<g=<xA~Z{Yy>%
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeexpires: Wed, 11 Jan 1984 05:00:00 GMTcache-control: no-cache, must-revalidate, max-age=0content-type: text/html; charset=UTF-8link: <https://lefkosaturklisesi.net/wp-json/>; rel="https://api.w.org/"content-length: 11681content-encoding: gzipvary: Accept-Encodingdate: Thu, 27 Mar 2025 10:35:52 GMTserver: LiteSpeedData Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 7d 5d 77 db 46 b2 e0 b3 fd 2b da f0 19 8b 4c 40 10 00 29 4a 22 4d 65 12 c7 be 77 76 93 4d 76 9c d9 7b 76 63 af 0f 48 34 45 58 20 80 01 40 7d 0c 47 bf e5 3e ce eb ce fb 7d 9b ec ff da aa ee 06 d0 00 1a 20 48 69 e6 de dc b3 71 24 91 e8 ea aa ea ea ea fa e8 2f bc 7e f1 ed 0f 6f 7e fa 9f 3f be 25 eb 74 e3 5f 3e 7f 8d 7f 88 ef 04 57 73 2d 8d 35 7c 40 1d f7 f2 f9 b3 d7 1b 9a 3a 64 b9 76 e2 84 a6 73 ed 0f 3f bd 1b 9c 6b 64 98 97 04 ce 86 ce b5 1b 8f de 46 61 9c 6a 64 19 06 29 0d 00 f2 d6 73 d3 f5 dc a5 37 de 92 0e d8 17 9d 78 81 97 7a 8e 3f 48 96 8e 4f e7 16 c3 23 a1 39 89 c3 45 98 26 27 39 92 93 8d 73 37 f0 36 ce 15 1d 44 31 45 22 53 df 89 af e8 09 67 20 49 ef 7d 7a e9 6d ae a6 5e d2 fb 39 f1 fe 44 93 b9 e6 6c d3 50 23 de 47 9d f0 27 ff 9b 3f d2 f1 59 9f ec 18 6e c7 0b 06 5e 90 c6 5e 90 78 cb 01 82 4d c9 c8 34 cd e8 8e 58 a7 ec cf c3 eb 21 c7 0e 64 52 2f 85 0f ef 9d fb 95 43 16 5b 7f 0b bc 3a ee 2f 7f 25 af 5e 9e db 96 35 23 df df 93 6f fc f0 ea f5 90 03 3e 7f ed 7b c1 35 89 a9 3f 3f 71 83 04 39 5f d1 74 b9 3e 21 6b f8 34 3f 19 0e 7d ba ba 0e 13 27 dd c6 d7 be 97 d0 c4 33 02 9a b2 36 15 55 35 c7 4f 69 1c 38 29 d5 48 7a 1f 81 8c 9d 28 f2 bd a5 93 7a 61 30 8c 93 e4 cb bb 8d 0f 45 48 72 ae 09 16 c8 ab d8 f9 e3 36 9c 11 e7 fa 97 bf fe df 7f fd e5 af 1a a7 a9 ad d3 34 4a a6 0d 94 87 2b 4a dd a1 f6 94 f4 ef c3 78 bb 39 90 8b 65 b8 d9 40 a7 27 32 3b c9 32 f6 a2 f4 f2 f9 ad 17 b8 e1 ad f1 e9 36 a2 9b f0 b3 f7 9e a6 a9 17 5c 25 64 4e 76 da c2 49 e8 1f 62 5f 9b 0a fc 1f 86 1f 86 89 71 6b 84 f1 d5 87 21 53 9e e4 03 20 8f e9 87 21 ab fc 61 68 9d 1a a6 31 fa 30 3c b3 ef ce ec 0f 43 4d d7 e8 5d 0a f5 8d 28 b8 82 2f c9 cd d5 71 f8 a0 22 c3 06 7f df 72 84 f0 09 bf 87 db 78 49 b5 e9 4e 03 e5 03 09 b2 6a 02 3f 43 af 14 c8 87 e1 6d 04 5a ba f4 b7 2e 52 fc 9c b0 07 ac ee 00 7a 88 42 b3 8d 8d 17 18 9f 93 af 6e 68 3c 9f 18 67 86 ad 3d 3c cc 9e 0f bf 78 41 7e 5a 7b 09 59 79 3e 25 f0 17 f5 7f 70 45 03 1a 03 6d 97 7c 31 7c Data Ascii: }]wF+L@)J"MewvMv{vcH4EX @}G>} Hiq$/~o~?%t_>Ws-5|@:dvs?kdFajd)s7xz?HO#9E&'9s76D1E"Sg I}zm^9DlP#G'?Yn^^xM4X!dR/C[:/%^5#o>{5??q9_t>!k4?}'36U5Oi8)Hz(za0EHr64J+Jx9e@'2;26\%dNvIb_qk!S !ah10<CM](/q"rxINj?CmZ.RzBnh<g=<xA~Z{Yy>%
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeexpires: Wed, 11 Jan 1984 05:00:00 GMTcache-control: no-cache, must-revalidate, max-age=0content-type: text/html; charset=UTF-8link: <https://lefkosaturklisesi.net/wp-json/>; rel="https://api.w.org/"transfer-encoding: chunkedcontent-encoding: gzipvary: Accept-Encodingdate: Thu, 27 Mar 2025 10:35:55 GMTserver: LiteSpeedData Raw: 32 62 66 36 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec 7d db 96 e3 46 92 d8 73 f7 57 64 a3 cf 74 11 12 09 02 e0 a5 aa c8 66 69 24 4d f7 ee da 92 25 4f 6b bc c7 56 b7 fb 80 44 b2 08 15 48 60 00 b0 2e c3 a9 6f f1 a3 9f e7 7d df 66 fc 5f 8e c8 4c 00 09 20 71 21 ab 66 76 e5 63 b5 aa 8a 44 46 46 44 46 46 c6 25 6f 78 fb ea 77 3f 7c fb d3 7f ff f1 1d d9 24 5b ff ea e5 5b fc 43 7c 67 77 bd d0 92 48 c3 07 d4 71 af 5e be 78 bb a5 89 43 56 1b 27 8a 69 b2 d0 fe f0 d3 fb c1 85 46 86 59 c9 ce d9 d2 85 76 eb d1 bb 30 88 12 8d ac 82 5d 42 77 00 79 e7 b9 c9 66 e1 d2 5b 6f 45 07 ec 4b 9f 78 3b 2f f1 1c 7f 10 af 1c 9f 2e 2c 86 47 42 73 16 05 cb 20 89 cf 32 24 67 5b e7 7e e0 6d 9d 6b 3a 08 23 8a 44 66 be 13 5d d3 33 ce 40 9c 3c f8 f4 ca db 5e cf bc b8 f7 73 ec fd 89 c6 0b cd d9 27 81 46 bc 4f 7d c2 9f fc 4f fe a8 8f cf 74 72 60 b8 1d 6f 37 f0 76 49 e4 ed 62 6f 35 40 b0 19 19 99 a6 19 de 13 6b c2 fe 3c be 1d 72 ec 40 26 f1 12 f8 f0 c1 79 58 3b 64 b9 f7 f7 c0 ab e3 fe ed 2f e4 cd eb 0b db b2 e6 e4 fb 07 f2 8d 1f 5c bf 1d 72 c0 97 6f 7d 6f 77 43 22 ea 2f ce dc 5d 8c 9c af 69 b2 da 9c 91 0d 7c 5a 9c 0d 87 3e 5d df 04 b1 93 ec a3 1b df 8b 69 ec 19 3b 9a b0 36 e5 55 35 c7 4f 68 b4 73 12 aa 91 e4 21 04 19 3b 61 e8 7b 2b 27 f1 82 dd 30 8a e3 2f ef b7 3e 14 21 c9 85 26 58 20 6f 22 e7 8f fb 60 4e 9c 9b bf fd e5 ff fc af bf fd 45 e3 34 b5 4d 92 84 f1 ac 86 f2 70 4d a9 3b d4 9e 93 fe 43 10 ed b7 47 72 b1 0a b6 5b e8 f4 58 66 27 5e 45 5e 98 5c bd bc f3 76 6e 70 67 7c be 0b e9 36 f8 c5 fb 40 93 c4 db 5d c7 64 41 0e da d2 89 e9 1f 22 5f 9b 09 fc 1f 87 1f 87 b1 71 67 04 d1 f5 c7 21 53 9e f8 23 20 8f e8 c7 21 ab fc 71 68 4d 0c d3 18 7d 1c 9e db f7 e7 f6 c7 a1 d6 d7 e8 7d 02 f5 8d 70 77 0d 5f e2 db eb d3 f0 41 45 86 0d fe be e3 08 e1 13 7e 0f f6 d1 8a 6a b3 83 06 ca 07 12 64 d5 04 7e 86 5e 29 90 8f c3 bb 10 b4 74 e5 ef 5d a4 f8 4b cc 1e b0 ba 03 e8 21 0a cd 36 b6 de ce f8 25 fe ea 96 46 8b a9 71 6e d8 da e3 e3 fc e5 f0 8b 57 e4 a7 8d 17 93 b5 e7 53 02 Data Ascii: 2bf6}FsWdtfi$M%OkVDH`.o}f_L q!fvcDFFDFF%oxw?|$[[C|gwHq^xCV'iFYv0]Bwyf[oEKx;/.,GBs 2$g[~mk:#Df]3@<^s'FO}Otr`o7vIbo5@k<r@&yX;d/\ro}owC"/]i|Z>]i;6U5Ohs!;a{+'0/>!&X o"`NE4MpM;CGr[Xf'^E^\vnpg|6@]dA"_qg!S# !qhM}}pw_AE~jd~^)t]K!6%FqnWS
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 27 Mar 2025 10:37:05 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeExpires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cacheSet-Cookie: PHPSESSID=u1t86hhq9khna7j1e5kancbs1f; path=/cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IaK1ihvtGbGZU9I3mOzBnUrD7UHRV4E67fmIojSyIN6NcQV8Ljxr98cyL0m4GkmPtVbwDGi70HAP9L1VOsiLZxzsvmW6jVb%2B8CLPsFaDyMVLdreCJLnH%2FkJtQ8TvmkslfMTuvYKG"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 926e401cdfcdc461-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=85496&min_rtt=85496&rtt_var=42748&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=773&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 03 00 00 00 00 00 00 00 00 00 0d 0a Data Ascii: 14
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 27 Mar 2025 10:37:08 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeExpires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cacheSet-Cookie: PHPSESSID=0pkgjjanp6ic6j706d7m4svnk2; path=/cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=V7ukSlQvT%2BufP07L6YWDCPn%2FSHKDPq7jy5Fs%2FbNhrMvzrvV%2F8tPW0jKESCvKrYpINgIu%2FnsGlf%2BT41I7mfIdhPbIUumaiJG3nBpW73gwc00cBNu%2Bd2FTAFmGgznCEwlEbv1qsCh%2B"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 926e402d8c51985c-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=87543&min_rtt=87543&rtt_var=43771&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=797&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 03 00 00 00 00 00 00 00 00 00 0d 0a Data Ascii: 14
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 27 Mar 2025 10:37:11 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeExpires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cacheSet-Cookie: PHPSESSID=n1bekdoegrvjetb780oaqljval; path=/cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=X72bTSUd9kuQU3k%2B7%2F4rM0nO8ZxK5mpAI%2B8XzCcJP%2BOhJkYDOUXwU1xPDnc0z37tZzJjYvDMFehA%2BF8TElVYNpgaAfhLRKkX7tG7yQjHiFbBMKL8cDhkKSKrTXRLwIRZ%2B5VXQOhy"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 926e403dee6e7039-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=86523&min_rtt=86523&rtt_var=43261&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=957&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 03 00 00 00 00 00 00 00 00 00 0d 0a Data Ascii: 14
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 27 Mar 2025 10:37:13 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeExpires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cacheSet-Cookie: PHPSESSID=rbkkchq3gmf6kl80o5kbl23b91; path=/cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8aqb5HxS9Mmc8HJy321SU%2B%2FeKGze96CKzBVps1dEZfTJXmIHEmRcyCD2%2F4OdLrw6XZrxWLUjPETmgVAQ%2F4iT8GZExYiUz2JpwoPyGQmApFRPA%2BXHou1m%2B3lWLdo%2BkmldSE47Ebke"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 926e404e480532ee-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=85947&min_rtt=85947&rtt_var=42973&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=510&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 27 Mar 2025 10:37:22 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Dz%2FNzwuxb55fF1RWceTSYYDzr4qVe2CB%2B1L3L%2BIYGY0uwT2bLmiMjyeGeDQUjZZIXMmDZrHkwh9p0uXNQsvb2JM8mLg79xFW%2B%2BK1MiLkpCs%2BuRtdjHA3xPuRrB7OcYt4l5vyz3MTGabUtQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 926e4084a92dd96d-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=86315&min_rtt=86315&rtt_var=43157&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=514&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 Data Ascii: 224<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to dis
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 27 Mar 2025 10:37:27 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T%2FQOJ88PkHNlAvaW9pEyiUYgwhUeGs%2B2y2Iqaon0Lcbg6qhhDcC8DlvydZu34yhESMa44zxHC5K63o3IbXuqlQUFrOdYZQVHjizvtguXJIDMUCn5lzdSBn2K87zzohPcXtD%2BTXLhhR4f4w%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 926e40a6b9454328-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=88707&min_rtt=88707&rtt_var=44353&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=785&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 85 de 61 3c 40 88 85 2e 87 6c 44 c1 85 6e 3c 41 ea 8c 4d 20 9d 94 31 82 bd bd 54 2d 88 6b 97 ae 1e bc 9f 8f 87 a1 0c c9 d5 15 06 f6 e4 b0 c4 92 d8 b5 eb 16 8e b9 c0 2e df 84 d0 be 4c b4 cf 4a 5d 61 97 69 9a f5 cc 52 58 1d 86 e6 7b 11 1a 87 f6 1d cf 6c 75 4b 59 fa 28 f7 cf cc 2e 34 bb 3c 59 19 03 1e 46 4f 14 a5 87 92 81 e2 d5 77 89 e1 70 da 6f c1 0b c1 26 68 1e 18 2e 1a 59 28 4d c0 aa 59 61 f4 3d 83 31 7f c4 af 11 0f 27 a7 bf a8 24 02 00 00 0d 0a Data Ascii: a7M0a<@.lDn<AM 1T-k.LJ]aiRX{luKY(.4<YFOwpo&h.Y(MYa=1'$
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 27 Mar 2025 10:37:30 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OjTXMDLlDDXtRm1TFx6PTt9E9RFdCTiemrkAnN5XJALeA13Sh0FD7VWnZVrwMHJpW2LQNXDTYauYOptA8avopcBpzXZ5Yy%2FpelakPAsT23s%2FR8ov0y8koFGWW3FqHe2Xr21727rPghT68Q%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 926e40b71a2cc445-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=86093&min_rtt=86093&rtt_var=43046&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=809&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 85 de 61 3c 40 88 85 2e 87 6c 44 c1 85 6e 3c 41 ea 8c 4d 20 9d 94 31 82 bd bd 54 2d 88 6b 97 ae 1e bc 9f 8f 87 a1 0c c9 d5 15 06 f6 e4 b0 c4 92 d8 b5 eb 16 8e b9 c0 2e df 84 d0 be 4c b4 cf 4a 5d 61 97 69 9a f5 cc 52 58 1d 86 e6 7b 11 1a 87 f6 1d cf 6c 75 4b 59 fa 28 f7 cf cc 2e 34 bb 3c 59 19 03 1e 46 4f 14 a5 87 92 81 e2 d5 77 89 e1 70 da 6f c1 0b c1 26 68 1e 18 2e 1a 59 28 4d c0 aa 59 61 f4 3d 83 31 7f c4 af 11 0f 27 a7 bf a8 24 02 00 00 0d 0a Data Ascii: a7M0a<@.lDn<AM 1T-k.LJ]aiRX{luKY(.4<YFOwpo&h.Y(MYa=1'$
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 27 Mar 2025 10:37:33 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Yg1WnFMXfvshK4hAWjXOyyVCWLz%2BGc56VQnFbNJfH0yZDBCwFjzSawAfVl9hfIH6qLuvtPNufeSkAVZtyZdE1DYMqe%2BXAvvkkrQZL%2FNIWYJQKiMJ19OERJ0ieuK8IFADhqovHb6QpjOhMQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 926e40ca28e77cab-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=86729&min_rtt=86729&rtt_var=43364&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=969&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 85 de 61 3c 40 88 85 2e 87 6c 44 c1 85 6e 3c 41 ea 8c 4d 20 9d 94 31 82 bd bd 54 2d 88 6b 97 ae 1e bc 9f 8f 87 a1 0c c9 d5 15 06 f6 e4 b0 c4 92 d8 b5 eb 16 8e b9 c0 2e df 84 d0 be 4c b4 cf 4a 5d 61 97 69 9a f5 cc 52 58 1d 86 e6 7b 11 1a 87 f6 1d cf 6c 75 4b 59 fa 28 f7 cf cc 2e 34 bb 3c 59 19 03 1e 46 4f 14 a5 87 92 81 e2 d5 77 89 e1 70 da 6f c1 0b c1 26 68 1e 18 2e 1a 59 28 4d c0 aa 59 61 f4 3d 83 31 7f c4 af 11 0f 27 a7 bf a8 24 02 00 00 0d 0a Data Ascii: a7M0a<@.lDn<AM 1T-k.LJ]aiRX{luKY(.4<YFOwpo&h.Y(MYa=1'$
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 27 Mar 2025 10:37:35 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PcAIiJ5%2B5wkfO66qfMhAi2r%2BmTLMS3QIrFHDkYaGfraWgF%2F36GycAd8fecRpKZ05eFh1xIZmXZkYzlwKhZ%2Fq9mwamtlNQuNktkdHPYkjm7lm4bd0NBZin%2FyPaypaweu6V%2F6MoFb485yFcA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 926e40da7d64f5fa-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=85761&min_rtt=85761&rtt_var=42880&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=514&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 Data Ascii: 224<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to dis

Source: RmClient.exe, 00000003.00000002.3365180467.0000000004C96000.00000004.10000000.00040000.00000000.sdmp, 2i4KSAeQqjs.exe, 00000005.00000002.3364677712.00000000037C6000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://lefkosaturklisesi.net/scnj/?7rPThJ=la6mruIiTl7jT5t2EcPRjP0WeEe/LFy3MvqxRRXa8eFDOUG5BAmqw6OJnO
Source: RmClient.exe, 00000003.00000002.3365180467.0000000004972000.00000004.10000000.00040000.00000000.sdmp, 2i4KSAeQqjs.exe, 00000005.00000002.3364677712.00000000034A2000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://push.zhanzhang.baidu.com/push.js
Source: 2i4KSAeQqjs.exe, 00000005.00000002.3366385136.0000000004A61000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.xiongsupported.shop
Source: 2i4KSAeQqjs.exe, 00000005.00000002.3366385136.0000000004A61000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.xiongsupported.shop/pr5c/
Source: RmClient.exe, 00000003.00000003.1228882846.0000000007CDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org?q=
Source: RmClient.exe, 00000003.00000003.1228882846.0000000007CDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: RmClient.exe, 00000003.00000003.1228882846.0000000007CDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: RmClient.exe, 00000003.00000003.1228882846.0000000007CDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RmClient.exe, 00000003.00000003.1228882846.0000000007CDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: RmClient.exe, 00000003.00000003.1228882846.0000000007CDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabv20
Source: RmClient.exe, 00000003.00000003.1228882846.0000000007CDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RmClient.exe, 00000003.00000003.1228882846.0000000007CDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/app?q=
Source: RmClient.exe, 00000003.00000002.3365180467.000000000432A000.00000004.10000000.00040000.00000000.sdmp, 2i4KSAeQqjs.exe, 00000005.00000002.3364677712.0000000002E5A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://kb.fastpanel.direct/troubleshoot/
Source: RmClient.exe, 00000003.00000002.3363225227.0000000002F6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: RmClient.exe, 00000003.00000002.3363225227.0000000002F9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: RmClient.exe, 00000003.00000003.1218372635.0000000007CB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srfhttps://login.
Source: RmClient.exe, 00000003.00000002.3363225227.0000000002F6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: RmClient.exe, 00000003.00000002.3363225227.0000000002F6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033D
Source: RmClient.exe, 00000003.00000002.3363225227.0000000002F97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: RmClient.exe, 00000003.00000002.3363225227.0000000002F9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: RmClient.exe, 00000003.00000003.1228882846.0000000007CDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/v20Y&
Source: RmClient.exe, 00000003.00000002.3365180467.0000000004198000.00000004.10000000.00040000.00000000.sdmp, RmClient.exe, 00000003.00000002.3365180467.0000000004FBA000.00000004.10000000.00040000.00000000.sdmp, RmClient.exe, 00000003.00000002.3365180467.00000000047E0000.00000004.10000000.00040000.00000000.sdmp, 2i4KSAeQqjs.exe, 00000005.00000002.3364677712.0000000003310000.00000004.00000001.00040000.00000000.sdmp, 2i4KSAeQqjs.exe, 00000005.00000002.3364677712.0000000002CC8000.00000004.00000001.00040000.00000000.sdmp, 2i4KSAeQqjs.exe, 00000005.00000002.3364677712.0000000003AEA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: RmClient.exe, 00000003.00000003.1228882846.0000000007CDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
Source: RmClient.exe, 00000003.00000002.3365180467.0000000004972000.00000004.10000000.00040000.00000000.sdmp, 2i4KSAeQqjs.exe, 00000005.00000002.3364677712.00000000034A2000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://zz.bdstatic.com/linksubmit/push.js

Key, Mouse, Clipboard, Microphone and Screen Capturing

Source: C:\Users\user\Desktop\QUOTATION#0072395.exe

Code function: 0_2_00E5001C GetKeyboardState,SetKeyboardState,GetAsyncKeyState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_00E5001C

Source: C:\Users\user\Desktop\QUOTATION#0072395.exe

Code function: 0_2_00E7CABC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00E7CABC

E-Banking Fraud

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1033597823.0000000003A40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3362772946.0000000002C40000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3363106058.0000000002EE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3366385136.00000000049F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1033133393.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3364472057.0000000003040000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3364674637.0000000003780000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1034080368.0000000005350000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: This is a third-party compiled AutoIt script.		0_2_00DF3B3A
Source: QUOTATION#0072395.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: QUOTATION#0072395.exe, 00000000.00000000.905221992.0000000000EA4000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.		memstr_669c6666-5
Source: QUOTATION#0072395.exe, 00000000.00000000.905221992.0000000000EA4000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`		memstr_c6959816-5
Source: QUOTATION#0072395.exe	String found in binary or memory: This is a third-party compiled AutoIt script.		memstr_bec407ff-0
Source: QUOTATION#0072395.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`		memstr_0e994add-e

Source: initial sample

Static PE information: Filename: QUOTATION#0072395.exe

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0042C9D3 NtClose,		1_2_0042C9D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72B60 NtClose,LdrInitializeThunk,		1_2_03B72B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72DF0 NtQuerySystemInformation,LdrInitializeThunk,		1_2_03B72DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72C70 NtFreeVirtualMemory,LdrInitializeThunk,		1_2_03B72C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B735C0 NtCreateMutant,LdrInitializeThunk,		1_2_03B735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B74340 NtSetContextThread,		1_2_03B74340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B74650 NtSuspendThread,		1_2_03B74650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72BA0 NtEnumerateValueKey,		1_2_03B72BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72B80 NtQueryInformationFile,		1_2_03B72B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72BF0 NtAllocateVirtualMemory,		1_2_03B72BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72BE0 NtQueryValueKey,		1_2_03B72BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72AB0 NtWaitForSingleObject,		1_2_03B72AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72AF0 NtWriteFile,		1_2_03B72AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72AD0 NtReadFile,		1_2_03B72AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72FB0 NtResumeThread,		1_2_03B72FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72FA0 NtQuerySection,		1_2_03B72FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72F90 NtProtectVirtualMemory,		1_2_03B72F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72FE0 NtCreateFile,		1_2_03B72FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72F30 NtCreateSection,		1_2_03B72F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72F60 NtCreateProcessEx,		1_2_03B72F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72EA0 NtAdjustPrivilegesToken,		1_2_03B72EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72E80 NtReadVirtualMemory,		1_2_03B72E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72EE0 NtQueueApcThread,		1_2_03B72EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72E30 NtWriteVirtualMemory,		1_2_03B72E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72DB0 NtEnumerateKey,		1_2_03B72DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72DD0 NtDelayExecution,		1_2_03B72DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72D30 NtUnmapViewOfSection,		1_2_03B72D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72D10 NtMapViewOfSection,		1_2_03B72D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72D00 NtSetInformationFile,		1_2_03B72D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72CA0 NtQueryInformationToken,		1_2_03B72CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72CF0 NtOpenProcess,		1_2_03B72CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72CC0 NtQueryVirtualMemory,		1_2_03B72CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72C00 NtQueryInformationProcess,		1_2_03B72C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72C60 NtCreateKey,		1_2_03B72C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B73090 NtSetValueKey,		1_2_03B73090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B73010 NtOpenDirectoryObject,		1_2_03B73010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B739B0 NtGetContextThread,		1_2_03B739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B73D10 NtOpenProcessToken,		1_2_03B73D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B73D70 NtOpenThread,		1_2_03B73D70
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034D4340 NtSetContextThread,LdrInitializeThunk,		3_2_034D4340
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034D4650 NtSuspendThread,LdrInitializeThunk,		3_2_034D4650
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034D2B60 NtClose,LdrInitializeThunk,		3_2_034D2B60
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034D2BE0 NtQueryValueKey,LdrInitializeThunk,		3_2_034D2BE0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034D2BF0 NtAllocateVirtualMemory,LdrInitializeThunk,		3_2_034D2BF0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034D2BA0 NtEnumerateValueKey,LdrInitializeThunk,		3_2_034D2BA0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034D2AD0 NtReadFile,LdrInitializeThunk,		3_2_034D2AD0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034D2AF0 NtWriteFile,LdrInitializeThunk,		3_2_034D2AF0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034D2F30 NtCreateSection,LdrInitializeThunk,		3_2_034D2F30
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034D2FE0 NtCreateFile,LdrInitializeThunk,		3_2_034D2FE0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034D2FB0 NtResumeThread,LdrInitializeThunk,		3_2_034D2FB0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034D2EE0 NtQueueApcThread,LdrInitializeThunk,		3_2_034D2EE0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034D2E80 NtReadVirtualMemory,LdrInitializeThunk,		3_2_034D2E80
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034D2D10 NtMapViewOfSection,LdrInitializeThunk,		3_2_034D2D10
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034D2D30 NtUnmapViewOfSection,LdrInitializeThunk,		3_2_034D2D30
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034D2DD0 NtDelayExecution,LdrInitializeThunk,		3_2_034D2DD0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034D2DF0 NtQuerySystemInformation,LdrInitializeThunk,		3_2_034D2DF0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034D2C60 NtCreateKey,LdrInitializeThunk,		3_2_034D2C60
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034D2C70 NtFreeVirtualMemory,LdrInitializeThunk,		3_2_034D2C70
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034D2CA0 NtQueryInformationToken,LdrInitializeThunk,		3_2_034D2CA0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034D35C0 NtCreateMutant,LdrInitializeThunk,		3_2_034D35C0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034D39B0 NtGetContextThread,LdrInitializeThunk,		3_2_034D39B0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034D2B80 NtQueryInformationFile,		3_2_034D2B80
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034D2AB0 NtWaitForSingleObject,		3_2_034D2AB0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034D2F60 NtCreateProcessEx,		3_2_034D2F60
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034D2F90 NtProtectVirtualMemory,		3_2_034D2F90
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034D2FA0 NtQuerySection,		3_2_034D2FA0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034D2E30 NtWriteVirtualMemory,		3_2_034D2E30
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034D2EA0 NtAdjustPrivilegesToken,		3_2_034D2EA0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034D2D00 NtSetInformationFile,		3_2_034D2D00
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034D2DB0 NtEnumerateKey,		3_2_034D2DB0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034D2C00 NtQueryInformationProcess,		3_2_034D2C00
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034D2CC0 NtQueryVirtualMemory,		3_2_034D2CC0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034D2CF0 NtOpenProcess,		3_2_034D2CF0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034D3010 NtOpenDirectoryObject,		3_2_034D3010
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034D3090 NtSetValueKey,		3_2_034D3090
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034D3D70 NtOpenThread,		3_2_034D3D70
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034D3D10 NtOpenProcessToken,		3_2_034D3D10
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_02C696E0 NtDeleteFile,		3_2_02C696E0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_02C69780 NtClose,		3_2_02C69780
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_02C69480 NtCreateFile,		3_2_02C69480
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_02C695F0 NtReadFile,		3_2_02C695F0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_02C698E0 NtAllocateVirtualMemory,		3_2_02C698E0

Source: C:\Users\user\Desktop\QUOTATION#0072395.exe

Code function: 0_2_00E53DE2: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00E53DE2

Source: C:\Users\user\Desktop\QUOTATION#0072395.exe

Code function: 0_2_00E48310 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00E48310

Source: C:\Users\user\Desktop\QUOTATION#0072395.exe

Code function: 0_2_00E551BD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00E551BD

Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_00DFE6A0		0_2_00DFE6A0
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_00E1D975		0_2_00E1D975
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_00DFFCE0		0_2_00DFFCE0
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_00E121C5		0_2_00E121C5
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_00E262D2		0_2_00E262D2
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_00E2242E		0_2_00E2242E
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_00E125FA		0_2_00E125FA
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_00E066E1		0_2_00E066E1
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_00E4E616		0_2_00E4E616
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_00E2878F		0_2_00E2878F
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_00E58889		0_2_00E58889
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_00E26844		0_2_00E26844
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_00E70857		0_2_00E70857
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_00E08808		0_2_00E08808
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_00E1CB21		0_2_00E1CB21
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_00E26DB6		0_2_00E26DB6
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_00E06F9E		0_2_00E06F9E
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_00E03030		0_2_00E03030
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_00E1F1D9		0_2_00E1F1D9
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_00E13187		0_2_00E13187
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_00DF1287		0_2_00DF1287
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_00E11484		0_2_00E11484
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_00E05520		0_2_00E05520
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_00E17696		0_2_00E17696
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_00E05760		0_2_00E05760
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_00E11978		0_2_00E11978
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_00E29AB5		0_2_00E29AB5
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_00E77DDB		0_2_00E77DDB
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_00E1BDA6		0_2_00E1BDA6
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_00E11D90		0_2_00E11D90
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_00E03FE0		0_2_00E03FE0
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_00DFDF00		0_2_00DFDF00
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_010A7338		0_2_010A7338
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00418993		1_2_00418993
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004101AA		1_2_004101AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004101B3		1_2_004101B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00401250		1_2_00401250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00402AD6		1_2_00402AD6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00402AE0		1_2_00402AE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004103D3		1_2_004103D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00416BA3		1_2_00416BA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040E3B3		1_2_0040E3B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040E500		1_2_0040E500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040E503		1_2_0040E503
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00402FD0		1_2_00402FD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0042EFB3		1_2_0042EFB3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C003E6		1_2_03C003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B4E3F0		1_2_03B4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BFA352		1_2_03BFA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BC02C0		1_2_03BC02C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BF41A2		1_2_03BF41A2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C001AA		1_2_03C001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C021AE		1_2_03C021AE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BF81CC		1_2_03BF81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BDA118		1_2_03BDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B30100		1_2_03B30100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BC8158		1_2_03BC8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BD2000		1_2_03BD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3C7C0		1_2_03B3C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B40770		1_2_03B40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B64750		1_2_03B64750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5C6E0		1_2_03B5C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C00591		1_2_03C00591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B40535		1_2_03B40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BEE4F6		1_2_03BEE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BE4420		1_2_03BE4420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BF2446		1_2_03BF2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BFEB89		1_2_03BFEB89
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BF6BD7		1_2_03BF6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BFAB40		1_2_03BFAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3EA80		1_2_03B3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B429A0		1_2_03B429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B56962		1_2_03B56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B268B8		1_2_03B268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6E8F0		1_2_03B6E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B4A840		1_2_03B4A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BBEFA0		1_2_03BBEFA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B32FC8		1_2_03B32FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B60F30		1_2_03B60F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BE2F30		1_2_03BE2F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B82F28		1_2_03B82F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB4F40		1_2_03BB4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B52E90		1_2_03B52E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BFCE93		1_2_03BFCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BFEEDB		1_2_03BFEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BFEE26		1_2_03BFEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B58DBF		1_2_03B58DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3ADE0		1_2_03B3ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B48DC0		1_2_03B48DC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BDCD1F		1_2_03BDCD1F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B4AD00		1_2_03B4AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B30CF2		1_2_03B30CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B40C00		1_2_03B40C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BF132D		1_2_03BF132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B2D34C		1_2_03B2D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B452A0		1_2_03B452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5D2F0		1_2_03B5D2F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BE12ED		1_2_03BE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5B2C0		1_2_03B5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B4B1B0		1_2_03B4B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C0B16B		1_2_03C0B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B2F172		1_2_03B2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B7516C		1_2_03B7516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BF70E9		1_2_03BF70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BFF0E0		1_2_03BFF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BEF0CC		1_2_03BEF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BFF7B0		1_2_03BFF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B317EC		1_2_03B317EC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BF16CC		1_2_03BF16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B85630		1_2_03B85630
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C095C3		1_2_03C095C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BDD5B0		1_2_03BDD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BF7571		1_2_03BF7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BFF43F		1_2_03BFF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B31460		1_2_03B31460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5FB80		1_2_03B5FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB5BF0		1_2_03BB5BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B7DBF9		1_2_03B7DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BFFB76		1_2_03BFFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BDDAAC		1_2_03BDDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BE1AA3		1_2_03BE1AA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BEDAC6		1_2_03BEDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB3A6C		1_2_03BB3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BFFA49		1_2_03BFFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BF7A46		1_2_03BF7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B45990		1_2_03B45990
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BD5910		1_2_03BD5910
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B49950		1_2_03B49950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5B950		1_2_03B5B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B438E0		1_2_03B438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BAD800		1_2_03BAD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BFFFB1		1_2_03BFFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B41F92		1_2_03B41F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B03FD2		1_2_03B03FD2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B03FD5		1_2_03B03FD5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BFFF09		1_2_03BFFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B49EB0		1_2_03B49EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5FDC0		1_2_03B5FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BF7D73		1_2_03BF7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BF1D5A		1_2_03BF1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BFFCF2		1_2_03BFFCF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB9C32		1_2_03BB9C32
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_0355A352		3_2_0355A352
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_035603E6		3_2_035603E6
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034AE3F0		3_2_034AE3F0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_035202C0		3_2_035202C0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_03528158		3_2_03528158
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_03490100		3_2_03490100
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_0353A118		3_2_0353A118
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_035581CC		3_2_035581CC
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_035541A2		3_2_035541A2
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_035621AE		3_2_035621AE
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_035601AA		3_2_035601AA
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_03532000		3_2_03532000
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034C4750		3_2_034C4750
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034A0770		3_2_034A0770
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_0349C7C0		3_2_0349C7C0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034BC6E0		3_2_034BC6E0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034A0535		3_2_034A0535
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_03560591		3_2_03560591
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_03552446		3_2_03552446
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_03544420		3_2_03544420
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_0354E4F6		3_2_0354E4F6
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_0355AB40		3_2_0355AB40
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_03556BD7		3_2_03556BD7
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_0355EB89		3_2_0355EB89
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_0349EA80		3_2_0349EA80
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034B6962		3_2_034B6962
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034A29A0		3_2_034A29A0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034AA840		3_2_034AA840
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034CE8F0		3_2_034CE8F0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034868B8		3_2_034868B8
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_03514F40		3_2_03514F40
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_03542F30		3_2_03542F30
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034E2F28		3_2_034E2F28
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034C0F30		3_2_034C0F30
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_03492FC8		3_2_03492FC8
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_0351EFA0		3_2_0351EFA0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_0355EE26		3_2_0355EE26
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_0355EEDB		3_2_0355EEDB
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_0355CE93		3_2_0355CE93
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034B2E90		3_2_034B2E90
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034AAD00		3_2_034AAD00
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_0353CD1F		3_2_0353CD1F
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034A8DC0		3_2_034A8DC0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_0349ADE0		3_2_0349ADE0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034B8DBF		3_2_034B8DBF
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034A0C00		3_2_034A0C00
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_03490CF2		3_2_03490CF2
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_0348D34C		3_2_0348D34C
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_0355132D		3_2_0355132D
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034BB2C0		3_2_034BB2C0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_035412ED		3_2_035412ED
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034BD2F0		3_2_034BD2F0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034A52A0		3_2_034A52A0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034D516C		3_2_034D516C
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_0348F172		3_2_0348F172
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_0356B16B		3_2_0356B16B
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034AB1B0		3_2_034AB1B0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_0354F0CC		3_2_0354F0CC
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_0355F0E0		3_2_0355F0E0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_035570E9		3_2_035570E9
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034917EC		3_2_034917EC
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_0355F7B0		3_2_0355F7B0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034E5630		3_2_034E5630
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_035516CC		3_2_035516CC
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_03557571		3_2_03557571
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_035695C3		3_2_035695C3
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_0353D5B0		3_2_0353D5B0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_03491460		3_2_03491460
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_0355F43F		3_2_0355F43F
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_0355FB76		3_2_0355FB76
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_03515BF0		3_2_03515BF0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034DDBF9		3_2_034DDBF9
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034BFB80		3_2_034BFB80
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_03557A46		3_2_03557A46
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_0355FA49		3_2_0355FA49
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_03513A6C		3_2_03513A6C
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_0354DAC6		3_2_0354DAC6
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_03541AA3		3_2_03541AA3
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_0353DAAC		3_2_0353DAAC
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034A9950		3_2_034A9950
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034BB950		3_2_034BB950
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_03535910		3_2_03535910
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034A5990		3_2_034A5990
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_0350D800		3_2_0350D800
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034A38E0		3_2_034A38E0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_0355FF09		3_2_0355FF09
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_03463FD5		3_2_03463FD5
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_03463FD2		3_2_03463FD2
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034A1F92		3_2_034A1F92
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_0355FFB1		3_2_0355FFB1
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034A9EB0		3_2_034A9EB0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_03551D5A		3_2_03551D5A
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_03557D73		3_2_03557D73
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034BFDC0		3_2_034BFDC0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_03519C32		3_2_03519C32
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_0355FCF2		3_2_0355FCF2
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_02C52080		3_2_02C52080
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_02C4CF57		3_2_02C4CF57
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_02C4CF60		3_2_02C4CF60
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_02C4B2AD		3_2_02C4B2AD
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_02C4B2B0		3_2_02C4B2B0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_02C4D180		3_2_02C4D180
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_02C4B160		3_2_02C4B160
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_02C55740		3_2_02C55740
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_02C51940		3_2_02C51940
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_02C53950		3_2_02C53950
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_02C6BD60		3_2_02C6BD60
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_032AE368		3_2_032AE368
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_032AE483		3_2_032AE483
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_032AE822		3_2_032AE822
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_032AD8E8		3_2_032AD8E8

Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: String function: 00E10AE3 appears 70 times
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: String function: 00E18900 appears 36 times
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: String function: 00DF7DE1 appears 35 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03BAEA12 appears 76 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03B75130 appears 53 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03BBF290 appears 98 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03B2B970 appears 210 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03B87E54 appears 102 times
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: String function: 034E7E54 appears 102 times
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: String function: 0351F290 appears 98 times
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: String function: 0348B970 appears 210 times
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: String function: 0350EA12 appears 76 times
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: String function: 034D5130 appears 53 times

Source: QUOTATION#0072395.exe, 00000000.00000003.915624085.0000000003A0D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs QUOTATION#0072395.exe
Source: QUOTATION#0072395.exe, 00000000.00000003.916725943.0000000003863000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs QUOTATION#0072395.exe

Source: QUOTATION#0072395.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/3@16/13

Source: C:\Users\user\Desktop\QUOTATION#0072395.exe

Code function: 0_2_00E5A06A GetLastError,FormatMessageW,

0_2_00E5A06A

Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_00E481CB AdjustTokenPrivileges,CloseHandle,		0_2_00E481CB
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_00E487E1 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00E487E1

Source: C:\Users\user\Desktop\QUOTATION#0072395.exe

Code function: 0_2_00E5B3FB SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00E5B3FB

Source: C:\Users\user\Desktop\QUOTATION#0072395.exe

Code function: 0_2_00E6EE0D CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00E6EE0D

Source: C:\Users\user\Desktop\QUOTATION#0072395.exe

Code function: 0_2_00E683BB CoInitialize,CoUninitialize,CoCreateInstance,IIDFromString,VariantInit,VariantClear,

0_2_00E683BB

Source: C:\Users\user\Desktop\QUOTATION#0072395.exe

Code function: 0_2_00DF4E89 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00DF4E89

Source: C:\Users\user\Desktop\QUOTATION#0072395.exe

File created: C:\Users\user\AppData\Local\Temp\aut1407.tmp

Jump to behavior

Source: QUOTATION#0072395.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION#0072395.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RmClient.exe, 00000003.00000002.3363225227.0000000002FDD000.00000004.00000020.00020000.00000000.sdmp, RmClient.exe, 00000003.00000002.3363225227.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp, RmClient.exe, 00000003.00000003.1219421044.0000000002FD2000.00000004.00000020.00020000.00000000.sdmp, RmClient.exe, 00000003.00000002.3363225227.0000000002FD2000.00000004.00000020.00020000.00000000.sdmp, RmClient.exe, 00000003.00000002.3363225227.0000000003000000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: QUOTATION#0072395.exe	Virustotal: Detection: 54%
Source: QUOTATION#0072395.exe	ReversingLabs: Detection: 50%

Source: unknown	Process created: C:\Users\user\Desktop\QUOTATION#0072395.exe "C:\Users\user\Desktop\QUOTATION#0072395.exe"
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\QUOTATION#0072395.exe"
Source: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe	Process created: C:\Windows\SysWOW64\RmClient.exe "C:\Windows\SysWOW64\RmClient.exe"
Source: C:\Windows\SysWOW64\RmClient.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\QUOTATION#0072395.exe"			Jump to behavior
Source: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe	Process created: C:\Windows\SysWOW64\RmClient.exe "C:\Windows\SysWOW64\RmClient.exe"			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"			Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Section loaded: wsock32.dll			Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Section loaded: winmm.dll			Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Section loaded: mpr.dll			Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Section loaded: wininet.dll			Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Section loaded: ntmarta.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: wininet.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: ieframe.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: iertutil.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: netapi32.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: winhttp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: wkscli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: secur32.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: mlang.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: propsys.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: winsqlite3.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: vaultcli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: dpapi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe	Section loaded: wininet.dll			Jump to behavior
Source: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe	Section loaded: mswsock.dll			Jump to behavior
Source: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe	Section loaded: dnsapi.dll			Jump to behavior
Source: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe	Section loaded: fwpuclnt.dll			Jump to behavior
Source: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe	Section loaded: rasadhlp.dll			Jump to behavior

Source: C:\Windows\SysWOW64\RmClient.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\RmClient.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Jump to behavior

Source: QUOTATION#0072395.exe

Static file information: File size 1337856 > 1048576

Source: QUOTATION#0072395.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: QUOTATION#0072395.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: QUOTATION#0072395.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: QUOTATION#0072395.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: QUOTATION#0072395.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: QUOTATION#0072395.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: QUOTATION#0072395.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: RmClient.pdbGCTL source: svchost.exe, 00000001.00000002.1033461515.0000000003412000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1033437509.0000000003400000.00000004.00000020.00020000.00000000.sdmp, 2i4KSAeQqjs.exe, 00000002.00000002.3364018433.000000000064E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: QUOTATION#0072395.exe, 00000000.00000003.917243212.00000000038E0000.00000004.00001000.00020000.00000000.sdmp, QUOTATION#0072395.exe, 00000000.00000003.916725943.0000000003740000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.921630428.0000000003700000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1033636351.0000000003C9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1033636351.0000000003B00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.923734916.0000000003900000.00000004.00000020.00020000.00000000.sdmp, RmClient.exe, 00000003.00000003.1035701452.00000000032AB000.00000004.00000020.00020000.00000000.sdmp, RmClient.exe, 00000003.00000002.3364782266.0000000003460000.00000040.00001000.00020000.00000000.sdmp, RmClient.exe, 00000003.00000002.3364782266.00000000035FE000.00000040.00001000.00020000.00000000.sdmp, RmClient.exe, 00000003.00000003.1033423958.00000000030F8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: QUOTATION#0072395.exe, 00000000.00000003.917243212.00000000038E0000.00000004.00001000.00020000.00000000.sdmp, QUOTATION#0072395.exe, 00000000.00000003.916725943.0000000003740000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000003.921630428.0000000003700000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1033636351.0000000003C9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1033636351.0000000003B00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.923734916.0000000003900000.00000004.00000020.00020000.00000000.sdmp, RmClient.exe, RmClient.exe, 00000003.00000003.1035701452.00000000032AB000.00000004.00000020.00020000.00000000.sdmp, RmClient.exe, 00000003.00000002.3364782266.0000000003460000.00000040.00001000.00020000.00000000.sdmp, RmClient.exe, 00000003.00000002.3364782266.00000000035FE000.00000040.00001000.00020000.00000000.sdmp, RmClient.exe, 00000003.00000003.1033423958.00000000030F8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: RmClient.exe, 00000003.00000002.3365180467.0000000003A8C000.00000004.10000000.00040000.00000000.sdmp, RmClient.exe, 00000003.00000002.3363225227.0000000002F4D000.00000004.00000020.00020000.00000000.sdmp, 2i4KSAeQqjs.exe, 00000005.00000002.3364677712.00000000025BC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.1334592778.0000000033A0C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: RmClient.exe, 00000003.00000002.3365180467.0000000003A8C000.00000004.10000000.00040000.00000000.sdmp, RmClient.exe, 00000003.00000002.3363225227.0000000002F4D000.00000004.00000020.00020000.00000000.sdmp, 2i4KSAeQqjs.exe, 00000005.00000002.3364677712.00000000025BC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.1334592778.0000000033A0C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: RmClient.pdb source: svchost.exe, 00000001.00000002.1033461515.0000000003412000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1033437509.0000000003400000.00000004.00000020.00020000.00000000.sdmp, 2i4KSAeQqjs.exe, 00000002.00000002.3364018433.000000000064E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Work\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: 2i4KSAeQqjs.exe, 00000002.00000002.3362769174.000000000006F000.00000002.00000001.01000000.00000004.sdmp, 2i4KSAeQqjs.exe, 00000005.00000000.1106759411.000000000006F000.00000002.00000001.01000000.00000004.sdmp

Source: QUOTATION#0072395.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: QUOTATION#0072395.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: QUOTATION#0072395.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: QUOTATION#0072395.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: QUOTATION#0072395.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Source: C:\Users\user\Desktop\QUOTATION#0072395.exe

Code function: 0_2_00DF4B37 LoadLibraryA,GetProcAddress,

0_2_00DF4B37

Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_00E5848F push FFFFFF8Bh; iretd		0_2_00E58491
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_00E18945 push ecx; ret		0_2_00E18958
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00419001 push eax; ret		1_2_00419003
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00427013 push edi; retf		1_2_0042701C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004158EE push 0D652055h; ret		1_2_00415919
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004149DE push FFFFFFFBh; iretd		1_2_004149DD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00403250 push eax; ret		1_2_00403252
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00417357 push ebp; ret		1_2_00417359
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00416362 push cs; ret		1_2_00416363
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00415BA8 pushad ; iretd		1_2_00415BA9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00411D7F push ss; retf		1_2_00411D80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004125B6 push es; ret		1_2_004125B7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004176CD push cs; ret		1_2_004176E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004067A8 push edx; ret		1_2_004067A9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B0225F pushad ; ret		1_2_03B027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B027FA pushad ; ret		1_2_03B027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B309AD push ecx; mov dword ptr [esp], ecx		1_2_03B309B6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B0283D push eax; iretd		1_2_03B02858
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_0346225F pushad ; ret		3_2_034627F9
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034627FA pushad ; ret		3_2_034627F9
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_034909AD push ecx; mov dword ptr [esp], ecx		3_2_034909B6
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_0346283D push eax; iretd		3_2_03462858
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_0346135E push eax; iretd		3_2_03461369
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_02C54104 push ebp; ret		3_2_02C54106
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_02C5269B push 0D652055h; ret		3_2_02C526C6
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_02C5447A push cs; ret		3_2_02C54494
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_02C4EB2C push ss; retf		3_2_02C4EB2D
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_02C52955 pushad ; iretd		3_2_02C52956
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_02C4F363 push es; ret		3_2_02C4F364
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_02C43555 push edx; ret		3_2_02C43556
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_02C57877 push ss; ret		3_2_02C57884

Hooking and other Techniques for Hiding and Protection

Source: C:\Users\user\Desktop\QUOTATION#0072395.exe

Code function: 0_2_00E75376 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,

0_2_00E75376

Source: C:\Users\user\Desktop\QUOTATION#0072395.exe

Code function: 0_2_00E13187 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00E13187

Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	API/Special instruction interceptor: Address: 10A6F5C
Source: C:\Windows\SysWOW64\RmClient.exe	API/Special instruction interceptor: Address: 7FFA424ED324
Source: C:\Windows\SysWOW64\RmClient.exe	API/Special instruction interceptor: Address: 7FFA424ED7E4
Source: C:\Windows\SysWOW64\RmClient.exe	API/Special instruction interceptor: Address: 7FFA424ED944
Source: C:\Windows\SysWOW64\RmClient.exe	API/Special instruction interceptor: Address: 7FFA424ED504
Source: C:\Windows\SysWOW64\RmClient.exe	API/Special instruction interceptor: Address: 7FFA424ED544
Source: C:\Windows\SysWOW64\RmClient.exe	API/Special instruction interceptor: Address: 7FFA424ED1E4
Source: C:\Windows\SysWOW64\RmClient.exe	API/Special instruction interceptor: Address: 7FFA424F0154
Source: C:\Windows\SysWOW64\RmClient.exe	API/Special instruction interceptor: Address: 7FFA424EDA44

Source: QUOTATION#0072395.exe, 00000000.00000002.918992126.0000000001116000.00000004.00000020.00020000.00000000.sdmp, QUOTATION#0072395.exe, 00000000.00000003.905965819.00000000010E7000.00000004.00000020.00020000.00000000.sdmp, QUOTATION#0072395.exe, 00000000.00000003.906070772.0000000001116000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: PROCESSHACKER.EXEE

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_03C021AE rdtsc

1_2_03C021AE

Source: C:\Windows\SysWOW64\RmClient.exe	Window / User API: threadDelayed 1881			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Window / User API: threadDelayed 8092			Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION#0072395.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	API coverage: 4.8 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.8 %
Source: C:\Windows\SysWOW64\RmClient.exe	API coverage: 3.0 %

Source: C:\Windows\SysWOW64\RmClient.exe TID: 6200	Thread sleep count: 1881 > 30			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe TID: 6200	Thread sleep time: -3762000s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe TID: 6200	Thread sleep count: 8092 > 30			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe TID: 6200	Thread sleep time: -16184000s >= -30000s			Jump to behavior
Source: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe TID: 6552	Thread sleep time: -95000s >= -30000s			Jump to behavior
Source: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe TID: 6552	Thread sleep count: 38 > 30			Jump to behavior
Source: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe TID: 6552	Thread sleep time: -57000s >= -30000s			Jump to behavior
Source: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe TID: 6552	Thread sleep count: 48 > 30			Jump to behavior
Source: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe TID: 6552	Thread sleep time: -48000s >= -30000s			Jump to behavior

Source: C:\Windows\SysWOW64\RmClient.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\RmClient.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_00E5445A GetFileAttributesW,FindFirstFileW,FindClose,		0_2_00E5445A
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_00E5C6D1 FindFirstFileW,FindClose,		0_2_00E5C6D1
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_00E5C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,		0_2_00E5C75C
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_00E5F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,		0_2_00E5F3F3
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_00E537EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,		0_2_00E537EF
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_00E53B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,		0_2_00E53B12
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 3_2_02C5C970 FindFirstFileW,FindNextFileW,FindClose,		3_2_02C5C970

Source: C:\Users\user\Desktop\QUOTATION#0072395.exe

Code function: 0_2_00DF49A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00DF49A0

Source: 786202vrQ.3.dr	Binary or memory string: dev.azure.comVMware20,11696497155j
Source: 786202vrQ.3.dr	Binary or memory string: global block list test formVMware20,11696497155
Source: 786202vrQ.3.dr	Binary or memory string: turbotax.intuit.comVMware20,11696497155t
Source: RmClient.exe, 00000003.00000002.3366993078.0000000007D3D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: hdfcbank.comVMware20,11696497155
Source: RmClient.exe, 00000003.00000002.3363225227.0000000002F4D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll[
Source: 786202vrQ.3.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696497155
Source: RmClient.exe, 00000003.00000002.3366993078.0000000007D3D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,116964971}T
Source: 786202vrQ.3.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696497155]
Source: 786202vrQ.3.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696497155|UE
Source: 786202vrQ.3.dr	Binary or memory string: tasks.office.comVMware20,11696497155o
Source: 786202vrQ.3.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155
Source: RmClient.exe, 00000003.00000002.3366993078.0000000007D3D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .comVMware20,11696497155t
Source: 786202vrQ.3.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696497155
Source: 2i4KSAeQqjs.exe, 00000005.00000002.3364131819.00000000007F9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000007.00000002.1336571492.0000019A739FC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 786202vrQ.3.dr	Binary or memory string: bankofamerica.comVMware20,11696497155x
Source: 786202vrQ.3.dr	Binary or memory string: ms.portal.azure.comVMware20,11696497155
Source: 786202vrQ.3.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696497155h
Source: RmClient.exe, 00000003.00000002.3366993078.0000000007D3D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CDYNVMware20,11696497155p
Source: 786202vrQ.3.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696497155p
Source: 786202vrQ.3.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696497155n
Source: 786202vrQ.3.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696497155d
Source: 786202vrQ.3.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696497155x
Source: RmClient.exe, 00000003.00000002.3366993078.0000000007D3D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware20,11696497155t
Source: 786202vrQ.3.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696497155
Source: RmClient.exe, 00000003.00000002.3366993078.0000000007D3D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: active Brokers - EU WestVMware20,11696497155n
Source: 786202vrQ.3.dr	Binary or memory string: interactivebrokers.comVMware20,11696497155
Source: 786202vrQ.3.dr	Binary or memory string: AMC password management pageVMware20,11696497155
Source: RmClient.exe, 00000003.00000002.3366993078.0000000007D3D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696497155W
Source: 786202vrQ.3.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696497155
Source: 786202vrQ.3.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696497155}
Source: 786202vrQ.3.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696497155u
Source: 786202vrQ.3.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155^
Source: 786202vrQ.3.dr	Binary or memory string: discord.comVMware20,11696497155f
Source: RmClient.exe, 00000003.00000002.3366993078.0000000007D3D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ve Brokers - HKVMware20,11696497155]
Source: 786202vrQ.3.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696497155
Source: RmClient.exe, 00000003.00000002.3366993078.0000000007D3D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,1oW
Source: RmClient.exe, 00000003.00000002.3366993078.0000000007D3D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware
Source: 786202vrQ.3.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696497155z
Source: 786202vrQ.3.dr	Binary or memory string: outlook.office.comVMware20,11696497155s
Source: 786202vrQ.3.dr	Binary or memory string: outlook.office365.comVMware20,11696497155t
Source: RmClient.exe, 00000003.00000002.3366993078.0000000007D3D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,1
Source: 786202vrQ.3.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696497155}
Source: 786202vrQ.3.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696497155~
Source: 786202vrQ.3.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696497155x

Source: C:\Users\user\Desktop\QUOTATION#0072395.exe

API call chain: ExitProcess graph end node

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_03C021AE rdtsc

1_2_03C021AE

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_00417B33 LdrLoadDll,

1_2_00417B33

Source: C:\Users\user\Desktop\QUOTATION#0072395.exe

Code function: 0_2_00E63F09 BlockInput,

0_2_00E63F09

Source: C:\Users\user\Desktop\QUOTATION#0072395.exe

Code function: 0_2_00DF3B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00DF3B3A

Source: C:\Users\user\Desktop\QUOTATION#0072395.exe

Code function: 0_2_00E25A7C EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00E25A7C

Source: C:\Users\user\Desktop\QUOTATION#0072395.exe

Code function: 0_2_00DF4B37 LoadLibraryA,GetProcAddress,

0_2_00DF4B37

Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_010A71C8 mov eax, dword ptr fs:[00000030h]		0_2_010A71C8
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_010A7228 mov eax, dword ptr fs:[00000030h]		0_2_010A7228
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_010A5BA8 mov eax, dword ptr fs:[00000030h]		0_2_010A5BA8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B28397 mov eax, dword ptr fs:[00000030h]		1_2_03B28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B28397 mov eax, dword ptr fs:[00000030h]		1_2_03B28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B28397 mov eax, dword ptr fs:[00000030h]		1_2_03B28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5438F mov eax, dword ptr fs:[00000030h]		1_2_03B5438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5438F mov eax, dword ptr fs:[00000030h]		1_2_03B5438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B2E388 mov eax, dword ptr fs:[00000030h]		1_2_03B2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B2E388 mov eax, dword ptr fs:[00000030h]		1_2_03B2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B2E388 mov eax, dword ptr fs:[00000030h]		1_2_03B2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B4E3F0 mov eax, dword ptr fs:[00000030h]		1_2_03B4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B4E3F0 mov eax, dword ptr fs:[00000030h]		1_2_03B4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B4E3F0 mov eax, dword ptr fs:[00000030h]		1_2_03B4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B663FF mov eax, dword ptr fs:[00000030h]		1_2_03B663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B403E9 mov eax, dword ptr fs:[00000030h]		1_2_03B403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B403E9 mov eax, dword ptr fs:[00000030h]		1_2_03B403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B403E9 mov eax, dword ptr fs:[00000030h]		1_2_03B403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B403E9 mov eax, dword ptr fs:[00000030h]		1_2_03B403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B403E9 mov eax, dword ptr fs:[00000030h]		1_2_03B403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B403E9 mov eax, dword ptr fs:[00000030h]		1_2_03B403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B403E9 mov eax, dword ptr fs:[00000030h]		1_2_03B403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B403E9 mov eax, dword ptr fs:[00000030h]		1_2_03B403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BDE3DB mov eax, dword ptr fs:[00000030h]		1_2_03BDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BDE3DB mov eax, dword ptr fs:[00000030h]		1_2_03BDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BDE3DB mov ecx, dword ptr fs:[00000030h]		1_2_03BDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BDE3DB mov eax, dword ptr fs:[00000030h]		1_2_03BDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BD43D4 mov eax, dword ptr fs:[00000030h]		1_2_03BD43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BD43D4 mov eax, dword ptr fs:[00000030h]		1_2_03BD43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BEC3CD mov eax, dword ptr fs:[00000030h]		1_2_03BEC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3A3C0 mov eax, dword ptr fs:[00000030h]		1_2_03B3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3A3C0 mov eax, dword ptr fs:[00000030h]		1_2_03B3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3A3C0 mov eax, dword ptr fs:[00000030h]		1_2_03B3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3A3C0 mov eax, dword ptr fs:[00000030h]		1_2_03B3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3A3C0 mov eax, dword ptr fs:[00000030h]		1_2_03B3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3A3C0 mov eax, dword ptr fs:[00000030h]		1_2_03B3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B383C0 mov eax, dword ptr fs:[00000030h]		1_2_03B383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B383C0 mov eax, dword ptr fs:[00000030h]		1_2_03B383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B383C0 mov eax, dword ptr fs:[00000030h]		1_2_03B383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B383C0 mov eax, dword ptr fs:[00000030h]		1_2_03B383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB63C0 mov eax, dword ptr fs:[00000030h]		1_2_03BB63C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C0634F mov eax, dword ptr fs:[00000030h]		1_2_03C0634F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B2C310 mov ecx, dword ptr fs:[00000030h]		1_2_03B2C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B50310 mov ecx, dword ptr fs:[00000030h]		1_2_03B50310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6A30B mov eax, dword ptr fs:[00000030h]		1_2_03B6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6A30B mov eax, dword ptr fs:[00000030h]		1_2_03B6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6A30B mov eax, dword ptr fs:[00000030h]		1_2_03B6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BD437C mov eax, dword ptr fs:[00000030h]		1_2_03BD437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C08324 mov eax, dword ptr fs:[00000030h]		1_2_03C08324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C08324 mov ecx, dword ptr fs:[00000030h]		1_2_03C08324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C08324 mov eax, dword ptr fs:[00000030h]		1_2_03C08324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C08324 mov eax, dword ptr fs:[00000030h]		1_2_03C08324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB035C mov eax, dword ptr fs:[00000030h]		1_2_03BB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB035C mov eax, dword ptr fs:[00000030h]		1_2_03BB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB035C mov eax, dword ptr fs:[00000030h]		1_2_03BB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB035C mov ecx, dword ptr fs:[00000030h]		1_2_03BB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB035C mov eax, dword ptr fs:[00000030h]		1_2_03BB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB035C mov eax, dword ptr fs:[00000030h]		1_2_03BB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BFA352 mov eax, dword ptr fs:[00000030h]		1_2_03BFA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BD8350 mov ecx, dword ptr fs:[00000030h]		1_2_03BD8350
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B402A0 mov eax, dword ptr fs:[00000030h]		1_2_03B402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B402A0 mov eax, dword ptr fs:[00000030h]		1_2_03B402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C062D6 mov eax, dword ptr fs:[00000030h]		1_2_03C062D6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BC62A0 mov eax, dword ptr fs:[00000030h]		1_2_03BC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BC62A0 mov ecx, dword ptr fs:[00000030h]		1_2_03BC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BC62A0 mov eax, dword ptr fs:[00000030h]		1_2_03BC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BC62A0 mov eax, dword ptr fs:[00000030h]		1_2_03BC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BC62A0 mov eax, dword ptr fs:[00000030h]		1_2_03BC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BC62A0 mov eax, dword ptr fs:[00000030h]		1_2_03BC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6E284 mov eax, dword ptr fs:[00000030h]		1_2_03B6E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6E284 mov eax, dword ptr fs:[00000030h]		1_2_03B6E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB0283 mov eax, dword ptr fs:[00000030h]		1_2_03BB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB0283 mov eax, dword ptr fs:[00000030h]		1_2_03BB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB0283 mov eax, dword ptr fs:[00000030h]		1_2_03BB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B402E1 mov eax, dword ptr fs:[00000030h]		1_2_03B402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B402E1 mov eax, dword ptr fs:[00000030h]		1_2_03B402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B402E1 mov eax, dword ptr fs:[00000030h]		1_2_03B402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3A2C3 mov eax, dword ptr fs:[00000030h]		1_2_03B3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3A2C3 mov eax, dword ptr fs:[00000030h]		1_2_03B3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3A2C3 mov eax, dword ptr fs:[00000030h]		1_2_03B3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3A2C3 mov eax, dword ptr fs:[00000030h]		1_2_03B3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3A2C3 mov eax, dword ptr fs:[00000030h]		1_2_03B3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B2823B mov eax, dword ptr fs:[00000030h]		1_2_03B2823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C0625D mov eax, dword ptr fs:[00000030h]		1_2_03C0625D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B34260 mov eax, dword ptr fs:[00000030h]		1_2_03B34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B34260 mov eax, dword ptr fs:[00000030h]		1_2_03B34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B34260 mov eax, dword ptr fs:[00000030h]		1_2_03B34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B2826B mov eax, dword ptr fs:[00000030h]		1_2_03B2826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B2A250 mov eax, dword ptr fs:[00000030h]		1_2_03B2A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B36259 mov eax, dword ptr fs:[00000030h]		1_2_03B36259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BEA250 mov eax, dword ptr fs:[00000030h]		1_2_03BEA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BEA250 mov eax, dword ptr fs:[00000030h]		1_2_03BEA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB8243 mov eax, dword ptr fs:[00000030h]		1_2_03BB8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB8243 mov ecx, dword ptr fs:[00000030h]		1_2_03BB8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB019F mov eax, dword ptr fs:[00000030h]		1_2_03BB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB019F mov eax, dword ptr fs:[00000030h]		1_2_03BB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB019F mov eax, dword ptr fs:[00000030h]		1_2_03BB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB019F mov eax, dword ptr fs:[00000030h]		1_2_03BB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B2A197 mov eax, dword ptr fs:[00000030h]		1_2_03B2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B2A197 mov eax, dword ptr fs:[00000030h]		1_2_03B2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B2A197 mov eax, dword ptr fs:[00000030h]		1_2_03B2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C061E5 mov eax, dword ptr fs:[00000030h]		1_2_03C061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B70185 mov eax, dword ptr fs:[00000030h]		1_2_03B70185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BEC188 mov eax, dword ptr fs:[00000030h]		1_2_03BEC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BEC188 mov eax, dword ptr fs:[00000030h]		1_2_03BEC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BD4180 mov eax, dword ptr fs:[00000030h]		1_2_03BD4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BD4180 mov eax, dword ptr fs:[00000030h]		1_2_03BD4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B601F8 mov eax, dword ptr fs:[00000030h]		1_2_03B601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BAE1D0 mov eax, dword ptr fs:[00000030h]		1_2_03BAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BAE1D0 mov eax, dword ptr fs:[00000030h]		1_2_03BAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BAE1D0 mov ecx, dword ptr fs:[00000030h]		1_2_03BAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BAE1D0 mov eax, dword ptr fs:[00000030h]		1_2_03BAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BAE1D0 mov eax, dword ptr fs:[00000030h]		1_2_03BAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C021AE mov eax, dword ptr fs:[00000030h]		1_2_03C021AE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BF61C3 mov eax, dword ptr fs:[00000030h]		1_2_03BF61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BF61C3 mov eax, dword ptr fs:[00000030h]		1_2_03BF61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B60124 mov eax, dword ptr fs:[00000030h]		1_2_03B60124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C04164 mov eax, dword ptr fs:[00000030h]		1_2_03C04164
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C04164 mov eax, dword ptr fs:[00000030h]		1_2_03C04164
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BDA118 mov ecx, dword ptr fs:[00000030h]		1_2_03BDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BDA118 mov eax, dword ptr fs:[00000030h]		1_2_03BDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BDA118 mov eax, dword ptr fs:[00000030h]		1_2_03BDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BDA118 mov eax, dword ptr fs:[00000030h]		1_2_03BDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BF0115 mov eax, dword ptr fs:[00000030h]		1_2_03BF0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BDE10E mov eax, dword ptr fs:[00000030h]		1_2_03BDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BDE10E mov ecx, dword ptr fs:[00000030h]		1_2_03BDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BDE10E mov eax, dword ptr fs:[00000030h]		1_2_03BDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BDE10E mov eax, dword ptr fs:[00000030h]		1_2_03BDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BDE10E mov ecx, dword ptr fs:[00000030h]		1_2_03BDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BDE10E mov eax, dword ptr fs:[00000030h]		1_2_03BDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BDE10E mov eax, dword ptr fs:[00000030h]		1_2_03BDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BDE10E mov ecx, dword ptr fs:[00000030h]		1_2_03BDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BDE10E mov eax, dword ptr fs:[00000030h]		1_2_03BDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BDE10E mov ecx, dword ptr fs:[00000030h]		1_2_03BDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B2C156 mov eax, dword ptr fs:[00000030h]		1_2_03B2C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BC8158 mov eax, dword ptr fs:[00000030h]		1_2_03BC8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B36154 mov eax, dword ptr fs:[00000030h]		1_2_03B36154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B36154 mov eax, dword ptr fs:[00000030h]		1_2_03B36154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BC4144 mov eax, dword ptr fs:[00000030h]		1_2_03BC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BC4144 mov eax, dword ptr fs:[00000030h]		1_2_03BC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BC4144 mov ecx, dword ptr fs:[00000030h]		1_2_03BC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BC4144 mov eax, dword ptr fs:[00000030h]		1_2_03BC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BC4144 mov eax, dword ptr fs:[00000030h]		1_2_03BC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BF60B8 mov eax, dword ptr fs:[00000030h]		1_2_03BF60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BF60B8 mov ecx, dword ptr fs:[00000030h]		1_2_03BF60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B280A0 mov eax, dword ptr fs:[00000030h]		1_2_03B280A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BC80A8 mov eax, dword ptr fs:[00000030h]		1_2_03BC80A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3208A mov eax, dword ptr fs:[00000030h]		1_2_03B3208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B2C0F0 mov eax, dword ptr fs:[00000030h]		1_2_03B2C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B720F0 mov ecx, dword ptr fs:[00000030h]		1_2_03B720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B2A0E3 mov ecx, dword ptr fs:[00000030h]		1_2_03B2A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B380E9 mov eax, dword ptr fs:[00000030h]		1_2_03B380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB60E0 mov eax, dword ptr fs:[00000030h]		1_2_03BB60E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB20DE mov eax, dword ptr fs:[00000030h]		1_2_03BB20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BC6030 mov eax, dword ptr fs:[00000030h]		1_2_03BC6030
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B2A020 mov eax, dword ptr fs:[00000030h]		1_2_03B2A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B2C020 mov eax, dword ptr fs:[00000030h]		1_2_03B2C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B4E016 mov eax, dword ptr fs:[00000030h]		1_2_03B4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B4E016 mov eax, dword ptr fs:[00000030h]		1_2_03B4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B4E016 mov eax, dword ptr fs:[00000030h]		1_2_03B4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B4E016 mov eax, dword ptr fs:[00000030h]		1_2_03B4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB4000 mov ecx, dword ptr fs:[00000030h]		1_2_03BB4000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BD2000 mov eax, dword ptr fs:[00000030h]		1_2_03BD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BD2000 mov eax, dword ptr fs:[00000030h]		1_2_03BD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BD2000 mov eax, dword ptr fs:[00000030h]		1_2_03BD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BD2000 mov eax, dword ptr fs:[00000030h]		1_2_03BD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BD2000 mov eax, dword ptr fs:[00000030h]		1_2_03BD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BD2000 mov eax, dword ptr fs:[00000030h]		1_2_03BD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BD2000 mov eax, dword ptr fs:[00000030h]		1_2_03BD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BD2000 mov eax, dword ptr fs:[00000030h]		1_2_03BD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5C073 mov eax, dword ptr fs:[00000030h]		1_2_03B5C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B32050 mov eax, dword ptr fs:[00000030h]		1_2_03B32050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB6050 mov eax, dword ptr fs:[00000030h]		1_2_03BB6050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B307AF mov eax, dword ptr fs:[00000030h]		1_2_03B307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BE47A0 mov eax, dword ptr fs:[00000030h]		1_2_03BE47A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BD678E mov eax, dword ptr fs:[00000030h]		1_2_03BD678E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B347FB mov eax, dword ptr fs:[00000030h]		1_2_03B347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B347FB mov eax, dword ptr fs:[00000030h]		1_2_03B347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B527ED mov eax, dword ptr fs:[00000030h]		1_2_03B527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B527ED mov eax, dword ptr fs:[00000030h]		1_2_03B527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B527ED mov eax, dword ptr fs:[00000030h]		1_2_03B527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BBE7E1 mov eax, dword ptr fs:[00000030h]		1_2_03BBE7E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3C7C0 mov eax, dword ptr fs:[00000030h]		1_2_03B3C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB07C3 mov eax, dword ptr fs:[00000030h]		1_2_03BB07C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6273C mov eax, dword ptr fs:[00000030h]		1_2_03B6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6273C mov ecx, dword ptr fs:[00000030h]		1_2_03B6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6273C mov eax, dword ptr fs:[00000030h]		1_2_03B6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BAC730 mov eax, dword ptr fs:[00000030h]		1_2_03BAC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6C720 mov eax, dword ptr fs:[00000030h]		1_2_03B6C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6C720 mov eax, dword ptr fs:[00000030h]		1_2_03B6C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B30710 mov eax, dword ptr fs:[00000030h]		1_2_03B30710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B60710 mov eax, dword ptr fs:[00000030h]		1_2_03B60710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6C700 mov eax, dword ptr fs:[00000030h]		1_2_03B6C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B38770 mov eax, dword ptr fs:[00000030h]		1_2_03B38770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B40770 mov eax, dword ptr fs:[00000030h]		1_2_03B40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B40770 mov eax, dword ptr fs:[00000030h]		1_2_03B40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B40770 mov eax, dword ptr fs:[00000030h]		1_2_03B40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B40770 mov eax, dword ptr fs:[00000030h]		1_2_03B40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B40770 mov eax, dword ptr fs:[00000030h]		1_2_03B40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B40770 mov eax, dword ptr fs:[00000030h]		1_2_03B40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B40770 mov eax, dword ptr fs:[00000030h]		1_2_03B40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B40770 mov eax, dword ptr fs:[00000030h]		1_2_03B40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B40770 mov eax, dword ptr fs:[00000030h]		1_2_03B40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B40770 mov eax, dword ptr fs:[00000030h]		1_2_03B40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B40770 mov eax, dword ptr fs:[00000030h]		1_2_03B40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B40770 mov eax, dword ptr fs:[00000030h]		1_2_03B40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B30750 mov eax, dword ptr fs:[00000030h]		1_2_03B30750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BBE75D mov eax, dword ptr fs:[00000030h]		1_2_03BBE75D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72750 mov eax, dword ptr fs:[00000030h]		1_2_03B72750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72750 mov eax, dword ptr fs:[00000030h]		1_2_03B72750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6674D mov esi, dword ptr fs:[00000030h]		1_2_03B6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6674D mov eax, dword ptr fs:[00000030h]		1_2_03B6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6674D mov eax, dword ptr fs:[00000030h]		1_2_03B6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B666B0 mov eax, dword ptr fs:[00000030h]		1_2_03B666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6C6A6 mov eax, dword ptr fs:[00000030h]		1_2_03B6C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B34690 mov eax, dword ptr fs:[00000030h]		1_2_03B34690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B34690 mov eax, dword ptr fs:[00000030h]		1_2_03B34690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BAE6F2 mov eax, dword ptr fs:[00000030h]		1_2_03BAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BAE6F2 mov eax, dword ptr fs:[00000030h]		1_2_03BAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BAE6F2 mov eax, dword ptr fs:[00000030h]		1_2_03BAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BAE6F2 mov eax, dword ptr fs:[00000030h]		1_2_03BAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB06F1 mov eax, dword ptr fs:[00000030h]		1_2_03BB06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB06F1 mov eax, dword ptr fs:[00000030h]		1_2_03BB06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6A6C7 mov ebx, dword ptr fs:[00000030h]		1_2_03B6A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6A6C7 mov eax, dword ptr fs:[00000030h]		1_2_03B6A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B4E627 mov eax, dword ptr fs:[00000030h]		1_2_03B4E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B66620 mov eax, dword ptr fs:[00000030h]		1_2_03B66620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B68620 mov eax, dword ptr fs:[00000030h]		1_2_03B68620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3262C mov eax, dword ptr fs:[00000030h]		1_2_03B3262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72619 mov eax, dword ptr fs:[00000030h]		1_2_03B72619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BAE609 mov eax, dword ptr fs:[00000030h]		1_2_03BAE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B4260B mov eax, dword ptr fs:[00000030h]		1_2_03B4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B4260B mov eax, dword ptr fs:[00000030h]		1_2_03B4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B4260B mov eax, dword ptr fs:[00000030h]		1_2_03B4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B4260B mov eax, dword ptr fs:[00000030h]		1_2_03B4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B4260B mov eax, dword ptr fs:[00000030h]		1_2_03B4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B4260B mov eax, dword ptr fs:[00000030h]		1_2_03B4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B4260B mov eax, dword ptr fs:[00000030h]		1_2_03B4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B62674 mov eax, dword ptr fs:[00000030h]		1_2_03B62674
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BF866E mov eax, dword ptr fs:[00000030h]		1_2_03BF866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BF866E mov eax, dword ptr fs:[00000030h]		1_2_03BF866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6A660 mov eax, dword ptr fs:[00000030h]		1_2_03B6A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6A660 mov eax, dword ptr fs:[00000030h]		1_2_03B6A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B4C640 mov eax, dword ptr fs:[00000030h]		1_2_03B4C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B545B1 mov eax, dword ptr fs:[00000030h]		1_2_03B545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B545B1 mov eax, dword ptr fs:[00000030h]		1_2_03B545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB05A7 mov eax, dword ptr fs:[00000030h]		1_2_03BB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB05A7 mov eax, dword ptr fs:[00000030h]		1_2_03BB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB05A7 mov eax, dword ptr fs:[00000030h]		1_2_03BB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6E59C mov eax, dword ptr fs:[00000030h]		1_2_03B6E59C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B32582 mov eax, dword ptr fs:[00000030h]		1_2_03B32582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B32582 mov ecx, dword ptr fs:[00000030h]		1_2_03B32582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B64588 mov eax, dword ptr fs:[00000030h]		1_2_03B64588
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5E5E7 mov eax, dword ptr fs:[00000030h]		1_2_03B5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5E5E7 mov eax, dword ptr fs:[00000030h]		1_2_03B5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5E5E7 mov eax, dword ptr fs:[00000030h]		1_2_03B5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5E5E7 mov eax, dword ptr fs:[00000030h]		1_2_03B5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5E5E7 mov eax, dword ptr fs:[00000030h]		1_2_03B5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5E5E7 mov eax, dword ptr fs:[00000030h]		1_2_03B5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5E5E7 mov eax, dword ptr fs:[00000030h]		1_2_03B5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5E5E7 mov eax, dword ptr fs:[00000030h]		1_2_03B5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B325E0 mov eax, dword ptr fs:[00000030h]		1_2_03B325E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6C5ED mov eax, dword ptr fs:[00000030h]		1_2_03B6C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6C5ED mov eax, dword ptr fs:[00000030h]		1_2_03B6C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B365D0 mov eax, dword ptr fs:[00000030h]		1_2_03B365D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6A5D0 mov eax, dword ptr fs:[00000030h]		1_2_03B6A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6A5D0 mov eax, dword ptr fs:[00000030h]		1_2_03B6A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6E5CF mov eax, dword ptr fs:[00000030h]		1_2_03B6E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6E5CF mov eax, dword ptr fs:[00000030h]		1_2_03B6E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B40535 mov eax, dword ptr fs:[00000030h]		1_2_03B40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B40535 mov eax, dword ptr fs:[00000030h]		1_2_03B40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B40535 mov eax, dword ptr fs:[00000030h]		1_2_03B40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B40535 mov eax, dword ptr fs:[00000030h]		1_2_03B40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B40535 mov eax, dword ptr fs:[00000030h]		1_2_03B40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B40535 mov eax, dword ptr fs:[00000030h]		1_2_03B40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5E53E mov eax, dword ptr fs:[00000030h]		1_2_03B5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5E53E mov eax, dword ptr fs:[00000030h]		1_2_03B5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5E53E mov eax, dword ptr fs:[00000030h]		1_2_03B5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5E53E mov eax, dword ptr fs:[00000030h]		1_2_03B5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5E53E mov eax, dword ptr fs:[00000030h]		1_2_03B5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BC6500 mov eax, dword ptr fs:[00000030h]		1_2_03BC6500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C04500 mov eax, dword ptr fs:[00000030h]		1_2_03C04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C04500 mov eax, dword ptr fs:[00000030h]		1_2_03C04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C04500 mov eax, dword ptr fs:[00000030h]		1_2_03C04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C04500 mov eax, dword ptr fs:[00000030h]		1_2_03C04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C04500 mov eax, dword ptr fs:[00000030h]		1_2_03C04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C04500 mov eax, dword ptr fs:[00000030h]		1_2_03C04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C04500 mov eax, dword ptr fs:[00000030h]		1_2_03C04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6656A mov eax, dword ptr fs:[00000030h]		1_2_03B6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6656A mov eax, dword ptr fs:[00000030h]		1_2_03B6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6656A mov eax, dword ptr fs:[00000030h]		1_2_03B6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B38550 mov eax, dword ptr fs:[00000030h]		1_2_03B38550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B38550 mov eax, dword ptr fs:[00000030h]		1_2_03B38550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B644B0 mov ecx, dword ptr fs:[00000030h]		1_2_03B644B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BBA4B0 mov eax, dword ptr fs:[00000030h]		1_2_03BBA4B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B364AB mov eax, dword ptr fs:[00000030h]		1_2_03B364AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BEA49A mov eax, dword ptr fs:[00000030h]		1_2_03BEA49A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B304E5 mov ecx, dword ptr fs:[00000030h]		1_2_03B304E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B2E420 mov eax, dword ptr fs:[00000030h]		1_2_03B2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B2E420 mov eax, dword ptr fs:[00000030h]		1_2_03B2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B2E420 mov eax, dword ptr fs:[00000030h]		1_2_03B2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B2C427 mov eax, dword ptr fs:[00000030h]		1_2_03B2C427
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB6420 mov eax, dword ptr fs:[00000030h]		1_2_03BB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB6420 mov eax, dword ptr fs:[00000030h]		1_2_03BB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB6420 mov eax, dword ptr fs:[00000030h]		1_2_03BB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB6420 mov eax, dword ptr fs:[00000030h]		1_2_03BB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB6420 mov eax, dword ptr fs:[00000030h]		1_2_03BB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB6420 mov eax, dword ptr fs:[00000030h]		1_2_03BB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB6420 mov eax, dword ptr fs:[00000030h]		1_2_03BB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B68402 mov eax, dword ptr fs:[00000030h]		1_2_03B68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B68402 mov eax, dword ptr fs:[00000030h]		1_2_03B68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B68402 mov eax, dword ptr fs:[00000030h]		1_2_03B68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5A470 mov eax, dword ptr fs:[00000030h]		1_2_03B5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5A470 mov eax, dword ptr fs:[00000030h]		1_2_03B5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5A470 mov eax, dword ptr fs:[00000030h]		1_2_03B5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BBC460 mov ecx, dword ptr fs:[00000030h]		1_2_03BBC460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BEA456 mov eax, dword ptr fs:[00000030h]		1_2_03BEA456
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B2645D mov eax, dword ptr fs:[00000030h]		1_2_03B2645D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5245A mov eax, dword ptr fs:[00000030h]		1_2_03B5245A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6E443 mov eax, dword ptr fs:[00000030h]		1_2_03B6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6E443 mov eax, dword ptr fs:[00000030h]		1_2_03B6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6E443 mov eax, dword ptr fs:[00000030h]		1_2_03B6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6E443 mov eax, dword ptr fs:[00000030h]		1_2_03B6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6E443 mov eax, dword ptr fs:[00000030h]		1_2_03B6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6E443 mov eax, dword ptr fs:[00000030h]		1_2_03B6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6E443 mov eax, dword ptr fs:[00000030h]		1_2_03B6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6E443 mov eax, dword ptr fs:[00000030h]		1_2_03B6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B40BBE mov eax, dword ptr fs:[00000030h]		1_2_03B40BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B40BBE mov eax, dword ptr fs:[00000030h]		1_2_03B40BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BE4BB0 mov eax, dword ptr fs:[00000030h]		1_2_03BE4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BE4BB0 mov eax, dword ptr fs:[00000030h]		1_2_03BE4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B38BF0 mov eax, dword ptr fs:[00000030h]		1_2_03B38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B38BF0 mov eax, dword ptr fs:[00000030h]		1_2_03B38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B38BF0 mov eax, dword ptr fs:[00000030h]		1_2_03B38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BBCBF0 mov eax, dword ptr fs:[00000030h]		1_2_03BBCBF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BDEBD0 mov eax, dword ptr fs:[00000030h]		1_2_03BDEBD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B30BCD mov eax, dword ptr fs:[00000030h]		1_2_03B30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B30BCD mov eax, dword ptr fs:[00000030h]		1_2_03B30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B30BCD mov eax, dword ptr fs:[00000030h]		1_2_03B30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5EB20 mov eax, dword ptr fs:[00000030h]		1_2_03B5EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5EB20 mov eax, dword ptr fs:[00000030h]		1_2_03B5EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BF8B28 mov eax, dword ptr fs:[00000030h]		1_2_03BF8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BF8B28 mov eax, dword ptr fs:[00000030h]		1_2_03BF8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C02B57 mov eax, dword ptr fs:[00000030h]		1_2_03C02B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C02B57 mov eax, dword ptr fs:[00000030h]		1_2_03C02B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C02B57 mov eax, dword ptr fs:[00000030h]		1_2_03C02B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C02B57 mov eax, dword ptr fs:[00000030h]		1_2_03C02B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BAEB1D mov eax, dword ptr fs:[00000030h]		1_2_03BAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BAEB1D mov eax, dword ptr fs:[00000030h]		1_2_03BAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BAEB1D mov eax, dword ptr fs:[00000030h]		1_2_03BAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BAEB1D mov eax, dword ptr fs:[00000030h]		1_2_03BAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BAEB1D mov eax, dword ptr fs:[00000030h]		1_2_03BAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BAEB1D mov eax, dword ptr fs:[00000030h]		1_2_03BAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BAEB1D mov eax, dword ptr fs:[00000030h]		1_2_03BAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BAEB1D mov eax, dword ptr fs:[00000030h]		1_2_03BAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BAEB1D mov eax, dword ptr fs:[00000030h]		1_2_03BAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C04B00 mov eax, dword ptr fs:[00000030h]		1_2_03C04B00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B2CB7E mov eax, dword ptr fs:[00000030h]		1_2_03B2CB7E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B28B50 mov eax, dword ptr fs:[00000030h]		1_2_03B28B50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BDEB50 mov eax, dword ptr fs:[00000030h]		1_2_03BDEB50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BE4B4B mov eax, dword ptr fs:[00000030h]		1_2_03BE4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BE4B4B mov eax, dword ptr fs:[00000030h]		1_2_03BE4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BC6B40 mov eax, dword ptr fs:[00000030h]		1_2_03BC6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BC6B40 mov eax, dword ptr fs:[00000030h]		1_2_03BC6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BD8B42 mov eax, dword ptr fs:[00000030h]		1_2_03BD8B42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BFAB40 mov eax, dword ptr fs:[00000030h]		1_2_03BFAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B38AA0 mov eax, dword ptr fs:[00000030h]		1_2_03B38AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B38AA0 mov eax, dword ptr fs:[00000030h]		1_2_03B38AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B68A90 mov edx, dword ptr fs:[00000030h]		1_2_03B68A90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3EA80 mov eax, dword ptr fs:[00000030h]		1_2_03B3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3EA80 mov eax, dword ptr fs:[00000030h]		1_2_03B3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3EA80 mov eax, dword ptr fs:[00000030h]		1_2_03B3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3EA80 mov eax, dword ptr fs:[00000030h]		1_2_03B3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3EA80 mov eax, dword ptr fs:[00000030h]		1_2_03B3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3EA80 mov eax, dword ptr fs:[00000030h]		1_2_03B3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3EA80 mov eax, dword ptr fs:[00000030h]		1_2_03B3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3EA80 mov eax, dword ptr fs:[00000030h]		1_2_03B3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3EA80 mov eax, dword ptr fs:[00000030h]		1_2_03B3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C04A80 mov eax, dword ptr fs:[00000030h]		1_2_03C04A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6AAEE mov eax, dword ptr fs:[00000030h]		1_2_03B6AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6AAEE mov eax, dword ptr fs:[00000030h]		1_2_03B6AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B30AD0 mov eax, dword ptr fs:[00000030h]		1_2_03B30AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B64AD0 mov eax, dword ptr fs:[00000030h]		1_2_03B64AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B64AD0 mov eax, dword ptr fs:[00000030h]		1_2_03B64AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B86ACC mov eax, dword ptr fs:[00000030h]		1_2_03B86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B86ACC mov eax, dword ptr fs:[00000030h]		1_2_03B86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B86ACC mov eax, dword ptr fs:[00000030h]		1_2_03B86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B54A35 mov eax, dword ptr fs:[00000030h]		1_2_03B54A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B54A35 mov eax, dword ptr fs:[00000030h]		1_2_03B54A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6CA38 mov eax, dword ptr fs:[00000030h]		1_2_03B6CA38
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6CA24 mov eax, dword ptr fs:[00000030h]		1_2_03B6CA24
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5EA2E mov eax, dword ptr fs:[00000030h]		1_2_03B5EA2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BBCA11 mov eax, dword ptr fs:[00000030h]		1_2_03BBCA11
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BACA72 mov eax, dword ptr fs:[00000030h]		1_2_03BACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BACA72 mov eax, dword ptr fs:[00000030h]		1_2_03BACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6CA6F mov eax, dword ptr fs:[00000030h]		1_2_03B6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6CA6F mov eax, dword ptr fs:[00000030h]		1_2_03B6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6CA6F mov eax, dword ptr fs:[00000030h]		1_2_03B6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BDEA60 mov eax, dword ptr fs:[00000030h]		1_2_03BDEA60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B36A50 mov eax, dword ptr fs:[00000030h]		1_2_03B36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B36A50 mov eax, dword ptr fs:[00000030h]		1_2_03B36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B36A50 mov eax, dword ptr fs:[00000030h]		1_2_03B36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B36A50 mov eax, dword ptr fs:[00000030h]		1_2_03B36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B36A50 mov eax, dword ptr fs:[00000030h]		1_2_03B36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B36A50 mov eax, dword ptr fs:[00000030h]		1_2_03B36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B36A50 mov eax, dword ptr fs:[00000030h]		1_2_03B36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B40A5B mov eax, dword ptr fs:[00000030h]		1_2_03B40A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B40A5B mov eax, dword ptr fs:[00000030h]		1_2_03B40A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB89B3 mov esi, dword ptr fs:[00000030h]		1_2_03BB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB89B3 mov eax, dword ptr fs:[00000030h]		1_2_03BB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB89B3 mov eax, dword ptr fs:[00000030h]		1_2_03BB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B429A0 mov eax, dword ptr fs:[00000030h]		1_2_03B429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B429A0 mov eax, dword ptr fs:[00000030h]		1_2_03B429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B429A0 mov eax, dword ptr fs:[00000030h]		1_2_03B429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B429A0 mov eax, dword ptr fs:[00000030h]		1_2_03B429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B429A0 mov eax, dword ptr fs:[00000030h]		1_2_03B429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B429A0 mov eax, dword ptr fs:[00000030h]		1_2_03B429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B429A0 mov eax, dword ptr fs:[00000030h]		1_2_03B429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B429A0 mov eax, dword ptr fs:[00000030h]		1_2_03B429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B429A0 mov eax, dword ptr fs:[00000030h]		1_2_03B429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B429A0 mov eax, dword ptr fs:[00000030h]		1_2_03B429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B429A0 mov eax, dword ptr fs:[00000030h]		1_2_03B429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B429A0 mov eax, dword ptr fs:[00000030h]		1_2_03B429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B429A0 mov eax, dword ptr fs:[00000030h]		1_2_03B429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B309AD mov eax, dword ptr fs:[00000030h]		1_2_03B309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B309AD mov eax, dword ptr fs:[00000030h]		1_2_03B309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B629F9 mov eax, dword ptr fs:[00000030h]		1_2_03B629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B629F9 mov eax, dword ptr fs:[00000030h]		1_2_03B629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BBE9E0 mov eax, dword ptr fs:[00000030h]		1_2_03BBE9E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3A9D0 mov eax, dword ptr fs:[00000030h]		1_2_03B3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3A9D0 mov eax, dword ptr fs:[00000030h]		1_2_03B3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3A9D0 mov eax, dword ptr fs:[00000030h]		1_2_03B3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3A9D0 mov eax, dword ptr fs:[00000030h]		1_2_03B3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3A9D0 mov eax, dword ptr fs:[00000030h]		1_2_03B3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3A9D0 mov eax, dword ptr fs:[00000030h]		1_2_03B3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B649D0 mov eax, dword ptr fs:[00000030h]		1_2_03B649D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BFA9D3 mov eax, dword ptr fs:[00000030h]		1_2_03BFA9D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BC69C0 mov eax, dword ptr fs:[00000030h]		1_2_03BC69C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C04940 mov eax, dword ptr fs:[00000030h]		1_2_03C04940
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB892A mov eax, dword ptr fs:[00000030h]		1_2_03BB892A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BC892B mov eax, dword ptr fs:[00000030h]		1_2_03BC892B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BBC912 mov eax, dword ptr fs:[00000030h]		1_2_03BBC912
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B28918 mov eax, dword ptr fs:[00000030h]		1_2_03B28918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B28918 mov eax, dword ptr fs:[00000030h]		1_2_03B28918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BAE908 mov eax, dword ptr fs:[00000030h]		1_2_03BAE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BAE908 mov eax, dword ptr fs:[00000030h]		1_2_03BAE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BD4978 mov eax, dword ptr fs:[00000030h]		1_2_03BD4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BD4978 mov eax, dword ptr fs:[00000030h]		1_2_03BD4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BBC97C mov eax, dword ptr fs:[00000030h]		1_2_03BBC97C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B56962 mov eax, dword ptr fs:[00000030h]		1_2_03B56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B56962 mov eax, dword ptr fs:[00000030h]		1_2_03B56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B56962 mov eax, dword ptr fs:[00000030h]		1_2_03B56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB0946 mov eax, dword ptr fs:[00000030h]		1_2_03BB0946
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C008C0 mov eax, dword ptr fs:[00000030h]		1_2_03C008C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BBC89D mov eax, dword ptr fs:[00000030h]		1_2_03BBC89D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B30887 mov eax, dword ptr fs:[00000030h]		1_2_03B30887
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6C8F9 mov eax, dword ptr fs:[00000030h]		1_2_03B6C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6C8F9 mov eax, dword ptr fs:[00000030h]		1_2_03B6C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BFA8E4 mov eax, dword ptr fs:[00000030h]		1_2_03BFA8E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B52835 mov eax, dword ptr fs:[00000030h]		1_2_03B52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B52835 mov eax, dword ptr fs:[00000030h]		1_2_03B52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B52835 mov eax, dword ptr fs:[00000030h]		1_2_03B52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B52835 mov ecx, dword ptr fs:[00000030h]		1_2_03B52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B52835 mov eax, dword ptr fs:[00000030h]		1_2_03B52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B52835 mov eax, dword ptr fs:[00000030h]		1_2_03B52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6A830 mov eax, dword ptr fs:[00000030h]		1_2_03B6A830
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BD483A mov eax, dword ptr fs:[00000030h]		1_2_03BD483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BD483A mov eax, dword ptr fs:[00000030h]		1_2_03BD483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BBC810 mov eax, dword ptr fs:[00000030h]		1_2_03BBC810
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BBE872 mov eax, dword ptr fs:[00000030h]		1_2_03BBE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BBE872 mov eax, dword ptr fs:[00000030h]		1_2_03BBE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BC6870 mov eax, dword ptr fs:[00000030h]		1_2_03BC6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BC6870 mov eax, dword ptr fs:[00000030h]		1_2_03BC6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B60854 mov eax, dword ptr fs:[00000030h]		1_2_03B60854
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B34859 mov eax, dword ptr fs:[00000030h]		1_2_03B34859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B34859 mov eax, dword ptr fs:[00000030h]		1_2_03B34859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C04FE7 mov eax, dword ptr fs:[00000030h]		1_2_03C04FE7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B62F98 mov eax, dword ptr fs:[00000030h]		1_2_03B62F98
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B62F98 mov eax, dword ptr fs:[00000030h]		1_2_03B62F98
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6CF80 mov eax, dword ptr fs:[00000030h]		1_2_03B6CF80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B70FF6 mov eax, dword ptr fs:[00000030h]		1_2_03B70FF6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B70FF6 mov eax, dword ptr fs:[00000030h]		1_2_03B70FF6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B70FF6 mov eax, dword ptr fs:[00000030h]		1_2_03B70FF6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B70FF6 mov eax, dword ptr fs:[00000030h]		1_2_03B70FF6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BE6FF7 mov eax, dword ptr fs:[00000030h]		1_2_03BE6FF7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B2EFD8 mov eax, dword ptr fs:[00000030h]		1_2_03B2EFD8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B2EFD8 mov eax, dword ptr fs:[00000030h]		1_2_03B2EFD8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B2EFD8 mov eax, dword ptr fs:[00000030h]		1_2_03B2EFD8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B32FC8 mov eax, dword ptr fs:[00000030h]		1_2_03B32FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B32FC8 mov eax, dword ptr fs:[00000030h]		1_2_03B32FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B32FC8 mov eax, dword ptr fs:[00000030h]		1_2_03B32FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B32FC8 mov eax, dword ptr fs:[00000030h]		1_2_03B32FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5EF28 mov eax, dword ptr fs:[00000030h]		1_2_03B5EF28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C04F68 mov eax, dword ptr fs:[00000030h]		1_2_03C04F68
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6CF1F mov eax, dword ptr fs:[00000030h]		1_2_03B6CF1F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BE6F00 mov eax, dword ptr fs:[00000030h]		1_2_03BE6F00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5AF69 mov eax, dword ptr fs:[00000030h]		1_2_03B5AF69
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5AF69 mov eax, dword ptr fs:[00000030h]		1_2_03B5AF69
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BD2F60 mov eax, dword ptr fs:[00000030h]		1_2_03BD2F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BD2F60 mov eax, dword ptr fs:[00000030h]		1_2_03BD2F60

Source: C:\Users\user\Desktop\QUOTATION#0072395.exe

Code function: 0_2_00E480C9 GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,

0_2_00E480C9

Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_00E1A155 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00E1A155
Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Code function: 0_2_00E1A124 SetUnhandledExceptionFilter,		0_2_00E1A124

HIPS / PFW / Operating System Protection Evasion

Source: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe	NtTerminateThread: Direct from: 0x77D32FCC			Jump to behavior
Source: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe	NtSetInformationThread: Direct from: 0x77D263F9			Jump to behavior
Source: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe	NtQueryInformationToken: Direct from: 0x77D32CAC			Jump to behavior
Source: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe	NtCreateFile: Direct from: 0x77D32FEC			Jump to behavior
Source: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe	NtOpenFile: Direct from: 0x77D32DCC			Jump to behavior
Source: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe	NtSetInformationProcess: Direct from: 0x77D32C5C			Jump to behavior
Source: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe	NtProtectVirtualMemory: Direct from: 0x77D32F9C			Jump to behavior
Source: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe	NtOpenKeyEx: Direct from: 0x77D32B9C			Jump to behavior
Source: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe	NtResumeThread: Direct from: 0x77D336AC			Jump to behavior
Source: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe	NtMapViewOfSection: Direct from: 0x77D32D1C			Jump to behavior
Source: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe	NtWriteVirtualMemory: Direct from: 0x77D32E3C			Jump to behavior
Source: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe	NtCreateMutant: Direct from: 0x77D335CC			Jump to behavior
Source: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe	NtNotifyChangeKey: Direct from: 0x77D33C2C			Jump to behavior
Source: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe	NtQuerySystemInformation: Direct from: 0x77D32DFC			Jump to behavior
Source: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe	NtReadFile: Direct from: 0x77D32ADC			Jump to behavior
Source: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe	NtAllocateVirtualMemory: Direct from: 0x77D32BFC			Jump to behavior
Source: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe	NtCreateUserProcess: Direct from: 0x77D3371C			Jump to behavior
Source: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe	NtQueryInformationProcess: Direct from: 0x77D32C26			Jump to behavior
Source: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe	NtResumeThread: Direct from: 0x77D32FBC			Jump to behavior
Source: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe	NtDelayExecution: Direct from: 0x77D32DDC			Jump to behavior
Source: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe	NtQueryAttributesFile: Direct from: 0x77D32E6C			Jump to behavior
Source: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe	NtSetInformationThread: Direct from: 0x77D32B4C			Jump to behavior
Source: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe	NtReadVirtualMemory: Direct from: 0x77D32E8C			Jump to behavior
Source: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe	NtCreateKey: Direct from: 0x77D32C6C			Jump to behavior
Source: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe	NtClose: Direct from: 0x77D32B6C
Source: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe	NtAllocateVirtualMemory: Direct from: 0x77D33C9C			Jump to behavior
Source: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe	NtWriteVirtualMemory: Direct from: 0x77D3490C			Jump to behavior
Source: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe	NtOpenSection: Direct from: 0x77D32E0C			Jump to behavior
Source: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe	NtQueryVolumeInformationFile: Direct from: 0x77D32F2C			Jump to behavior
Source: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe	NtProtectVirtualMemory: Direct from: 0x77D27B2E			Jump to behavior
Source: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe	NtAllocateVirtualMemory: Direct from: 0x77D348EC			Jump to behavior
Source: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe	NtAllocateVirtualMemory: Direct from: 0x77D32BEC			Jump to behavior
Source: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe	NtDeviceIoControlFile: Direct from: 0x77D32AEC			Jump to behavior
Source: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe	NtQuerySystemInformation: Direct from: 0x77D348CC			Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe protection: execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\RmClient.exe protection: execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: NULL target: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe protection: read write			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: NULL target: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe protection: execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write			Jump to behavior

Source: C:\Windows\SysWOW64\RmClient.exe

Thread register set: target process: 1004

Jump to behavior

Source: C:\Windows\SysWOW64\RmClient.exe

Thread APC queued: target process: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe

Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION#0072395.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 3104008

Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION#0072395.exe

Code function: 0_2_00E487B1 LogonUserW,

0_2_00E487B1

Source: C:\Users\user\Desktop\QUOTATION#0072395.exe

Code function: 0_2_00DF3B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00DF3B3A

Source: C:\Users\user\Desktop\QUOTATION#0072395.exe

Code function: 0_2_00E512C7 SendInput,keybd_event,

0_2_00E512C7

Source: C:\Users\user\Desktop\QUOTATION#0072395.exe

Code function: 0_2_00E54C7F mouse_event,

0_2_00E54C7F

Source: C:\Users\user\Desktop\QUOTATION#0072395.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\QUOTATION#0072395.exe"			Jump to behavior
Source: C:\Program Files (x86)\eCuTJDdfFhKnpLEYGqExgFqbXhFJLDNwHYICCfSPtBhNLOEWgTwmMfeWaQBCpYc\2i4KSAeQqjs.exe	Process created: C:\Windows\SysWOW64\RmClient.exe "C:\Windows\SysWOW64\RmClient.exe"			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"			Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION#0072395.exe

Code function: 0_2_00E47CAF GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00E47CAF

Source: C:\Users\user\Desktop\QUOTATION#0072395.exe

Code function: 0_2_00E4874B AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00E4874B

Source: QUOTATION#0072395.exe	Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: 2i4KSAeQqjs.exe, 00000002.00000002.3364332876.0000000000CA1000.00000002.00000001.00040000.00000000.sdmp, 2i4KSAeQqjs.exe, 00000002.00000000.945197145.0000000000CA0000.00000002.00000001.00040000.00000000.sdmp, 2i4KSAeQqjs.exe, 00000005.00000000.1107390842.0000000000C60000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: QUOTATION#0072395.exe, 2i4KSAeQqjs.exe, 00000002.00000002.3364332876.0000000000CA1000.00000002.00000001.00040000.00000000.sdmp, 2i4KSAeQqjs.exe, 00000002.00000000.945197145.0000000000CA0000.00000002.00000001.00040000.00000000.sdmp, 2i4KSAeQqjs.exe, 00000005.00000000.1107390842.0000000000C60000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: 2i4KSAeQqjs.exe, 00000002.00000002.3364332876.0000000000CA1000.00000002.00000001.00040000.00000000.sdmp, 2i4KSAeQqjs.exe, 00000002.00000000.945197145.0000000000CA0000.00000002.00000001.00040000.00000000.sdmp, 2i4KSAeQqjs.exe, 00000005.00000000.1107390842.0000000000C60000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: 2i4KSAeQqjs.exe, 00000002.00000002.3364332876.0000000000CA1000.00000002.00000001.00040000.00000000.sdmp, 2i4KSAeQqjs.exe, 00000002.00000000.945197145.0000000000CA0000.00000002.00000001.00040000.00000000.sdmp, 2i4KSAeQqjs.exe, 00000005.00000000.1107390842.0000000000C60000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection

Source: C:\Users\user\Desktop\QUOTATION#0072395.exe

Code function: 0_2_00E1862B cpuid

0_2_00E1862B

Source: C:\Users\user\Desktop\QUOTATION#0072395.exe

Code function: 0_2_00E24E87 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00E24E87

Source: C:\Users\user\Desktop\QUOTATION#0072395.exe

Code function: 0_2_00E31E06 GetUserNameW,

0_2_00E31E06

Source: C:\Users\user\Desktop\QUOTATION#0072395.exe

Code function: 0_2_00DF49A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00DF49A0

Stealing of Sensitive Information

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1033597823.0000000003A40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3362772946.0000000002C40000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3363106058.0000000002EE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3366385136.00000000049F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1033133393.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3364472057.0000000003040000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3364674637.0000000003780000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1034080368.0000000005350000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\RmClient.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies			Jump to behavior

Source: C:\Windows\SysWOW64\RmClient.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Jump to behavior

Source: QUOTATION#0072395.exe	Binary or memory string: WIN_81
Source: QUOTATION#0072395.exe	Binary or memory string: WIN_XP
Source: QUOTATION#0072395.exe	Binary or memory string: WIN_XPe
Source: QUOTATION#0072395.exe	Binary or memory string: WIN_VISTA
Source: QUOTATION#0072395.exe	Binary or memory string: WIN_7
Source: QUOTATION#0072395.exe	Binary or memory string: WIN_8
Source: QUOTATION#0072395.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Remote Access Functionality

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1033597823.0000000003A40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3362772946.0000000002C40000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3363106058.0000000002EE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3366385136.00000000049F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1033133393.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3364472057.0000000003040000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3364674637.0000000003780000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1034080368.0000000005350000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\QUOTATION#0072395.exe

Code function: 0_2_00E66747 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,

0_2_00E66747