Windows Analysis Report
RFQ details folder.exe

AV Detection

Source: http://www.5s5zz.icu/7aoy/?ed=lFj0T&s2spt=fp2YbicaeZCvjPlH5kaqf38DV41Alb36RkH12Jc9jsEP3xNt5+yvvuwn7GzaPio27TEiEJpJOLWrHvzanHbqLkTN1Egji6y1JuragXTWaqXBAGzomLUHXW4=	Avira URL Cloud: Label: malware
Source: http://www.Mylivingbio.online	Avira URL Cloud: Label: phishing
Source: http://www.mylivingbio.online/dj43/?s2spt=EkKoskt/waFvdKqlQDReAdEPzqNBV/LCRcrbFleOd9fMl1ZZ6F30QdqQrdjttZXwjkEVztFs7SmMJNK/tzPQgm2YdBaGKs9siOngYeKkbdPQQj1YdWC5vzs=&ed=lFj0T	Avira URL Cloud: Label: phishing
Source: http://www.mylivingbio.online/__media__/js/trademark.php?d=mylivingbio.online&type=ns	Avira URL Cloud: Label: phishing
Source: http://www.shuangunder.shop/udq7/?s2spt=Rfp+Hy7ypq6TblfO6jtyDxJAW2Iw8lXr1dwSS3/BYvSaAWrqV1h4KNJqwO7WOFQicl/WQZFKFN8T0sKdpeUJpptycc7urIxBUjzwOjRYuCen9LSArV+SfCA=&ed=lFj0T	Avira URL Cloud: Label: malware
Source: http://www.maxank.top/esrt/?s2spt=Dauko676kCztHQAXIiMAeyqPgXjiUXsVTvMTsJhZ5gXLx1NdSwykiYrwT7juNmxOBLlr8LsBbcSb/+BWh1+dBPlTlKbRdnNReWZk2Peo2mQA4HQoEli9PVE=&ed=lFj0T	Avira URL Cloud: Label: malware
Source: http://www.full4movies.christmas/eg1u/?s2spt=SD/6wpCnW86cIrWeep14heI3UXePo+SxAqZXzX2LTq+ZxSYJstNKHiEBWhqrQIE7yMyB6clEy8PjJK9sDHiC3e/R1Eg2TmiiuSMczThP3qLlQkQqoU0Int0=&ed=lFj0T	Avira URL Cloud: Label: malware
Source: http://www.mylivingbio.online/__media__/design/underconstructionnotice.php?d=mylivingbio.online	Avira URL Cloud: Label: phishing
Source: http://www.tgwfj.xyz/b5fo/?ed=lFj0T&s2spt=/PlOLkIgBbh1jkr+6tQiokiNbLxNQiu1t1tA2B5ngzg+2ZPn1SOfaIfgu54OO3WPatKJobuG4vpvl8eIAu2jI3umZurVWzu+6cIQq0VJVLxagrBujY8Vb9g=	Avira URL Cloud: Label: phishing

Source: RFQ details folder.exe	ReversingLabs: Detection: 44%
Source: RFQ details folder.exe	Virustotal: Detection: 37%			Perma Link

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1404778921.0000000003790000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3676000841.0000000003050000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3675864670.0000000003000000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1404313483.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3681688673.0000000007F20000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3675258966.0000000000A00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3677471460.0000000004EC0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1405459163.0000000005C50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Compliance

Source: RFQ details folder.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: wntdll.pdbUGP source: RFQ details folder.exe, 00000000.00000003.1230522676.0000000003770000.00000004.00001000.00020000.00000000.sdmp, RFQ details folder.exe, 00000000.00000003.1233535333.0000000003910000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1268719730.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1271844661.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1404871036.0000000003A00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1404871036.0000000003B9E000.00000040.00001000.00020000.00000000.sdmp, reg.exe, 00000008.00000003.1404599304.00000000032BA000.00000004.00000020.00020000.00000000.sdmp, reg.exe, 00000008.00000002.3677649396.0000000003610000.00000040.00001000.00020000.00000000.sdmp, reg.exe, 00000008.00000002.3677649396.00000000037AE000.00000040.00001000.00020000.00000000.sdmp, reg.exe, 00000008.00000003.1406538532.000000000346A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: RFQ details folder.exe, 00000000.00000003.1230522676.0000000003770000.00000004.00001000.00020000.00000000.sdmp, RFQ details folder.exe, 00000000.00000003.1233535333.0000000003910000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000003.1268719730.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1271844661.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1404871036.0000000003A00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1404871036.0000000003B9E000.00000040.00001000.00020000.00000000.sdmp, reg.exe, reg.exe, 00000008.00000003.1404599304.00000000032BA000.00000004.00000020.00020000.00000000.sdmp, reg.exe, 00000008.00000002.3677649396.0000000003610000.00000040.00001000.00020000.00000000.sdmp, reg.exe, 00000008.00000002.3677649396.00000000037AE000.00000040.00001000.00020000.00000000.sdmp, reg.exe, 00000008.00000003.1406538532.000000000346A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: reg.pdb source: svchost.exe, 00000001.00000003.1351722684.000000000341A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1351856103.000000000343B000.00000004.00000020.00020000.00000000.sdmp, 99mXjPxVfM3v.exe, 00000007.00000003.1471315586.0000000001384000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: 99mXjPxVfM3v.exe, 00000007.00000002.3680411287.0000000005AEC000.00000004.80000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3676253646.00000000031BE000.00000004.00000020.00020000.00000000.sdmp, reg.exe, 00000008.00000002.3678084173.0000000003C3C000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.1689216523.000000000C19C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: 99mXjPxVfM3v.exe, 00000007.00000002.3680411287.0000000005AEC000.00000004.80000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3676253646.00000000031BE000.00000004.00000020.00020000.00000000.sdmp, reg.exe, 00000008.00000002.3678084173.0000000003C3C000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.1689216523.000000000C19C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: reg.pdbGCTL source: svchost.exe, 00000001.00000003.1351722684.000000000341A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1351856103.000000000343B000.00000004.00000020.00020000.00000000.sdmp, 99mXjPxVfM3v.exe, 00000007.00000003.1471315586.0000000001384000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Work\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: 99mXjPxVfM3v.exe, 00000007.00000002.3675227158.00000000006EF000.00000002.00000001.01000000.00000005.sdmp

Spreading

Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00DC445A GetFileAttributesW,FindFirstFileW,FindClose,		0_2_00DC445A
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00DCC6D1 FindFirstFileW,FindClose,		0_2_00DCC6D1
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00DCC75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,		0_2_00DCC75C
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00DCEF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,		0_2_00DCEF95
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00DCF0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,		0_2_00DCF0F2
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00DCF3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,		0_2_00DCF3F3
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00DC37EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,		0_2_00DC37EF
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00DC3B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,		0_2_00DC3B12
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00DCBCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,		0_2_00DCBCBC
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_00A1C640 FindFirstFileW,FindNextFileW,FindClose,		8_2_00A1C640

Software Vulnerabilities

Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	Code function: 4x nop then pop edi		7_2_07F26FA9
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	Code function: 4x nop then xor eax, eax		7_2_07F2C83E
Source: C:\Windows\SysWOW64\reg.exe	Code function: 4x nop then xor eax, eax		8_2_00A09F80
Source: C:\Windows\SysWOW64\reg.exe	Code function: 4x nop then pop edi		8_2_00A0E271
Source: C:\Windows\SysWOW64\reg.exe	Code function: 4x nop then mov ebx, 00000004h		8_2_032B04F8

Networking

Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49759 -> 52.223.13.41:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49741 -> 162.254.32.77:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49755 -> 104.21.27.203:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49771 -> 208.91.197.27:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49773 -> 76.223.54.146:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49757 -> 52.223.13.41:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49762 -> 104.21.50.219:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49774 -> 76.223.54.146:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49737 -> 104.21.10.18:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49742 -> 162.254.32.77:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49744 -> 104.21.23.144:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49753 -> 104.21.27.203:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49748 -> 199.59.243.228:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49752 -> 104.21.27.203:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49738 -> 104.21.10.18:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49745 -> 104.21.23.144:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49736 -> 104.21.10.18:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49735 -> 104.21.10.18:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49761 -> 104.21.50.219:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49728 -> 47.239.127.207:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49734 -> 208.91.197.27:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49758 -> 52.223.13.41:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49772 -> 76.223.54.146:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49782 -> 52.223.13.41:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49751 -> 199.59.243.228:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49760 -> 104.21.50.219:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49777 -> 76.223.54.146:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49778 -> 76.223.54.146:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49750 -> 199.59.243.228:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49776 -> 76.223.54.146:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49783 -> 52.223.13.41:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49743 -> 162.254.32.77:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49786 -> 199.59.243.228:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49746 -> 104.21.23.144:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49780 -> 52.223.13.41:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49754 -> 104.21.27.203:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49739 -> 162.254.32.77:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49747 -> 104.21.23.144:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49756 -> 52.223.13.41:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49781 -> 52.223.13.41:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49765 -> 149.88.81.195:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49779 -> 76.223.54.146:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49784 -> 199.59.243.228:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49764 -> 149.88.81.195:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49767 -> 149.88.81.195:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49775 -> 76.223.54.146:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49785 -> 199.59.243.228:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49787 -> 199.59.243.228:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49749 -> 199.59.243.228:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49763 -> 104.21.50.219:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49730 -> 208.91.197.27:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49769 -> 208.91.197.27:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49770 -> 208.91.197.27:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49733 -> 208.91.197.27:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49731 -> 208.91.197.27:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49766 -> 149.88.81.195:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49768 -> 208.91.197.27:80

Source:	DNS query: www.tgwfj.xyz
Source:	DNS query: www.chatdn.xyz
Source:	DNS query: www.nodefolio.xyz

Source: Joe Sandbox View	IP Address: 76.223.54.146 76.223.54.146
Source: Joe Sandbox View	IP Address: 208.91.197.27 208.91.197.27

Source: Joe Sandbox View

ASN Name: SAIC-ASUS SAIC-ASUS

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\RFQ details folder.exe

Code function: 0_2_00DD22EE InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_00DD22EE

Source: global traffic	HTTP traffic detected: GET /7aoy/?ed=lFj0T&s2spt=fp2YbicaeZCvjPlH5kaqf38DV41Alb36RkH12Jc9jsEP3xNt5+yvvuwn7GzaPio27TEiEJpJOLWrHvzanHbqLkTN1Egji6y1JuragXTWaqXBAGzomLUHXW4= HTTP/1.1Host: www.5s5zz.icuAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.4; LIFETAB_P891X Build/KTU84P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.135 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /dj43/?s2spt=EkKoskt/waFvdKqlQDReAdEPzqNBV/LCRcrbFleOd9fMl1ZZ6F30QdqQrdjttZXwjkEVztFs7SmMJNK/tzPQgm2YdBaGKs9siOngYeKkbdPQQj1YdWC5vzs=&ed=lFj0T HTTP/1.1Host: www.mylivingbio.onlineAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.4; LIFETAB_P891X Build/KTU84P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.135 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /b5fo/?ed=lFj0T&s2spt=/PlOLkIgBbh1jkr+6tQiokiNbLxNQiu1t1tA2B5ngzg+2ZPn1SOfaIfgu54OO3WPatKJobuG4vpvl8eIAu2jI3umZurVWzu+6cIQq0VJVLxagrBujY8Vb9g= HTTP/1.1Host: www.tgwfj.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.4; LIFETAB_P891X Build/KTU84P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.135 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /esrt/?s2spt=Dauko676kCztHQAXIiMAeyqPgXjiUXsVTvMTsJhZ5gXLx1NdSwykiYrwT7juNmxOBLlr8LsBbcSb/+BWh1+dBPlTlKbRdnNReWZk2Peo2mQA4HQoEli9PVE=&ed=lFj0T HTTP/1.1Host: www.maxank.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.4; LIFETAB_P891X Build/KTU84P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.135 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /udq7/?s2spt=Rfp+Hy7ypq6TblfO6jtyDxJAW2Iw8lXr1dwSS3/BYvSaAWrqV1h4KNJqwO7WOFQicl/WQZFKFN8T0sKdpeUJpptycc7urIxBUjzwOjRYuCen9LSArV+SfCA=&ed=lFj0T HTTP/1.1Host: www.shuangunder.shopAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.4; LIFETAB_P891X Build/KTU84P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.135 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /6q0f/?s2spt=wiwQqHwCkimMGK1O8/TsrRJt0TS3GvBgx/vKhmgmOWN7HwxXpwqIUsOeVf/rnfDynropZ5jJ6rh5lht5oeh5zBGjGlLzKt0WJbI/ll4BP97oCSHZMdO96+E=&ed=lFj0T HTTP/1.1Host: www.b47uwch1046r.shopAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.4; LIFETAB_P891X Build/KTU84P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.135 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /eg1u/?s2spt=SD/6wpCnW86cIrWeep14heI3UXePo+SxAqZXzX2LTq+ZxSYJstNKHiEBWhqrQIE7yMyB6clEy8PjJK9sDHiC3e/R1Eg2TmiiuSMczThP3qLlQkQqoU0Int0=&ed=lFj0T HTTP/1.1Host: www.full4movies.christmasAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.4; LIFETAB_P891X Build/KTU84P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.135 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /1lu1/?s2spt=gnLWuwl3YNLZq+kctfrZUOTzTE3pbZVwjJY4ZtQulD85or1kaYgFmp8RYbKmTg0As5h6Mjvom9+7CRNf5gL+WXwHB31qXopKQu9NEjLyPWWcN/0zbSlnIAo=&ed=lFj0T HTTP/1.1Host: www.boa-first-option.clickAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.4; LIFETAB_P891X Build/KTU84P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.135 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /80od/?s2spt=IuBU55xvok3HLpzopmSwS3eRJtMGjt1Zqh5Gq7N5X/kkFlbQTPRvjQimlDDv2Xk75v4IRLPjg1IsLOv524487OyvTvNnLeqteMoFxwXQeG30mYgEGWZi0hA=&ed=lFj0T HTTP/1.1Host: www.12345lopkmj.lolAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.4; LIFETAB_P891X Build/KTU84P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.135 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /d478/?s2spt=yZiSYoN2a3htTd2ds6QP1P94BsLGeX6oYMbqUQeMjg/YAZw5n93PIWGpgWWmb8mQ8VOILxP51EOaJbDvkr6mJAyFQhdDW9491Gv85aBeIngj22zJHkOaBfQ=&ed=lFj0T HTTP/1.1Host: www.utzp.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.4; LIFETAB_P891X Build/KTU84P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.135 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /wdfk/?s2spt=dQ/vpVbcLME9vwPg7kSs1Ge38yKYU8Ny+d50wcZtmmpldahEUd9gA/U/hLKsV6Bf0aiX/H+ppQZXy0qtZ/D2arixEyiIXMiiQVJMjcbVizmpU0jISOIDNtc=&ed=lFj0T HTTP/1.1Host: www.keys4health.netAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.4; LIFETAB_P891X Build/KTU84P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.135 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /7ciy/?s2spt=zHKEIz0o2n6jgB/hsmnJO2sSBnStbZsQVl5Rhq17f2fLN5qLroapQ67U0eY+CFXVn3WbdiYa7ZubGC6ertIlkxB5tl8uUOUcTmGxpI7zrCojAx7GiDrY7Eg=&ed=lFj0T HTTP/1.1Host: www.chatdn.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.4; LIFETAB_P891X Build/KTU84P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.135 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /b3dy/?ed=lFj0T&s2spt=h9bs7PJVxZ24zAp8sOvULNZBJpYYvbGSw5AYHhggM3Al5Cg+4lnT1wleJpI9wHWBpVcO5JhmorqlsWRv+OmFrOSl3OTa2WslKmv3CcMifMqF+OCOFwGvzWg= HTTP/1.1Host: www.nodefolio.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.4; LIFETAB_P891X Build/KTU84P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.135 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /vwqy/?s2spt=v3ZoZSKmjs/ElY9JvlJ7BWTwahN5acThzg3dHORkdyRJknvTPlvLy9hszWAf9XBOUxgBVtKXDaR+AVr7OKAzWeOWT1wlljBB6sVlXxalYjF/TM4jMJevS8E=&ed=lFj0T HTTP/1.1Host: www.lindaashley.weddingAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.4; LIFETAB_P891X Build/KTU84P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.135 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /qm65/?ed=lFj0T&s2spt=WKDdNWC7INV6sdOF5Bhyf1QssefnQWO/zrWG+knbwk3UKiu1mAWcQNEx7C72Rm2XZizvCRn0VF5y6M8t/wPOeO9O0pStKLi9f2h/7RX8W0nZFe+LJKmGy+U= HTTP/1.1Host: www.myhandyplanner.coursesAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.4; LIFETAB_P891X Build/KTU84P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.135 Safari/537.36

Source: global traffic	DNS traffic detected: DNS query: www.5s5zz.icu
Source: global traffic	DNS traffic detected: DNS query: www.mylivingbio.online
Source: global traffic	DNS traffic detected: DNS query: www.tgwfj.xyz
Source: global traffic	DNS traffic detected: DNS query: www.maxank.top
Source: global traffic	DNS traffic detected: DNS query: www.shuangunder.shop
Source: global traffic	DNS traffic detected: DNS query: www.b47uwch1046r.shop
Source: global traffic	DNS traffic detected: DNS query: www.full4movies.christmas
Source: global traffic	DNS traffic detected: DNS query: www.boa-first-option.click
Source: global traffic	DNS traffic detected: DNS query: www.12345lopkmj.lol
Source: global traffic	DNS traffic detected: DNS query: www.utzp.top
Source: global traffic	DNS traffic detected: DNS query: www.keys4health.net
Source: global traffic	DNS traffic detected: DNS query: www.chatdn.xyz
Source: global traffic	DNS traffic detected: DNS query: www.nodefolio.xyz
Source: global traffic	DNS traffic detected: DNS query: www.lindaashley.wedding
Source: global traffic	DNS traffic detected: DNS query: www.myhandyplanner.courses

Source: unknown

HTTP traffic detected: POST /dj43/ HTTP/1.1Host: www.mylivingbio.onlineAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Accept-Encoding: gzip, deflateOrigin: http://www.mylivingbio.onlineCache-Control: no-cacheContent-Length: 202Connection: closeContent-Type: application/x-www-form-urlencodedReferer: http://www.mylivingbio.online/dj43/User-Agent: Mozilla/5.0 (Linux; Android 4.4.4; LIFETAB_P891X Build/KTU84P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.135 Safari/537.36Data Raw: 73 32 73 70 74 3d 4a 6d 69 49 76 53 56 6c 32 66 56 48 58 36 57 41 53 33 35 39 4a 2f 55 4a 39 72 35 77 4d 50 4b 42 45 66 65 4a 52 57 50 41 65 74 50 58 76 58 51 52 33 47 47 7a 51 59 2f 33 76 38 2f 46 31 35 76 30 69 30 4d 30 34 4c 4d 58 72 67 33 32 59 66 65 6c 30 52 62 68 72 47 6d 65 58 51 62 30 43 75 59 48 6d 63 6a 76 59 71 75 52 4c 65 44 31 57 7a 73 32 62 79 61 42 78 56 31 58 46 41 49 2f 39 39 33 68 67 4a 6a 4b 74 64 35 61 68 74 69 35 6c 6f 35 4f 7a 4c 45 46 42 4d 59 38 50 51 6b 62 61 7a 41 4b 6d 49 30 73 65 34 6e 6e 57 30 6b 75 32 2f 75 52 50 41 2f 6f 63 31 6e 6b 44 70 75 4f 73 78 38 70 6e 51 3d 3d Data Ascii: s2spt=JmiIvSVl2fVHX6WAS359J/UJ9r5wMPKBEfeJRWPAetPXvXQR3GGzQY/3v8/F15v0i0M04LMXrg32Yfel0RbhrGmeXQb0CuYHmcjvYquRLeD1Wzs2byaBxV1XFAI/993hgJjKtd5ahti5lo5OzLEFBMY8PQkbazAKmI0se4nnW0ku2/uRPA/oc1nkDpuOsx8pnQ==

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Sat, 29 Mar 2025 04:25:52 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 29 Mar 2025 04:26:22 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=F8zgB89on07uPrQ4mZuVxdyMWk%2BdWeUJ2hOdFN9RDiECu8W0Nup85aCwkO1gZDbk14CVqL8Al6RU%2FdqEa2Ok9d1rnmHuNA8iNieBUfV%2BUA22YeHBYLJRaShl86GrI0Uh"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 927c9bcec9fa6dc6-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=107051&min_rtt=107051&rtt_var=53525&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=777&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 85 de 61 3c 40 88 85 2e 87 6c 44 c1 85 6e 3c 41 ea 8c 4d 20 9d 94 31 82 bd bd 54 2d 88 6b 97 ae 1e bc 9f 8f 87 a1 0c c9 d5 15 06 f6 e4 b0 c4 92 d8 b5 eb 16 8e b9 c0 2e df 84 d0 be 4c b4 cf 4a 5d 61 97 69 9a f5 cc 52 58 1d 86 e6 7b 11 1a 87 f6 1d cf 6c 75 4b 59 fa 28 f7 cf cc 2e 34 bb 3c 59 19 03 1e 46 4f 14 a5 87 92 81 e2 d5 77 89 e1 70 da 6f c1 0b c1 26 68 1e 18 2e 1a 59 28 4d c0 aa 59 61 f4 3d 83 31 7f c4 af 11 0f 27 a7 bf a8 24 02 00 00 0d 0a Data Ascii: a7M0a<@.lDn<AM 1T-k.LJ]aiRX{luKY(.4<YFOwpo&h.Y(MYa=1'$
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 29 Mar 2025 04:26:25 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xel2HBnjdjEsQmbMGXe88bVU9wBXa3RcrsOEhsxLGi3ji0z0G9YrceIYaBrMlVRCjk47R2tiUK9xn5ZoLAOU90e3qm2E7L%2BI%2FZo17v%2BuaqaLna9jgMspjDi7qtAHr6EM"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 927c9bdf4dbd06a1-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=109091&min_rtt=109091&rtt_var=54545&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=797&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 85 de 61 3c 40 88 85 2e 87 6c 44 c1 85 6e 3c 41 ea 8c 4d 20 9d 94 31 82 bd bd 54 2d 88 6b 97 ae 1e bc 9f 8f 87 a1 0c c9 d5 15 06 f6 e4 b0 c4 92 d8 b5 eb 16 8e b9 c0 2e df 84 d0 be 4c b4 cf 4a 5d 61 97 69 9a f5 cc 52 58 1d 86 e6 7b 11 1a 87 f6 1d cf 6c 75 4b 59 fa 28 f7 cf cc 2e 34 bb 3c 59 19 03 1e 46 4f 14 a5 87 92 81 e2 d5 77 89 e1 70 da 6f c1 0b c1 26 68 1e 18 2e 1a 59 28 4d c0 aa 59 61 f4 3d 83 31 7f c4 af 11 0f 27 a7 bf a8 24 02 00 00 0d 0a Data Ascii: a7M0a<@.lDn<AM 1T-k.LJ]aiRX{luKY(.4<YFOwpo&h.Y(MYa=1'$
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 29 Mar 2025 04:26:27 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gLutf4vTRu6pV1rNqz6rJZLG9AiWEBUsnu9%2FJwyG4MGwVQchnWNxxJmNc1bC46GWDljhjpeuEwQ9o67LpOVpz4hL6%2FuwCdY3p%2FazyUOvLIUUJaMlpKueM3FtzJzmkrzV"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 927c9befca058cc0-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=101195&min_rtt=101195&rtt_var=50597&sent=4&recv=9&lost=0&retrans=0&sent_bytes=0&recv_bytes=7054&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 85 de 61 3c 40 88 85 2e 87 6c 44 c1 85 6e 3c 41 ea 8c 4d 20 9d 94 31 82 bd bd 54 2d 88 6b 97 ae 1e bc 9f 8f 87 a1 0c c9 d5 15 06 f6 e4 b0 c4 92 d8 b5 eb 16 8e b9 c0 2e df 84 d0 be 4c b4 cf 4a 5d 61 97 69 9a f5 cc 52 58 1d 86 e6 7b 11 1a 87 f6 1d cf 6c 75 4b 59 fa 28 f7 cf cc 2e 34 bb 3c 59 19 03 1e 46 4f 14 a5 87 92 81 e2 d5 77 89 e1 70 da 6f c1 0b c1 26 68 1e 18 2e 1a 59 28 4d c0 aa 59 61 f4 3d 83 31 7f c4 af 11 0f 27 a7 bf a8 24 02 00 00 0d 0a Data Ascii: a7M0a<@.lDn<AM 1T-k.LJ]aiRX{luKY(.4<YFOwpo&h.Y(MYa=1'$
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 29 Mar 2025 04:26:30 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=D8pvDrBOOFL%2FRlAwLj43ecubUwNUkf9bpWB1IQdPekoF8krbR%2BeXx0GEyR2bpQsgNi1EZQ1VBU%2BaJW8E5x1D992qFKu1z%2FaMi6lhic66fj%2F6yHFnyx0ix2ANcpkJcHxb"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 927c9c004871cdf0-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=105482&min_rtt=105482&rtt_var=52741&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=516&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 Data Ascii: 224<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 29 Mar 2025 04:26:35 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 29 Mar 2025 04:26:38 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 29 Mar 2025 04:26:41 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 29 Mar 2025 04:26:43 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 29 Mar 2025 04:26:49 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YKTq9jzkMcc9%2Bkx7CSqinNB7Xf46M3Nq0a7i1ssjdJx0D%2BpS3lPUYzzaLLd%2BJUZ2iGlV8kGFbiW8VDeAU84Z7cHTR7sTpdd%2FNpk6vtMzLNn%2B%2F6AkrtIiomJu0zhDcIEdvBjY3uz56A%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 927c9c7aab2c41b5-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=105332&min_rtt=105332&rtt_var=52666&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=798&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 85 de 61 3c 40 88 85 2e 87 6c 44 c1 85 6e 3c 41 ea 8c 4d 20 9d 94 31 82 bd bd 54 2d 88 6b 97 ae 1e bc 9f 8f 87 a1 0c c9 d5 15 06 f6 e4 b0 c4 92 d8 b5 eb 16 8e b9 c0 2e df 84 d0 be 4c b4 cf 4a 5d 61 97 69 9a f5 cc 52 58 1d 86 e6 7b 11 1a 87 f6 1d cf 6c 75 4b 59 fa 28 f7 cf cc 2e 34 bb 3c 59 19 03 1e 46 4f 14 a5 87 92 81 e2 d5 77 89 e1 70 da 6f c1 0b c1 26 68 1e 18 2e 1a 59 28 4d c0 aa 59 61 f4 3d 83 31 7f c4 af 11 0f 27 a7 bf a8 24 02 00 00 0d 0a Data Ascii: a7M0a<@.lDn<AM 1T-k.LJ]aiRX{luKY(.4<YFOwpo&h.Y(MYa=1'$
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 29 Mar 2025 04:26:52 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oIKZpaHfbBJt4F1nhFmZxx4bIjJ%2B8YVt09AORT%2Bejdm7yx5zVNkADqG8j0KO8rGR9OepwfqK0sUcYxNDIRN0ONW3w1R74Or03HBGGhJo1bRdhZPXCAUxXphCiT9Ei3E%2Fl8ywr%2ByKvA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 927c9c8b2c8d0cfb-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=101121&min_rtt=101121&rtt_var=50560&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=818&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 85 de 61 3c 40 88 85 2e 87 6c 44 c1 85 6e 3c 41 ea 8c 4d 20 9d 94 31 82 bd bd 54 2d 88 6b 97 ae 1e bc 9f 8f 87 a1 0c c9 d5 15 06 f6 e4 b0 c4 92 d8 b5 eb 16 8e b9 c0 2e df 84 d0 be 4c b4 cf 4a 5d 61 97 69 9a f5 cc 52 58 1d 86 e6 7b 11 1a 87 f6 1d cf 6c 75 4b 59 fa 28 f7 cf cc 2e 34 bb 3c 59 19 03 1e 46 4f 14 a5 87 92 81 e2 d5 77 89 e1 70 da 6f c1 0b c1 26 68 1e 18 2e 1a 59 28 4d c0 aa 59 61 f4 3d 83 31 7f c4 af 11 0f 27 a7 bf a8 24 02 00 00 0d 0a Data Ascii: a7M0a<@.lDn<AM 1T-k.LJ]aiRX{luKY(.4<YFOwpo&h.Y(MYa=1'$
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 29 Mar 2025 04:26:54 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0EsnpBQWDutMaV7BiPvlRZmYzWTd9BC9f0dtUzH3mI798RcIL9ZHPxtyc2uRPpEEH2wVjvdV3snGAQxW4d8wDN%2FxoFVu1LdJmcThfJdJegbj5fYwlpVe64EtDHZV7NCRsS9nxEUMEg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 927c9c9bb97d5e6b-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=107485&min_rtt=107485&rtt_var=53742&sent=5&recv=9&lost=0&retrans=0&sent_bytes=0&recv_bytes=7075&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 85 de 61 3c 40 88 85 2e 87 6c 44 c1 85 6e 3c 41 ea 8c 4d 20 9d 94 31 82 bd bd 54 2d 88 6b 97 ae 1e bc 9f 8f 87 a1 0c c9 d5 15 06 f6 e4 b0 c4 92 d8 b5 eb 16 8e b9 c0 2e df 84 d0 be 4c b4 cf 4a 5d 61 97 69 9a f5 cc 52 58 1d 86 e6 7b 11 1a 87 f6 1d cf 6c 75 4b 59 fa 28 f7 cf cc 2e 34 bb 3c 59 19 03 1e 46 4f 14 a5 87 92 81 e2 d5 77 89 e1 70 da 6f c1 0b c1 26 68 1e 18 2e 1a 59 28 4d c0 aa 59 61 f4 3d 83 31 7f c4 af 11 0f 27 a7 bf a8 24 02 00 00 0d 0a Data Ascii: a7M0a<@.lDn<AM 1T-k.LJ]aiRX{luKY(.4<YFOwpo&h.Y(MYa=1'$
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 29 Mar 2025 04:26:57 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OWmuUEquOqWkcI4Cauvkuu984XIUH5pPIsZqEBQjQRljUV90nAm7gRzCAyr9z8A4Cc3NiQSom%2BqZQycqDZuhhiQ7%2Bgvdl%2FJv%2BkBbFVjwHjWoFq3hJ6eACPXARS73azZkNgC7MnOjLA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 927c9cac2d7d0f97-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=93003&min_rtt=93003&rtt_var=46501&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=523&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 Data Ascii: 224<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSI
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 29 Mar 2025 04:27:16 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closevary: Accept-Encodingcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ktl6hKWL15EnFsHmqAyVZUYWbwFaWT4WWXlvgIL5jf5i1NhK7g0375YX87KRyL5bbsAIfxCHdW51%2BljXNXBITFuHzYmpvJuy6rJMVexf%2BVFzYOpGgQTCS0F0AVBsntHcJQu4TSnS8D0cSfxE"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 927c9d2199db80d9-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=96608&min_rtt=96608&rtt_var=48304&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=813&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 39 62 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 56 59 b3 9b ca 11 7e f7 af 20 4e a5 2a 29 ac 2b 36 ad b6 6f 85 55 70 10 48 a0 15 bd 0d 30 c0 48 6c 82 61 91 52 f7 bf a7 a4 63 fb 9e 45 3a 3e 4e f2 90 79 81 59 ba 7b ba fb eb af e7 c3 87 0f 5f fe 22 cd c4 a5 33 97 89 08 27 f1 ef 1f be 3c 7e 08 82 20 be 44 10 f8 df 7e 13 88 01 11 61 9c 77 e0 b1 42 f5 d7 8f 62 96 62 98 e2 0e 3e e5 f0 23 e1 3d ce be 7e c4 b0 c5 dd 8b 8a cf 84 17 81 a2 84 f8 6b 85 83 ce f0 e3 5d 3d c0 8b 60 e7 22 5f 64 f1 13 45 69 d6 f1 2e 5b 77 05 e7 05 08 13 f0 2b 12 72 9b a3 02 96 4f 44 a8 67 67 53 90 c0 af 1f 6b 04 9b 3c 2b f0 93 63 0d f2 71 Data Ascii: 9b9VY~ N*)+6oUpH0HlaRcE:>NyY{_"3'<~ D~awBbb>#=~k]=`"_dEi.[w+rODggSk<+cq
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 29 Mar 2025 04:27:18 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closevary: Accept-Encodingcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SnjRtjfwbUHEp59T2lsLTcvGdQirgCR0cZs5xA3hyZurHkTJKSB%2B6RFM2gPt9i3oNiWsSm%2BAOm5JtbhOhjUjxzcUEXqEHfbJOOp4UesknC8PG2cDsxFK9P4Wo5VM8p9x8KThr0X%2BT%2BvubjFi"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 927c9d323b7c4372-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=108324&min_rtt=108324&rtt_var=54162&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=833&delivery_rate=0&cwnd=240&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 31 33 33 32 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a 59 97 a3 4a 72 7e bf bf 42 ae 39 b6 67 0e 5d cd be d5 ad 6a 1b 10 02 24 81 00 09 49 e8 e5 1e 96 64 11 ab d8 25 9f f9 41 fe 1b fe 65 3e 54 f5 52 5d 25 75 f7 9d f1 83 a9 07 91 99 11 91 91 b1 7c 41 65 e6 6f bf fd f6 f8 2f d3 95 b0 b1 75 71 12 35 59 fa e9 b7 c7 97 9f c9 64 32 79 8c 80 e3 7f 7e cd 40 e3 4c a2 a6 29 ef c1 a9 8d bb a7 3b a1 c8 1b 90 37 f7 cd b9 04 77 13 ef a5 f5 74 d7 80 a1 81 47 11 bf 4f bc c8 a9 6a d0 3c b5 4d 70 cf dc dd 94 e3 78 11 b8 1f f9 ab 22 7d 25 28 2f ee bd 71 e8 26 a3 5e 39 61 e6 fc 19 0e 71 28 e3 0a d4 af 58 90 Data Ascii: 1332ZYJr~B9g]j$Id%Ae>TR]%u|Aeo/uq5Yd2y~@L);7wtGOj<Mpx"}%(/q&^9aq(X
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 29 Mar 2025 04:27:21 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closevary: Accept-Encodingcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PU2YRJuwZt202qZUEx5%2BXTNc6qyyLTGfGqQZ1knXzNpR3Y2tJcCwtt4XQF0BJ%2F3h3YipZZ6OvNr1AtLoEWr1B3poJuE4yaR7H%2Fifm0J%2BPpFLXBIOLAhME5UZbbIHkFd18o9%2F%2FWj15oCCE7OC"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 927c9d42c9b258c1-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=106584&min_rtt=106584&rtt_var=53292&sent=6&recv=9&lost=0&retrans=0&sent_bytes=0&recv_bytes=7090&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 31 33 33 32 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a e9 72 a3 4a 96 fe 7f 9f 82 71 c7 cc 74 07 e5 62 df 7c ed 9a 01 84 00 49 20 40 42 12 fa 73 03 41 b2 88 55 ec d2 44 3f d0 bc c6 3c d9 04 76 2d 2e 5b aa aa db 3d 3f 06 47 d8 64 e6 39 27 4f 9e e5 3b 38 33 7f fb ed b7 c7 7f 99 2c c5 b5 63 48 50 d4 64 e9 a7 df 1e 5f fe 40 10 04 3d 46 c0 f5 3f bf 66 a0 71 a1 a8 69 ca 7b 70 6a e3 ee e9 4e 2c f2 06 e4 cd 7d 73 2e c1 1d e4 bd b4 9e ee 1a 30 34 c8 28 e2 77 c8 8b dc aa 06 cd 53 db 04 f7 ec dd 4d 39 ae 17 81 fb 91 bf 2a d2 57 82 f2 e2 de 1b 87 6e 32 1a 95 1b 66 ee 9f e1 90 86 32 ae Data Ascii: 1332ZrJqtb|I @BsAUD?<v-.[=?Gd9'O;83,cHPd_@=F?fqi{pjN,}s.04(wSM9*Wn2f2
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 29 Mar 2025 04:27:24 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closevary: Accept-Encodingcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iFb1refekTbi9d8B0I8Xaytf5d6aqI%2BQP8JNE3TfNn%2BIMznaxzTj%2BO1XPo%2F4TYo8Hi1tRDzHjsmY6oPyaLVsbIJsTWtc5PEzKMoofZqR6D4DS5UI7ITpYgnIQFkmK7DdsflhXGzYYfS8xB37"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 927c9d535c743d64-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=103830&min_rtt=103830&rtt_var=51915&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=528&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 66 38 35 0d 0a 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 Data Ascii: f85<!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache">
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 29 Mar 2025 04:27:43 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachex-turbo-charged-by: LiteSpeedcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Wcnf0KqhZkck3LJ9t22IzbZyg0%2BhcAwAEm36FAQzyxkSN0RDmw6wWn63%2FrZSErN%2FtjjAGHcyFHc9rm3gd46%2FZ7kPJ4axEhEyogLRqZW1pqI4sMz%2By3ChPCWaB36vP4PFauyIaE4k"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 927c9dc93b534f4e-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=94447&min_rtt=94447&rtt_var=47223&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=795&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 32 64 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 64 54 ed 8a db 3a 10 fd 1f e8 3b cc 7a 29 74 21 de c8 59 87 16 db 31 2d fd a0 17 4a ef 42 17 2e fd 29 5b e3 68 58 59 72 a5 89 93 b4 f4 dd 2f 72 92 fd 68 35 20 4b e3 33 a3 99 33 23 55 17 1f fe 7d 7f f7 fd f6 23 68 ee 4d 3d ab e2 07 02 1f 0c ae 13 8d b4 d1 5c 64 42 bc 4c e2 2f 94 Data Ascii: 2d8dT:;z)t!Y1-JB.)[hXYr/rh5 K33#U}#hM=\dBL/
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 29 Mar 2025 04:27:45 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachex-turbo-charged-by: LiteSpeedcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hMMO96lE7d5q6%2F7HWFj%2By3cAxafB2lIUdD8PCddPQTL8WEUAEjGYqn9%2FgCti9JuFUvmDoAy1yFEG%2BpVVUZHgYGeqh1%2BlN4mXPHcSCKwNeg7BlT7zfnhvrfXNqy3io4gqdQyR%2Bu%2FU"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 927c9dd9af8c0ca6-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=93174&min_rtt=93174&rtt_var=46587&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=815&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 32 64 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 64 54 ed 8a db 3a 10 fd 1f e8 3b cc 7a 29 74 21 de c8 59 87 16 db 31 2d fd a0 17 4a ef 42 17 2e fd 29 5b e3 68 58 59 72 a5 89 93 b4 f4 dd 2f 72 92 fd 68 35 20 4b e3 33 a3 99 33 23 55 17 1f fe 7d 7f f7 fd f6 23 68 ee 4d 3d ab e2 07 02 1f 0c ae 13 8d b4 d1 5c 64 42 bc Data Ascii: 2d8dT:;z)t!Y1-JB.)[hXYr/rh5 K33#U}#hM=\dB
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 29 Mar 2025 04:27:48 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachex-turbo-charged-by: LiteSpeedcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BNeYI%2BlFWjN9FX7PnVCEI9r5yvIfCL5EzrYCZRGxIZ4RitM7DmwFq1d7%2BCHYz1ozEF7Rw6GiXaLJlixAE6l9NWIn6pa6meS5P112x7l8qzQjTDFZ3f%2Fus%2FSN4GlpeI6jgNGKvxaF"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 927c9dea5cb443ff-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=99701&min_rtt=99701&rtt_var=49850&sent=6&recv=9&lost=0&retrans=0&sent_bytes=0&recv_bytes=7072&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 32 64 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 64 54 ed 8a db 3a 10 fd 1f e8 3b cc 7a 29 74 21 de c8 59 87 16 db 31 2d fd a0 17 4a ef 42 17 2e fd 29 5b e3 68 58 59 72 a5 89 93 b4 f4 dd 2f 72 92 fd 68 35 20 4b e3 33 a3 99 33 23 55 17 1f fe 7d 7f f7 fd f6 23 68 ee 4d 3d ab e2 07 02 1f 0c ae 13 8d b4 d1 5c 64 42 bc 4c e2 2f 94 aa Data Ascii: 2d8dT:;z)t!Y1-JB.)[hXYr/rh5 K33#U}#hM=\dBL/
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 29 Mar 2025 04:27:51 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachex-turbo-charged-by: LiteSpeedcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YD8otxmiQ0ADLScRmuJKzsLxcW6Op4L2Py3mtiQWHdsDMoWZ1D2e0TKZbEbGPGifOpViL4nUgTFcta1WgE%2B%2BsnsbLsFS3Z6JQZI3O2KufMeyW0fSEPUiBtDjOf476Mlhe7Rxg%2FdD"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 927c9dfafe92fbf2-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=108661&min_rtt=108661&rtt_var=54330&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=522&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 34 65 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 Data Ascii: 4e3<!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-f

Source: 99mXjPxVfM3v.exe, 00000007.00000002.3680411287.0000000006840000.00000004.80000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3678084173.0000000004990000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://cpanel.com/?utm_source=cpanelwhm&utm_medium=cplogo&utm_content=logolink&utm_campaign=404refer
Source: 99mXjPxVfM3v.exe, 00000007.00000002.3680411287.0000000006066000.00000004.80000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3678084173.00000000041B6000.00000004.10000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3679639621.0000000006190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://digi-searches.com/Autoresponder_Marketing.cfm?fp=y0rjdxcdoANYIcILFoWoqPFXvvI7qm0YiuaMoAwxOEL5
Source: 99mXjPxVfM3v.exe, 00000007.00000002.3680411287.0000000006066000.00000004.80000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3678084173.00000000041B6000.00000004.10000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3679639621.0000000006190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://digi-searches.com/Book_Airline_Tickets.cfm?fp=y0rjdxcdoANYIcILFoWoqPFXvvI7qm0YiuaMoAwxOEL5Aic
Source: 99mXjPxVfM3v.exe, 00000007.00000002.3680411287.0000000006066000.00000004.80000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3678084173.00000000041B6000.00000004.10000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3679639621.0000000006190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://digi-searches.com/Chat_Rooms.cfm?fp=y0rjdxcdoANYIcILFoWoqPFXvvI7qm0YiuaMoAwxOEL5AicKTQZ90MxYJ
Source: 99mXjPxVfM3v.exe, 00000007.00000002.3680411287.0000000006066000.00000004.80000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3678084173.00000000041B6000.00000004.10000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3679639621.0000000006190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://digi-searches.com/Google_Adwords.cfm?fp=y0rjdxcdoANYIcILFoWoqPFXvvI7qm0YiuaMoAwxOEL5AicKTQZ90
Source: 99mXjPxVfM3v.exe, 00000007.00000002.3680411287.0000000006066000.00000004.80000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3678084173.00000000041B6000.00000004.10000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3679639621.0000000006190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://digi-searches.com/Living.cfm?fp=y0rjdxcdoANYIcILFoWoqPFXvvI7qm0YiuaMoAwxOEL5AicKTQZ90MxYJLO%2
Source: reg.exe, 00000008.00000002.3679639621.0000000006190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://digi-searches.com/px.js?ch=1
Source: reg.exe, 00000008.00000002.3679639621.0000000006190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://digi-searches.com/px.js?ch=2
Source: reg.exe, 00000008.00000002.3679639621.0000000006190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://digi-searches.com/sk-logabpstatus.php?a=U1BVWkdTdzV4emJ5bSs5TXFNVTc3S05kUks2V3l3bzZBUTlwUDhwZ
Source: 99mXjPxVfM3v.exe, 00000007.00000002.3680411287.0000000006066000.00000004.80000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3678084173.00000000041B6000.00000004.10000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3679639621.0000000006190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.eot
Source: 99mXjPxVfM3v.exe, 00000007.00000002.3680411287.0000000006066000.00000004.80000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3678084173.00000000041B6000.00000004.10000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3679639621.0000000006190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.eot?#iefix
Source: 99mXjPxVfM3v.exe, 00000007.00000002.3680411287.0000000006066000.00000004.80000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3678084173.00000000041B6000.00000004.10000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3679639621.0000000006190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.otf
Source: 99mXjPxVfM3v.exe, 00000007.00000002.3680411287.0000000006066000.00000004.80000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3678084173.00000000041B6000.00000004.10000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3679639621.0000000006190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.svg#montserrat-bold
Source: 99mXjPxVfM3v.exe, 00000007.00000002.3680411287.0000000006066000.00000004.80000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3678084173.00000000041B6000.00000004.10000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3679639621.0000000006190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.ttf
Source: 99mXjPxVfM3v.exe, 00000007.00000002.3680411287.0000000006066000.00000004.80000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3678084173.00000000041B6000.00000004.10000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3679639621.0000000006190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.woff
Source: 99mXjPxVfM3v.exe, 00000007.00000002.3680411287.0000000006066000.00000004.80000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3678084173.00000000041B6000.00000004.10000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3679639621.0000000006190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.woff2
Source: 99mXjPxVfM3v.exe, 00000007.00000002.3680411287.0000000006066000.00000004.80000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3678084173.00000000041B6000.00000004.10000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3679639621.0000000006190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.eot
Source: 99mXjPxVfM3v.exe, 00000007.00000002.3680411287.0000000006066000.00000004.80000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3678084173.00000000041B6000.00000004.10000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3679639621.0000000006190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.eot?#iefix
Source: 99mXjPxVfM3v.exe, 00000007.00000002.3680411287.0000000006066000.00000004.80000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3678084173.00000000041B6000.00000004.10000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3679639621.0000000006190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.otf
Source: 99mXjPxVfM3v.exe, 00000007.00000002.3680411287.0000000006066000.00000004.80000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3678084173.00000000041B6000.00000004.10000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3679639621.0000000006190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.svg#montserrat-regular
Source: 99mXjPxVfM3v.exe, 00000007.00000002.3680411287.0000000006066000.00000004.80000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3678084173.00000000041B6000.00000004.10000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3679639621.0000000006190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.ttf
Source: 99mXjPxVfM3v.exe, 00000007.00000002.3680411287.0000000006066000.00000004.80000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3678084173.00000000041B6000.00000004.10000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3679639621.0000000006190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.woff
Source: 99mXjPxVfM3v.exe, 00000007.00000002.3680411287.0000000006066000.00000004.80000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3678084173.00000000041B6000.00000004.10000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3679639621.0000000006190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.woff2
Source: 99mXjPxVfM3v.exe, 00000007.00000002.3680411287.0000000006066000.00000004.80000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3678084173.00000000041B6000.00000004.10000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3679639621.0000000006190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/js/min.js?v2.3
Source: 99mXjPxVfM3v.exe, 00000007.00000002.3680411287.0000000006066000.00000004.80000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3678084173.00000000041B6000.00000004.10000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3679639621.0000000006190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/pics/10667/netsol-logos-2020-165-50.jpg
Source: 99mXjPxVfM3v.exe, 00000007.00000002.3680411287.0000000006066000.00000004.80000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3678084173.00000000041B6000.00000004.10000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3679639621.0000000006190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/pics/28903/search.png)
Source: 99mXjPxVfM3v.exe, 00000007.00000002.3680411287.0000000006066000.00000004.80000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3678084173.00000000041B6000.00000004.10000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3679639621.0000000006190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/pics/28905/arrrow.png)
Source: 99mXjPxVfM3v.exe, 00000007.00000002.3680411287.0000000006066000.00000004.80000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3678084173.00000000041B6000.00000004.10000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3679639621.0000000006190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/pics/29590/bg1.png)
Source: 99mXjPxVfM3v.exe, 00000007.00000002.3680411287.0000000006066000.00000004.80000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3678084173.00000000041B6000.00000004.10000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3679639621.0000000006190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/pics/468/netsol-favicon-2020.jpg
Source: 99mXjPxVfM3v.exe, 00000007.00000002.3680411287.0000000006066000.00000004.80000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3678084173.00000000041B6000.00000004.10000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3679639621.0000000006190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.Mylivingbio.online
Source: 99mXjPxVfM3v.exe, 00000007.00000002.3681688673.0000000007F72000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.myhandyplanner.courses
Source: 99mXjPxVfM3v.exe, 00000007.00000002.3681688673.0000000007F72000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.myhandyplanner.courses/qm65/
Source: 99mXjPxVfM3v.exe, 00000007.00000002.3680411287.0000000006066000.00000004.80000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3678084173.00000000041B6000.00000004.10000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3679639621.0000000006190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mylivingbio.online/__media__/design/underconstructionnotice.php?d=mylivingbio.online
Source: 99mXjPxVfM3v.exe, 00000007.00000002.3680411287.0000000006066000.00000004.80000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3678084173.00000000041B6000.00000004.10000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3679639621.0000000006190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mylivingbio.online/__media__/js/trademark.php?d=mylivingbio.online&type=ns
Source: reg.exe, 00000008.00000003.1584547010.0000000007C6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org?q=
Source: 99mXjPxVfM3v.exe, 00000007.00000002.3680411287.0000000006066000.00000004.80000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3678084173.00000000041B6000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://cdn.consentmanager.net
Source: reg.exe, 00000008.00000003.1584547010.0000000007C6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: reg.exe, 00000008.00000003.1584547010.0000000007C6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: reg.exe, 00000008.00000003.1584547010.0000000007C6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 99mXjPxVfM3v.exe, 00000007.00000002.3680411287.0000000006066000.00000004.80000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3678084173.00000000041B6000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://delivery.consentmanager.net
Source: reg.exe, 00000008.00000002.3678084173.00000000041B6000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://dts.gnpge.com
Source: reg.exe, 00000008.00000003.1584547010.0000000007C6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: reg.exe, 00000008.00000003.1584547010.0000000007C6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabv20
Source: reg.exe, 00000008.00000003.1584547010.0000000007C6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: reg.exe, 00000008.00000003.1584547010.0000000007C6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/app?q=
Source: reg.exe, 00000008.00000002.3676253646.00000000031DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: reg.exe, 00000008.00000002.3676253646.00000000031DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: reg.exe, 00000008.00000002.3676253646.00000000031DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: reg.exe, 00000008.00000003.1577199348.0000000007C42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: reg.exe, 00000008.00000003.1584547010.0000000007C6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/v20
Source: 99mXjPxVfM3v.exe, 00000007.00000002.3680411287.00000000066AE000.00000004.80000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3678084173.00000000047FE000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: reg.exe, 00000008.00000003.1584547010.0000000007C6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
Source: 99mXjPxVfM3v.exe, 00000007.00000002.3680411287.0000000006CF6000.00000004.80000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3678084173.0000000004E46000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.utzp.top/d478/?s2spt=yZiSYoN2a3htTd2ds6QP1P94BsLGeX6oYMbqUQeMjg/YAZw5n93PIWGpgWWmb8mQ8VO

Key, Mouse, Clipboard, Microphone and Screen Capturing

Source: C:\Users\user\Desktop\RFQ details folder.exe

Code function: 0_2_00DD4164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00DD4164

Source: C:\Users\user\Desktop\RFQ details folder.exe

Code function: 0_2_00DD4164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00DD4164

Source: C:\Users\user\Desktop\RFQ details folder.exe

Code function: 0_2_00DD3F66 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00DD3F66

Source: C:\Users\user\Desktop\RFQ details folder.exe

Code function: 0_2_00DC001C GetKeyboardState,SetKeyboardState,GetAsyncKeyState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_00DC001C

Source: C:\Users\user\Desktop\RFQ details folder.exe

Code function: 0_2_00DECABC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00DECABC

E-Banking Fraud

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1404778921.0000000003790000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3676000841.0000000003050000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3675864670.0000000003000000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1404313483.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3681688673.0000000007F20000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3675258966.0000000000A00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3677471460.0000000004EC0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1405459163.0000000005C50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: This is a third-party compiled AutoIt script.		0_2_00D63B3A
Source: RFQ details folder.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: RFQ details folder.exe, 00000000.00000002.1250863893.0000000000E14000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.		memstr_5ff45843-c
Source: RFQ details folder.exe, 00000000.00000002.1250863893.0000000000E14000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`		memstr_d17c8b89-0
Source: RFQ details folder.exe	String found in binary or memory: This is a third-party compiled AutoIt script.		memstr_69cf237d-a
Source: RFQ details folder.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`		memstr_a644f3c7-2

Source: initial sample

Static PE information: Filename: RFQ details folder.exe

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0042C8E3 NtClose,		1_2_0042C8E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72B60 NtClose,LdrInitializeThunk,		1_2_03A72B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72DF0 NtQuerySystemInformation,LdrInitializeThunk,		1_2_03A72DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A735C0 NtCreateMutant,LdrInitializeThunk,		1_2_03A735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A74340 NtSetContextThread,		1_2_03A74340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A74650 NtSuspendThread,		1_2_03A74650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72BA0 NtEnumerateValueKey,		1_2_03A72BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72B80 NtQueryInformationFile,		1_2_03A72B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72BE0 NtQueryValueKey,		1_2_03A72BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72BF0 NtAllocateVirtualMemory,		1_2_03A72BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72AB0 NtWaitForSingleObject,		1_2_03A72AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72AF0 NtWriteFile,		1_2_03A72AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72AD0 NtReadFile,		1_2_03A72AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72FA0 NtQuerySection,		1_2_03A72FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72FB0 NtResumeThread,		1_2_03A72FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72F90 NtProtectVirtualMemory,		1_2_03A72F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72FE0 NtCreateFile,		1_2_03A72FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72F30 NtCreateSection,		1_2_03A72F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72F60 NtCreateProcessEx,		1_2_03A72F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72EA0 NtAdjustPrivilegesToken,		1_2_03A72EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72E80 NtReadVirtualMemory,		1_2_03A72E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72EE0 NtQueueApcThread,		1_2_03A72EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72E30 NtWriteVirtualMemory,		1_2_03A72E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72DB0 NtEnumerateKey,		1_2_03A72DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72DD0 NtDelayExecution,		1_2_03A72DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72D30 NtUnmapViewOfSection,		1_2_03A72D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72D00 NtSetInformationFile,		1_2_03A72D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72D10 NtMapViewOfSection,		1_2_03A72D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72CA0 NtQueryInformationToken,		1_2_03A72CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72CF0 NtOpenProcess,		1_2_03A72CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72CC0 NtQueryVirtualMemory,		1_2_03A72CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72C00 NtQueryInformationProcess,		1_2_03A72C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72C60 NtCreateKey,		1_2_03A72C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72C70 NtFreeVirtualMemory,		1_2_03A72C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A73090 NtSetValueKey,		1_2_03A73090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A73010 NtOpenDirectoryObject,		1_2_03A73010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A739B0 NtGetContextThread,		1_2_03A739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A73D10 NtOpenProcessToken,		1_2_03A73D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A73D70 NtOpenThread,		1_2_03A73D70
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03684340 NtSetContextThread,LdrInitializeThunk,		8_2_03684340
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03684650 NtSuspendThread,LdrInitializeThunk,		8_2_03684650
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03682B60 NtClose,LdrInitializeThunk,		8_2_03682B60
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03682BE0 NtQueryValueKey,LdrInitializeThunk,		8_2_03682BE0
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03682BF0 NtAllocateVirtualMemory,LdrInitializeThunk,		8_2_03682BF0
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03682BA0 NtEnumerateValueKey,LdrInitializeThunk,		8_2_03682BA0
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03682AF0 NtWriteFile,LdrInitializeThunk,		8_2_03682AF0
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03682AD0 NtReadFile,LdrInitializeThunk,		8_2_03682AD0
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03682F30 NtCreateSection,LdrInitializeThunk,		8_2_03682F30
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03682FE0 NtCreateFile,LdrInitializeThunk,		8_2_03682FE0
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03682FB0 NtResumeThread,LdrInitializeThunk,		8_2_03682FB0
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03682EE0 NtQueueApcThread,LdrInitializeThunk,		8_2_03682EE0
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03682E80 NtReadVirtualMemory,LdrInitializeThunk,		8_2_03682E80
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03682D30 NtUnmapViewOfSection,LdrInitializeThunk,		8_2_03682D30
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03682D10 NtMapViewOfSection,LdrInitializeThunk,		8_2_03682D10
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03682DF0 NtQuerySystemInformation,LdrInitializeThunk,		8_2_03682DF0
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03682DD0 NtDelayExecution,LdrInitializeThunk,		8_2_03682DD0
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03682C60 NtCreateKey,LdrInitializeThunk,		8_2_03682C60
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03682C70 NtFreeVirtualMemory,LdrInitializeThunk,		8_2_03682C70
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03682CA0 NtQueryInformationToken,LdrInitializeThunk,		8_2_03682CA0
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_036835C0 NtCreateMutant,LdrInitializeThunk,		8_2_036835C0
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_036839B0 NtGetContextThread,LdrInitializeThunk,		8_2_036839B0
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03682B80 NtQueryInformationFile,		8_2_03682B80
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03682AB0 NtWaitForSingleObject,		8_2_03682AB0
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03682F60 NtCreateProcessEx,		8_2_03682F60
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03682FA0 NtQuerySection,		8_2_03682FA0
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03682F90 NtProtectVirtualMemory,		8_2_03682F90
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03682E30 NtWriteVirtualMemory,		8_2_03682E30
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03682EA0 NtAdjustPrivilegesToken,		8_2_03682EA0
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03682D00 NtSetInformationFile,		8_2_03682D00
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03682DB0 NtEnumerateKey,		8_2_03682DB0
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03682C00 NtQueryInformationProcess,		8_2_03682C00
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03682CF0 NtOpenProcess,		8_2_03682CF0
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03682CC0 NtQueryVirtualMemory,		8_2_03682CC0
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03683010 NtOpenDirectoryObject,		8_2_03683010
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03683090 NtSetValueKey,		8_2_03683090
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03683D70 NtOpenThread,		8_2_03683D70
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03683D10 NtOpenProcessToken,		8_2_03683D10
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_00A29200 NtCreateFile,		8_2_00A29200
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_00A29370 NtReadFile,		8_2_00A29370
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_00A29460 NtDeleteFile,		8_2_00A29460
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_00A29500 NtClose,		8_2_00A29500
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_00A29670 NtAllocateVirtualMemory,		8_2_00A29670

Source: C:\Users\user\Desktop\RFQ details folder.exe

Code function: 0_2_00DCA1EF: GetFullPathNameW,__swprintf,CreateDirectoryW,CreateFileW,_memset,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

0_2_00DCA1EF

Source: C:\Users\user\Desktop\RFQ details folder.exe

Code function: 0_2_00DB8310 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00DB8310

Source: C:\Users\user\Desktop\RFQ details folder.exe

Code function: 0_2_00DC51BD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00DC51BD

Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00D8D975		0_2_00D8D975
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00D821C5		0_2_00D821C5
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00D962D2		0_2_00D962D2
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00DE03DA		0_2_00DE03DA
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00D9242E		0_2_00D9242E
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00D825FA		0_2_00D825FA
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00D766E1		0_2_00D766E1
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00D6E6A0		0_2_00D6E6A0
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00DBE616		0_2_00DBE616
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00D9878F		0_2_00D9878F
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00DC8889		0_2_00DC8889
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00DE0857		0_2_00DE0857
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00D96844		0_2_00D96844
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00D78808		0_2_00D78808
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00D8CB21		0_2_00D8CB21
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00D96DB6		0_2_00D96DB6
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00D76F9E		0_2_00D76F9E
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00D73030		0_2_00D73030
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00D8F1D9		0_2_00D8F1D9
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00D83187		0_2_00D83187
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00D61287		0_2_00D61287
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00D81484		0_2_00D81484
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00D75520		0_2_00D75520
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00D87696		0_2_00D87696
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00D75760		0_2_00D75760
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00D81978		0_2_00D81978
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00D6FCE0		0_2_00D6FCE0
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00DE7DDB		0_2_00DE7DDB
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00D81D90		0_2_00D81D90
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00D8BDA6		0_2_00D8BDA6
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00D73FE0		0_2_00D73FE0
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00D6DF00		0_2_00D6DF00
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_011C2DB0		0_2_011C2DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004187E3		1_2_004187E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0041001A		1_2_0041001A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00410023		1_2_00410023
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040282C		1_2_0040282C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00402830		1_2_00402830
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00403160		1_2_00403160
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00401110		1_2_00401110
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004169DE		1_2_004169DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004169E3		1_2_004169E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00410243		1_2_00410243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00401260		1_2_00401260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040E233		1_2_0040E233
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040E377		1_2_0040E377
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00402320		1_2_00402320
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040E383		1_2_0040E383
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00402C42		1_2_00402C42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00402C50		1_2_00402C50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040258D		1_2_0040258D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00402590		1_2_00402590
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0042EEB3		1_2_0042EEB3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A4E3F0		1_2_03A4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B003E6		1_2_03B003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AFA352		1_2_03AFA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AC02C0		1_2_03AC02C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AE0274		1_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B001AA		1_2_03B001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AF81CC		1_2_03AF81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A30100		1_2_03A30100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ADA118		1_2_03ADA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AC8158		1_2_03AC8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AD2000		1_2_03AD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3C7C0		1_2_03A3C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40770		1_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A64750		1_2_03A64750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5C6E0		1_2_03A5C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B00591		1_2_03B00591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40535		1_2_03A40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AEE4F6		1_2_03AEE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AE4420		1_2_03AE4420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AF2446		1_2_03AF2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AF6BD7		1_2_03AF6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AFAB40		1_2_03AFAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3EA80		1_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A429A0		1_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B0A9A6		1_2_03B0A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A56962		1_2_03A56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A268B8		1_2_03A268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6E8F0		1_2_03A6E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A4A840		1_2_03A4A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A42840		1_2_03A42840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ABEFA0		1_2_03ABEFA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A4CFE0		1_2_03A4CFE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A32FC8		1_2_03A32FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A82F28		1_2_03A82F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A60F30		1_2_03A60F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AE2F30		1_2_03AE2F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB4F40		1_2_03AB4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A52E90		1_2_03A52E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AFCE93		1_2_03AFCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AFEEDB		1_2_03AFEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AFEE26		1_2_03AFEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40E59		1_2_03A40E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A58DBF		1_2_03A58DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3ADE0		1_2_03A3ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A4AD00		1_2_03A4AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ADCD1F		1_2_03ADCD1F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AE0CB5		1_2_03AE0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A30CF2		1_2_03A30CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40C00		1_2_03A40C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A8739A		1_2_03A8739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AF132D		1_2_03AF132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A2D34C		1_2_03A2D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A452A0		1_2_03A452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AE12ED		1_2_03AE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5B2C0		1_2_03A5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A4B1B0		1_2_03A4B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A7516C		1_2_03A7516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A2F172		1_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B0B16B		1_2_03B0B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AF70E9		1_2_03AF70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AFF0E0		1_2_03AFF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AEF0CC		1_2_03AEF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A470C0		1_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AFF7B0		1_2_03AFF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AF16CC		1_2_03AF16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ADD5B0		1_2_03ADD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AF7571		1_2_03AF7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AFF43F		1_2_03AFF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A31460		1_2_03A31460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5FB80		1_2_03A5FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB5BF0		1_2_03AB5BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A7DBF9		1_2_03A7DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AFFB76		1_2_03AFFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ADDAAC		1_2_03ADDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A85AA0		1_2_03A85AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AE1AA3		1_2_03AE1AA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AEDAC6		1_2_03AEDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB3A6C		1_2_03AB3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AFFA49		1_2_03AFFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AF7A46		1_2_03AF7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AD5910		1_2_03AD5910
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A49950		1_2_03A49950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5B950		1_2_03A5B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A438E0		1_2_03A438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AAD800		1_2_03AAD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AFFFB1		1_2_03AFFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A41F92		1_2_03A41F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AFFF09		1_2_03AFFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A49EB0		1_2_03A49EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5FDC0		1_2_03A5FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AF7D73		1_2_03AF7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A43D40		1_2_03A43D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AF1D5A		1_2_03AF1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AFFCF2		1_2_03AFFCF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB9C32		1_2_03AB9C32
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	Code function: 7_2_07F2F71E		7_2_07F2F71E
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	Code function: 7_2_07F2D70E		7_2_07F2D70E
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	Code function: 7_2_07F35EB9		7_2_07F35EB9
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	Code function: 7_2_07F35EBE		7_2_07F35EBE
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	Code function: 7_2_07F3462E		7_2_07F3462E
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	Code function: 7_2_07F2F4F5		7_2_07F2F4F5
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	Code function: 7_2_07F2F4FE		7_2_07F2F4FE
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	Code function: 7_2_07F37CBE		7_2_07F37CBE
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	Code function: 7_2_07F4E38E		7_2_07F4E38E
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	Code function: 7_2_07F2D852		7_2_07F2D852
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	Code function: 7_2_07F2D85E		7_2_07F2D85E
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_0370A352		8_2_0370A352
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_0365E3F0		8_2_0365E3F0
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_037103E6		8_2_037103E6
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_036F0274		8_2_036F0274
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_036D02C0		8_2_036D02C0
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_036D8158		8_2_036D8158
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03640100		8_2_03640100
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_036EA118		8_2_036EA118
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_037081CC		8_2_037081CC
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_037041A2		8_2_037041A2
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_037101AA		8_2_037101AA
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_036E2000		8_2_036E2000
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03650770		8_2_03650770
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03674750		8_2_03674750
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_0366C6E0		8_2_0366C6E0
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03650535		8_2_03650535
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03710591		8_2_03710591
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03702446		8_2_03702446
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_036F4420		8_2_036F4420
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_036FE4F6		8_2_036FE4F6
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_0370AB40		8_2_0370AB40
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03706BD7		8_2_03706BD7
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_0364EA80		8_2_0364EA80
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03666962		8_2_03666962
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_036529A0		8_2_036529A0
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_0371A9A6		8_2_0371A9A6
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03652840		8_2_03652840
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_0365A840		8_2_0365A840
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_0367E8F0		8_2_0367E8F0
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_036368B8		8_2_036368B8
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_036C4F40		8_2_036C4F40
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03692F28		8_2_03692F28
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03670F30		8_2_03670F30
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_036F2F30		8_2_036F2F30
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_0365CFE0		8_2_0365CFE0
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03642FC8		8_2_03642FC8
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_036CEFA0		8_2_036CEFA0
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03650E59		8_2_03650E59
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_0370EE26		8_2_0370EE26
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_0370EEDB		8_2_0370EEDB
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_0370CE93		8_2_0370CE93
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03662E90		8_2_03662E90
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_0365AD00		8_2_0365AD00
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_036ECD1F		8_2_036ECD1F
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_0364ADE0		8_2_0364ADE0
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03668DBF		8_2_03668DBF
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03650C00		8_2_03650C00
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03640CF2		8_2_03640CF2
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_036F0CB5		8_2_036F0CB5
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_0363D34C		8_2_0363D34C
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_0370132D		8_2_0370132D
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_0369739A		8_2_0369739A
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_036F12ED		8_2_036F12ED
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_0366B2C0		8_2_0366B2C0
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_036552A0		8_2_036552A0
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_0368516C		8_2_0368516C
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_0363F172		8_2_0363F172
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_0371B16B		8_2_0371B16B
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_0365B1B0		8_2_0365B1B0
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_0370F0E0		8_2_0370F0E0
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_037070E9		8_2_037070E9
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_036FF0CC		8_2_036FF0CC
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_036570C0		8_2_036570C0
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_0370F7B0		8_2_0370F7B0
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_037016CC		8_2_037016CC
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03707571		8_2_03707571
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_036ED5B0		8_2_036ED5B0
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03641460		8_2_03641460
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_0370F43F		8_2_0370F43F
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_0370FB76		8_2_0370FB76
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_0368DBF9		8_2_0368DBF9
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_036C5BF0		8_2_036C5BF0
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_0366FB80		8_2_0366FB80
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_036C3A6C		8_2_036C3A6C
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03707A46		8_2_03707A46
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_0370FA49		8_2_0370FA49
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_036FDAC6		8_2_036FDAC6
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_036EDAAC		8_2_036EDAAC
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03695AA0		8_2_03695AA0
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_036F1AA3		8_2_036F1AA3
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03659950		8_2_03659950
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_0366B950		8_2_0366B950
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_036E5910		8_2_036E5910
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_036BD800		8_2_036BD800
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_036538E0		8_2_036538E0
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_0370FF09		8_2_0370FF09
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_0370FFB1		8_2_0370FFB1
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03651F92		8_2_03651F92
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03659EB0		8_2_03659EB0
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03707D73		8_2_03707D73
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03653D40		8_2_03653D40
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_03701D5A		8_2_03701D5A
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_0366FDC0		8_2_0366FDC0
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_036C9C32		8_2_036C9C32
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_0370FCF2		8_2_0370FCF2
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_00A11D70		8_2_00A11D70
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_00A0CC37		8_2_00A0CC37
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_00A0CC40		8_2_00A0CC40
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_00A0CE60		8_2_00A0CE60
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_00A0AE50		8_2_00A0AE50
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_00A0AFA0		8_2_00A0AFA0
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_00A0AF94		8_2_00A0AF94
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_00A15400		8_2_00A15400
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_00A135FB		8_2_00A135FB
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_00A13600		8_2_00A13600
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_00A2BAD0		8_2_00A2BAD0
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_032BE2F4		8_2_032BE2F4
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_032BE7AC		8_2_032BE7AC
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_032BE413		8_2_032BE413
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_032BD878		8_2_032BD878

Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: String function: 00D67DE1 appears 35 times
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: String function: 00D80AE3 appears 70 times
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: String function: 00D88900 appears 42 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03AAEA12 appears 86 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03A2B970 appears 280 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03A87E54 appears 102 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03ABF290 appears 105 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03A75130 appears 58 times
Source: C:\Windows\SysWOW64\reg.exe	Code function: String function: 03685130 appears 58 times
Source: C:\Windows\SysWOW64\reg.exe	Code function: String function: 03697E54 appears 102 times
Source: C:\Windows\SysWOW64\reg.exe	Code function: String function: 0363B970 appears 280 times
Source: C:\Windows\SysWOW64\reg.exe	Code function: String function: 036BEA12 appears 86 times
Source: C:\Windows\SysWOW64\reg.exe	Code function: String function: 036CF290 appears 105 times

Source: RFQ details folder.exe, 00000000.00000003.1231439011.0000000003893000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs RFQ details folder.exe
Source: RFQ details folder.exe, 00000000.00000003.1229797992.00000000039ED000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs RFQ details folder.exe

Source: RFQ details folder.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe

Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\SysWOW64\reg.exe"

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/3@16/11

Source: C:\Users\user\Desktop\RFQ details folder.exe

Code function: 0_2_00DCA06A GetLastError,FormatMessageW,

0_2_00DCA06A

Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00DB81CB AdjustTokenPrivileges,CloseHandle,		0_2_00DB81CB
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00DB87E1 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00DB87E1

Source: C:\Users\user\Desktop\RFQ details folder.exe

Code function: 0_2_00DCB3FB SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00DCB3FB

Source: C:\Users\user\Desktop\RFQ details folder.exe

Code function: 0_2_00DDEE0D CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00DDEE0D

Source: C:\Users\user\Desktop\RFQ details folder.exe

Code function: 0_2_00DCC397 CoInitialize,CoCreateInstance,CoUninitialize,

0_2_00DCC397

Source: C:\Users\user\Desktop\RFQ details folder.exe

Code function: 0_2_00D64E89 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00D64E89

Source: C:\Users\user\Desktop\RFQ details folder.exe

File created: C:\Users\user\AppData\Local\Temp\aut3BCC.tmp

Jump to behavior

Source: RFQ details folder.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\RFQ details folder.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: reg.exe, 00000008.00000002.3676253646.0000000003243000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: RFQ details folder.exe	ReversingLabs: Detection: 44%
Source: RFQ details folder.exe	Virustotal: Detection: 37%

Source: unknown	Process created: C:\Users\user\Desktop\RFQ details folder.exe "C:\Users\user\Desktop\RFQ details folder.exe"
Source: C:\Users\user\Desktop\RFQ details folder.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\RFQ details folder.exe"
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\SysWOW64\reg.exe"
Source: C:\Windows\SysWOW64\reg.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\RFQ details folder.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\RFQ details folder.exe"			Jump to behavior
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\SysWOW64\reg.exe"			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"			Jump to behavior

Source: C:\Users\user\Desktop\RFQ details folder.exe	Section loaded: wsock32.dll			Jump to behavior
Source: C:\Users\user\Desktop\RFQ details folder.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Users\user\Desktop\RFQ details folder.exe	Section loaded: winmm.dll			Jump to behavior
Source: C:\Users\user\Desktop\RFQ details folder.exe	Section loaded: mpr.dll			Jump to behavior
Source: C:\Users\user\Desktop\RFQ details folder.exe	Section loaded: wininet.dll			Jump to behavior
Source: C:\Users\user\Desktop\RFQ details folder.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Users\user\Desktop\RFQ details folder.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Users\user\Desktop\RFQ details folder.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Users\user\Desktop\RFQ details folder.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Users\user\Desktop\RFQ details folder.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Users\user\Desktop\RFQ details folder.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Users\user\Desktop\RFQ details folder.exe	Section loaded: ntmarta.dll			Jump to behavior
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	Section loaded: wininet.dll			Jump to behavior
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	Section loaded: mswsock.dll			Jump to behavior
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	Section loaded: dnsapi.dll			Jump to behavior
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	Section loaded: fwpuclnt.dll			Jump to behavior
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	Section loaded: rasadhlp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Section loaded: wininet.dll			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Section loaded: ieframe.dll			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Section loaded: iertutil.dll			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Section loaded: netapi32.dll			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Section loaded: winhttp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Section loaded: wkscli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Section loaded: secur32.dll			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Section loaded: mlang.dll			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Section loaded: propsys.dll			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Section loaded: winsqlite3.dll			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Section loaded: vaultcli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Section loaded: dpapi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Section loaded: cryptbase.dll			Jump to behavior

Source: C:\Windows\SysWOW64\reg.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\reg.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Jump to behavior

Source: RFQ details folder.exe

Static file information: File size 1192960 > 1048576

Source: RFQ details folder.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: RFQ details folder.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: RFQ details folder.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: RFQ details folder.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: RFQ details folder.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: RFQ details folder.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: RFQ details folder.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: RFQ details folder.exe, 00000000.00000003.1230522676.0000000003770000.00000004.00001000.00020000.00000000.sdmp, RFQ details folder.exe, 00000000.00000003.1233535333.0000000003910000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1268719730.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1271844661.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1404871036.0000000003A00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1404871036.0000000003B9E000.00000040.00001000.00020000.00000000.sdmp, reg.exe, 00000008.00000003.1404599304.00000000032BA000.00000004.00000020.00020000.00000000.sdmp, reg.exe, 00000008.00000002.3677649396.0000000003610000.00000040.00001000.00020000.00000000.sdmp, reg.exe, 00000008.00000002.3677649396.00000000037AE000.00000040.00001000.00020000.00000000.sdmp, reg.exe, 00000008.00000003.1406538532.000000000346A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: RFQ details folder.exe, 00000000.00000003.1230522676.0000000003770000.00000004.00001000.00020000.00000000.sdmp, RFQ details folder.exe, 00000000.00000003.1233535333.0000000003910000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000003.1268719730.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1271844661.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1404871036.0000000003A00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1404871036.0000000003B9E000.00000040.00001000.00020000.00000000.sdmp, reg.exe, reg.exe, 00000008.00000003.1404599304.00000000032BA000.00000004.00000020.00020000.00000000.sdmp, reg.exe, 00000008.00000002.3677649396.0000000003610000.00000040.00001000.00020000.00000000.sdmp, reg.exe, 00000008.00000002.3677649396.00000000037AE000.00000040.00001000.00020000.00000000.sdmp, reg.exe, 00000008.00000003.1406538532.000000000346A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: reg.pdb source: svchost.exe, 00000001.00000003.1351722684.000000000341A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1351856103.000000000343B000.00000004.00000020.00020000.00000000.sdmp, 99mXjPxVfM3v.exe, 00000007.00000003.1471315586.0000000001384000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: 99mXjPxVfM3v.exe, 00000007.00000002.3680411287.0000000005AEC000.00000004.80000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3676253646.00000000031BE000.00000004.00000020.00020000.00000000.sdmp, reg.exe, 00000008.00000002.3678084173.0000000003C3C000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.1689216523.000000000C19C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: 99mXjPxVfM3v.exe, 00000007.00000002.3680411287.0000000005AEC000.00000004.80000000.00040000.00000000.sdmp, reg.exe, 00000008.00000002.3676253646.00000000031BE000.00000004.00000020.00020000.00000000.sdmp, reg.exe, 00000008.00000002.3678084173.0000000003C3C000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.1689216523.000000000C19C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: reg.pdbGCTL source: svchost.exe, 00000001.00000003.1351722684.000000000341A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1351856103.000000000343B000.00000004.00000020.00020000.00000000.sdmp, 99mXjPxVfM3v.exe, 00000007.00000003.1471315586.0000000001384000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Work\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: 99mXjPxVfM3v.exe, 00000007.00000002.3675227158.00000000006EF000.00000002.00000001.01000000.00000005.sdmp

Source: RFQ details folder.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: RFQ details folder.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: RFQ details folder.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: RFQ details folder.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: RFQ details folder.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Source: C:\Users\user\Desktop\RFQ details folder.exe

Code function: 0_2_00D64B37 LoadLibraryA,GetProcAddress,

0_2_00D64B37

Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00D88945 push ecx; ret		0_2_00D88958
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00419140 pushfd ; retf		1_2_00419143
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0041A951 push ebx; ret		1_2_0041A952
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00414A08 push ss; retf		1_2_00414A0E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004192A7 push edi; retf		1_2_004192A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040AB7E push esi; iretd		1_2_0040AB8D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004033E0 push eax; ret		1_2_004033E2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040AB83 push esi; iretd		1_2_0040AB8D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00415C43 push esp; ret		1_2_00415DA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00414428 push esi; ret		1_2_0041442D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00401500 push esp; retf D8DFh		1_2_00401596
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00418D0C push edi; ret		1_2_00418D1C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00418D13 push edi; ret		1_2_00418D1C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00411E1B push ds; ret		1_2_00411E23
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00401E2A pushfd ; ret		1_2_00401E55
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00417ED3 push edi; ret		1_2_00417EDF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004016E2 push esp; iretd		1_2_004016E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00401697 pushfd ; ret		1_2_004016D5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A309AD push ecx; mov dword ptr [esp], ecx		1_2_03A309B6
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	Code function: 7_2_07F377DD push edi; retf		7_2_07F3786F
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	Code function: 7_2_07F38782 push edi; retf		7_2_07F38783
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	Code function: 7_2_07F33EE3 push ss; retf		7_2_07F33EE9
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	Code function: 7_2_07F39E2C push ebx; ret		7_2_07F39E2D
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	Code function: 7_2_07F3861B pushfd ; retf		7_2_07F3861E
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	Code function: 7_2_07F35446 push edx; ret		7_2_07F35447
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	Code function: 7_2_07F29C26 pushfd ; retf		7_2_07F29C29
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	Code function: 7_2_07F373AE push edi; ret		7_2_07F373BA
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	Code function: 7_2_07F312F6 push ds; ret		7_2_07F312FE
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	Code function: 7_2_07F381E7 push edi; ret		7_2_07F381F7
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	Code function: 7_2_07F381EE push edi; ret		7_2_07F381F7
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	Code function: 7_2_07F2A059 push esi; iretd		7_2_07F2A068

Hooking and other Techniques for Hiding and Protection

Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00D648D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00D648D7
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00DE5376 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00DE5376

Source: C:\Users\user\Desktop\RFQ details folder.exe

Code function: 0_2_00D83187 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00D83187

Source: C:\Users\user\Desktop\RFQ details folder.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\RFQ details folder.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\RFQ details folder.exe	API/Special instruction interceptor: Address: 11C29D4
Source: C:\Windows\SysWOW64\reg.exe	API/Special instruction interceptor: Address: 7FFCC372D324
Source: C:\Windows\SysWOW64\reg.exe	API/Special instruction interceptor: Address: 7FFCC372D7E4
Source: C:\Windows\SysWOW64\reg.exe	API/Special instruction interceptor: Address: 7FFCC372D944
Source: C:\Windows\SysWOW64\reg.exe	API/Special instruction interceptor: Address: 7FFCC372D504
Source: C:\Windows\SysWOW64\reg.exe	API/Special instruction interceptor: Address: 7FFCC372D544
Source: C:\Windows\SysWOW64\reg.exe	API/Special instruction interceptor: Address: 7FFCC372D1E4
Source: C:\Windows\SysWOW64\reg.exe	API/Special instruction interceptor: Address: 7FFCC3730154
Source: C:\Windows\SysWOW64\reg.exe	API/Special instruction interceptor: Address: 7FFCC372DA44

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_03A7096E rdtsc

1_2_03A7096E

Source: C:\Windows\SysWOW64\reg.exe

Window / User API: threadDelayed 9798

Jump to behavior

Source: C:\Users\user\Desktop\RFQ details folder.exe	API coverage: 4.4 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.7 %
Source: C:\Windows\SysWOW64\reg.exe	API coverage: 2.7 %

Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe TID: 7212	Thread sleep time: -80000s >= -30000s			Jump to behavior
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe TID: 7212	Thread sleep count: 40 > 30			Jump to behavior
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe TID: 7212	Thread sleep time: -60000s >= -30000s			Jump to behavior
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe TID: 7212	Thread sleep count: 41 > 30			Jump to behavior
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe TID: 7212	Thread sleep time: -41000s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe TID: 7196	Thread sleep count: 174 > 30			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe TID: 7196	Thread sleep time: -348000s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe TID: 7196	Thread sleep count: 9798 > 30			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe TID: 7196	Thread sleep time: -19596000s >= -30000s			Jump to behavior

Source: C:\Windows\SysWOW64\reg.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\reg.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00DC445A GetFileAttributesW,FindFirstFileW,FindClose,		0_2_00DC445A
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00DCC6D1 FindFirstFileW,FindClose,		0_2_00DCC6D1
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00DCC75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,		0_2_00DCC75C
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00DCEF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,		0_2_00DCEF95
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00DCF0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,		0_2_00DCF0F2
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00DCF3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,		0_2_00DCF3F3
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00DC37EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,		0_2_00DC37EF
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00DC3B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,		0_2_00DC3B12
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00DCBCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,		0_2_00DCBCBC
Source: C:\Windows\SysWOW64\reg.exe	Code function: 8_2_00A1C640 FindFirstFileW,FindNextFileW,FindClose,		8_2_00A1C640

Source: C:\Users\user\Desktop\RFQ details folder.exe

Code function: 0_2_00D649A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00D649A0

Source: 99mXjPxVfM3v.exe, 00000007.00000002.3676254184.0000000001389000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllw
Source: reg.exe, 00000008.00000002.3676253646.00000000031BE000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000A.00000002.1696932388.000001B00C22C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_03A7096E rdtsc

1_2_03A7096E

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_00417973 LdrLoadDll,

1_2_00417973

Source: C:\Users\user\Desktop\RFQ details folder.exe

Code function: 0_2_00DD3F09 BlockInput,

0_2_00DD3F09

Source: C:\Users\user\Desktop\RFQ details folder.exe

Code function: 0_2_00D63B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00D63B3A

Source: C:\Users\user\Desktop\RFQ details folder.exe

Code function: 0_2_00D95A7C EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00D95A7C

Source: C:\Users\user\Desktop\RFQ details folder.exe

Code function: 0_2_00D64B37 LoadLibraryA,GetProcAddress,

0_2_00D64B37

Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_011C15F0 mov eax, dword ptr fs:[00000030h]		0_2_011C15F0
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_011C2C40 mov eax, dword ptr fs:[00000030h]		0_2_011C2C40
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_011C2CA0 mov eax, dword ptr fs:[00000030h]		0_2_011C2CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A2E388 mov eax, dword ptr fs:[00000030h]		1_2_03A2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A2E388 mov eax, dword ptr fs:[00000030h]		1_2_03A2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A2E388 mov eax, dword ptr fs:[00000030h]		1_2_03A2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5438F mov eax, dword ptr fs:[00000030h]		1_2_03A5438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5438F mov eax, dword ptr fs:[00000030h]		1_2_03A5438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A28397 mov eax, dword ptr fs:[00000030h]		1_2_03A28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A28397 mov eax, dword ptr fs:[00000030h]		1_2_03A28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A28397 mov eax, dword ptr fs:[00000030h]		1_2_03A28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A403E9 mov eax, dword ptr fs:[00000030h]		1_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A403E9 mov eax, dword ptr fs:[00000030h]		1_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A403E9 mov eax, dword ptr fs:[00000030h]		1_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A403E9 mov eax, dword ptr fs:[00000030h]		1_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A403E9 mov eax, dword ptr fs:[00000030h]		1_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A403E9 mov eax, dword ptr fs:[00000030h]		1_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A403E9 mov eax, dword ptr fs:[00000030h]		1_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A403E9 mov eax, dword ptr fs:[00000030h]		1_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A4E3F0 mov eax, dword ptr fs:[00000030h]		1_2_03A4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A4E3F0 mov eax, dword ptr fs:[00000030h]		1_2_03A4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A4E3F0 mov eax, dword ptr fs:[00000030h]		1_2_03A4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A663FF mov eax, dword ptr fs:[00000030h]		1_2_03A663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AEC3CD mov eax, dword ptr fs:[00000030h]		1_2_03AEC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]		1_2_03A3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]		1_2_03A3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]		1_2_03A3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]		1_2_03A3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]		1_2_03A3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]		1_2_03A3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A383C0 mov eax, dword ptr fs:[00000030h]		1_2_03A383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A383C0 mov eax, dword ptr fs:[00000030h]		1_2_03A383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A383C0 mov eax, dword ptr fs:[00000030h]		1_2_03A383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A383C0 mov eax, dword ptr fs:[00000030h]		1_2_03A383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB63C0 mov eax, dword ptr fs:[00000030h]		1_2_03AB63C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ADE3DB mov eax, dword ptr fs:[00000030h]		1_2_03ADE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ADE3DB mov eax, dword ptr fs:[00000030h]		1_2_03ADE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ADE3DB mov ecx, dword ptr fs:[00000030h]		1_2_03ADE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ADE3DB mov eax, dword ptr fs:[00000030h]		1_2_03ADE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AD43D4 mov eax, dword ptr fs:[00000030h]		1_2_03AD43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AD43D4 mov eax, dword ptr fs:[00000030h]		1_2_03AD43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6A30B mov eax, dword ptr fs:[00000030h]		1_2_03A6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6A30B mov eax, dword ptr fs:[00000030h]		1_2_03A6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6A30B mov eax, dword ptr fs:[00000030h]		1_2_03A6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A2C310 mov ecx, dword ptr fs:[00000030h]		1_2_03A2C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A50310 mov ecx, dword ptr fs:[00000030h]		1_2_03A50310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AD437C mov eax, dword ptr fs:[00000030h]		1_2_03AD437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB2349 mov eax, dword ptr fs:[00000030h]		1_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB2349 mov eax, dword ptr fs:[00000030h]		1_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB2349 mov eax, dword ptr fs:[00000030h]		1_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB2349 mov eax, dword ptr fs:[00000030h]		1_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB2349 mov eax, dword ptr fs:[00000030h]		1_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB2349 mov eax, dword ptr fs:[00000030h]		1_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB2349 mov eax, dword ptr fs:[00000030h]		1_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB2349 mov eax, dword ptr fs:[00000030h]		1_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB2349 mov eax, dword ptr fs:[00000030h]		1_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB2349 mov eax, dword ptr fs:[00000030h]		1_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB2349 mov eax, dword ptr fs:[00000030h]		1_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB2349 mov eax, dword ptr fs:[00000030h]		1_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB2349 mov eax, dword ptr fs:[00000030h]		1_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB2349 mov eax, dword ptr fs:[00000030h]		1_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB2349 mov eax, dword ptr fs:[00000030h]		1_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB035C mov eax, dword ptr fs:[00000030h]		1_2_03AB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB035C mov eax, dword ptr fs:[00000030h]		1_2_03AB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB035C mov eax, dword ptr fs:[00000030h]		1_2_03AB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB035C mov ecx, dword ptr fs:[00000030h]		1_2_03AB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB035C mov eax, dword ptr fs:[00000030h]		1_2_03AB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB035C mov eax, dword ptr fs:[00000030h]		1_2_03AB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AFA352 mov eax, dword ptr fs:[00000030h]		1_2_03AFA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AD8350 mov ecx, dword ptr fs:[00000030h]		1_2_03AD8350
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A402A0 mov eax, dword ptr fs:[00000030h]		1_2_03A402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A402A0 mov eax, dword ptr fs:[00000030h]		1_2_03A402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AC62A0 mov eax, dword ptr fs:[00000030h]		1_2_03AC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AC62A0 mov ecx, dword ptr fs:[00000030h]		1_2_03AC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AC62A0 mov eax, dword ptr fs:[00000030h]		1_2_03AC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AC62A0 mov eax, dword ptr fs:[00000030h]		1_2_03AC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AC62A0 mov eax, dword ptr fs:[00000030h]		1_2_03AC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AC62A0 mov eax, dword ptr fs:[00000030h]		1_2_03AC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6E284 mov eax, dword ptr fs:[00000030h]		1_2_03A6E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6E284 mov eax, dword ptr fs:[00000030h]		1_2_03A6E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB0283 mov eax, dword ptr fs:[00000030h]		1_2_03AB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB0283 mov eax, dword ptr fs:[00000030h]		1_2_03AB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB0283 mov eax, dword ptr fs:[00000030h]		1_2_03AB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A402E1 mov eax, dword ptr fs:[00000030h]		1_2_03A402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A402E1 mov eax, dword ptr fs:[00000030h]		1_2_03A402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A402E1 mov eax, dword ptr fs:[00000030h]		1_2_03A402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3A2C3 mov eax, dword ptr fs:[00000030h]		1_2_03A3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3A2C3 mov eax, dword ptr fs:[00000030h]		1_2_03A3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3A2C3 mov eax, dword ptr fs:[00000030h]		1_2_03A3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3A2C3 mov eax, dword ptr fs:[00000030h]		1_2_03A3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3A2C3 mov eax, dword ptr fs:[00000030h]		1_2_03A3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A2823B mov eax, dword ptr fs:[00000030h]		1_2_03A2823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A34260 mov eax, dword ptr fs:[00000030h]		1_2_03A34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A34260 mov eax, dword ptr fs:[00000030h]		1_2_03A34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A34260 mov eax, dword ptr fs:[00000030h]		1_2_03A34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A2826B mov eax, dword ptr fs:[00000030h]		1_2_03A2826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AE0274 mov eax, dword ptr fs:[00000030h]		1_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AE0274 mov eax, dword ptr fs:[00000030h]		1_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AE0274 mov eax, dword ptr fs:[00000030h]		1_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AE0274 mov eax, dword ptr fs:[00000030h]		1_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AE0274 mov eax, dword ptr fs:[00000030h]		1_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AE0274 mov eax, dword ptr fs:[00000030h]		1_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AE0274 mov eax, dword ptr fs:[00000030h]		1_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AE0274 mov eax, dword ptr fs:[00000030h]		1_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AE0274 mov eax, dword ptr fs:[00000030h]		1_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AE0274 mov eax, dword ptr fs:[00000030h]		1_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AE0274 mov eax, dword ptr fs:[00000030h]		1_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AE0274 mov eax, dword ptr fs:[00000030h]		1_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB8243 mov eax, dword ptr fs:[00000030h]		1_2_03AB8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB8243 mov ecx, dword ptr fs:[00000030h]		1_2_03AB8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A2A250 mov eax, dword ptr fs:[00000030h]		1_2_03A2A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A36259 mov eax, dword ptr fs:[00000030h]		1_2_03A36259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AEA250 mov eax, dword ptr fs:[00000030h]		1_2_03AEA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AEA250 mov eax, dword ptr fs:[00000030h]		1_2_03AEA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A70185 mov eax, dword ptr fs:[00000030h]		1_2_03A70185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AEC188 mov eax, dword ptr fs:[00000030h]		1_2_03AEC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AEC188 mov eax, dword ptr fs:[00000030h]		1_2_03AEC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AD4180 mov eax, dword ptr fs:[00000030h]		1_2_03AD4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AD4180 mov eax, dword ptr fs:[00000030h]		1_2_03AD4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB019F mov eax, dword ptr fs:[00000030h]		1_2_03AB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB019F mov eax, dword ptr fs:[00000030h]		1_2_03AB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB019F mov eax, dword ptr fs:[00000030h]		1_2_03AB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB019F mov eax, dword ptr fs:[00000030h]		1_2_03AB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A2A197 mov eax, dword ptr fs:[00000030h]		1_2_03A2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A2A197 mov eax, dword ptr fs:[00000030h]		1_2_03A2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A2A197 mov eax, dword ptr fs:[00000030h]		1_2_03A2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B061E5 mov eax, dword ptr fs:[00000030h]		1_2_03B061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A601F8 mov eax, dword ptr fs:[00000030h]		1_2_03A601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AF61C3 mov eax, dword ptr fs:[00000030h]		1_2_03AF61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AF61C3 mov eax, dword ptr fs:[00000030h]		1_2_03AF61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AAE1D0 mov eax, dword ptr fs:[00000030h]		1_2_03AAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AAE1D0 mov eax, dword ptr fs:[00000030h]		1_2_03AAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AAE1D0 mov ecx, dword ptr fs:[00000030h]		1_2_03AAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AAE1D0 mov eax, dword ptr fs:[00000030h]		1_2_03AAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AAE1D0 mov eax, dword ptr fs:[00000030h]		1_2_03AAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A60124 mov eax, dword ptr fs:[00000030h]		1_2_03A60124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ADE10E mov eax, dword ptr fs:[00000030h]		1_2_03ADE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ADE10E mov ecx, dword ptr fs:[00000030h]		1_2_03ADE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ADE10E mov eax, dword ptr fs:[00000030h]		1_2_03ADE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ADE10E mov eax, dword ptr fs:[00000030h]		1_2_03ADE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ADE10E mov ecx, dword ptr fs:[00000030h]		1_2_03ADE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ADE10E mov eax, dword ptr fs:[00000030h]		1_2_03ADE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ADE10E mov eax, dword ptr fs:[00000030h]		1_2_03ADE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ADE10E mov ecx, dword ptr fs:[00000030h]		1_2_03ADE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ADE10E mov eax, dword ptr fs:[00000030h]		1_2_03ADE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ADE10E mov ecx, dword ptr fs:[00000030h]		1_2_03ADE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ADA118 mov ecx, dword ptr fs:[00000030h]		1_2_03ADA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ADA118 mov eax, dword ptr fs:[00000030h]		1_2_03ADA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ADA118 mov eax, dword ptr fs:[00000030h]		1_2_03ADA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ADA118 mov eax, dword ptr fs:[00000030h]		1_2_03ADA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AF0115 mov eax, dword ptr fs:[00000030h]		1_2_03AF0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AC4144 mov eax, dword ptr fs:[00000030h]		1_2_03AC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AC4144 mov eax, dword ptr fs:[00000030h]		1_2_03AC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AC4144 mov ecx, dword ptr fs:[00000030h]		1_2_03AC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AC4144 mov eax, dword ptr fs:[00000030h]		1_2_03AC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AC4144 mov eax, dword ptr fs:[00000030h]		1_2_03AC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A2C156 mov eax, dword ptr fs:[00000030h]		1_2_03A2C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AC8158 mov eax, dword ptr fs:[00000030h]		1_2_03AC8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A36154 mov eax, dword ptr fs:[00000030h]		1_2_03A36154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A36154 mov eax, dword ptr fs:[00000030h]		1_2_03A36154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AC80A8 mov eax, dword ptr fs:[00000030h]		1_2_03AC80A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AF60B8 mov eax, dword ptr fs:[00000030h]		1_2_03AF60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AF60B8 mov ecx, dword ptr fs:[00000030h]		1_2_03AF60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3208A mov eax, dword ptr fs:[00000030h]		1_2_03A3208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A2A0E3 mov ecx, dword ptr fs:[00000030h]		1_2_03A2A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A380E9 mov eax, dword ptr fs:[00000030h]		1_2_03A380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB60E0 mov eax, dword ptr fs:[00000030h]		1_2_03AB60E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A2C0F0 mov eax, dword ptr fs:[00000030h]		1_2_03A2C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A720F0 mov ecx, dword ptr fs:[00000030h]		1_2_03A720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB20DE mov eax, dword ptr fs:[00000030h]		1_2_03AB20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A2A020 mov eax, dword ptr fs:[00000030h]		1_2_03A2A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A2C020 mov eax, dword ptr fs:[00000030h]		1_2_03A2C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AC6030 mov eax, dword ptr fs:[00000030h]		1_2_03AC6030
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB4000 mov ecx, dword ptr fs:[00000030h]		1_2_03AB4000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AD2000 mov eax, dword ptr fs:[00000030h]		1_2_03AD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AD2000 mov eax, dword ptr fs:[00000030h]		1_2_03AD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AD2000 mov eax, dword ptr fs:[00000030h]		1_2_03AD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AD2000 mov eax, dword ptr fs:[00000030h]		1_2_03AD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AD2000 mov eax, dword ptr fs:[00000030h]		1_2_03AD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AD2000 mov eax, dword ptr fs:[00000030h]		1_2_03AD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AD2000 mov eax, dword ptr fs:[00000030h]		1_2_03AD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AD2000 mov eax, dword ptr fs:[00000030h]		1_2_03AD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A4E016 mov eax, dword ptr fs:[00000030h]		1_2_03A4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A4E016 mov eax, dword ptr fs:[00000030h]		1_2_03A4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A4E016 mov eax, dword ptr fs:[00000030h]		1_2_03A4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A4E016 mov eax, dword ptr fs:[00000030h]		1_2_03A4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5C073 mov eax, dword ptr fs:[00000030h]		1_2_03A5C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A32050 mov eax, dword ptr fs:[00000030h]		1_2_03A32050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB6050 mov eax, dword ptr fs:[00000030h]		1_2_03AB6050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A307AF mov eax, dword ptr fs:[00000030h]		1_2_03A307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AE47A0 mov eax, dword ptr fs:[00000030h]		1_2_03AE47A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AD678E mov eax, dword ptr fs:[00000030h]		1_2_03AD678E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A527ED mov eax, dword ptr fs:[00000030h]		1_2_03A527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A527ED mov eax, dword ptr fs:[00000030h]		1_2_03A527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A527ED mov eax, dword ptr fs:[00000030h]		1_2_03A527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ABE7E1 mov eax, dword ptr fs:[00000030h]		1_2_03ABE7E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A347FB mov eax, dword ptr fs:[00000030h]		1_2_03A347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A347FB mov eax, dword ptr fs:[00000030h]		1_2_03A347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3C7C0 mov eax, dword ptr fs:[00000030h]		1_2_03A3C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB07C3 mov eax, dword ptr fs:[00000030h]		1_2_03AB07C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6C720 mov eax, dword ptr fs:[00000030h]		1_2_03A6C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6C720 mov eax, dword ptr fs:[00000030h]		1_2_03A6C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6273C mov eax, dword ptr fs:[00000030h]		1_2_03A6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6273C mov ecx, dword ptr fs:[00000030h]		1_2_03A6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6273C mov eax, dword ptr fs:[00000030h]		1_2_03A6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AAC730 mov eax, dword ptr fs:[00000030h]		1_2_03AAC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6C700 mov eax, dword ptr fs:[00000030h]		1_2_03A6C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A30710 mov eax, dword ptr fs:[00000030h]		1_2_03A30710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A60710 mov eax, dword ptr fs:[00000030h]		1_2_03A60710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A38770 mov eax, dword ptr fs:[00000030h]		1_2_03A38770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40770 mov eax, dword ptr fs:[00000030h]		1_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40770 mov eax, dword ptr fs:[00000030h]		1_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40770 mov eax, dword ptr fs:[00000030h]		1_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40770 mov eax, dword ptr fs:[00000030h]		1_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40770 mov eax, dword ptr fs:[00000030h]		1_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40770 mov eax, dword ptr fs:[00000030h]		1_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40770 mov eax, dword ptr fs:[00000030h]		1_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40770 mov eax, dword ptr fs:[00000030h]		1_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40770 mov eax, dword ptr fs:[00000030h]		1_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40770 mov eax, dword ptr fs:[00000030h]		1_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40770 mov eax, dword ptr fs:[00000030h]		1_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40770 mov eax, dword ptr fs:[00000030h]		1_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6674D mov esi, dword ptr fs:[00000030h]		1_2_03A6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6674D mov eax, dword ptr fs:[00000030h]		1_2_03A6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6674D mov eax, dword ptr fs:[00000030h]		1_2_03A6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A30750 mov eax, dword ptr fs:[00000030h]		1_2_03A30750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ABE75D mov eax, dword ptr fs:[00000030h]		1_2_03ABE75D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72750 mov eax, dword ptr fs:[00000030h]		1_2_03A72750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72750 mov eax, dword ptr fs:[00000030h]		1_2_03A72750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB4755 mov eax, dword ptr fs:[00000030h]		1_2_03AB4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6C6A6 mov eax, dword ptr fs:[00000030h]		1_2_03A6C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A666B0 mov eax, dword ptr fs:[00000030h]		1_2_03A666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A34690 mov eax, dword ptr fs:[00000030h]		1_2_03A34690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A34690 mov eax, dword ptr fs:[00000030h]		1_2_03A34690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AAE6F2 mov eax, dword ptr fs:[00000030h]		1_2_03AAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AAE6F2 mov eax, dword ptr fs:[00000030h]		1_2_03AAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AAE6F2 mov eax, dword ptr fs:[00000030h]		1_2_03AAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AAE6F2 mov eax, dword ptr fs:[00000030h]		1_2_03AAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB06F1 mov eax, dword ptr fs:[00000030h]		1_2_03AB06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB06F1 mov eax, dword ptr fs:[00000030h]		1_2_03AB06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6A6C7 mov ebx, dword ptr fs:[00000030h]		1_2_03A6A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6A6C7 mov eax, dword ptr fs:[00000030h]		1_2_03A6A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A4E627 mov eax, dword ptr fs:[00000030h]		1_2_03A4E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A66620 mov eax, dword ptr fs:[00000030h]		1_2_03A66620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A68620 mov eax, dword ptr fs:[00000030h]		1_2_03A68620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3262C mov eax, dword ptr fs:[00000030h]		1_2_03A3262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AAE609 mov eax, dword ptr fs:[00000030h]		1_2_03AAE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A4260B mov eax, dword ptr fs:[00000030h]		1_2_03A4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A4260B mov eax, dword ptr fs:[00000030h]		1_2_03A4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A4260B mov eax, dword ptr fs:[00000030h]		1_2_03A4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A4260B mov eax, dword ptr fs:[00000030h]		1_2_03A4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A4260B mov eax, dword ptr fs:[00000030h]		1_2_03A4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A4260B mov eax, dword ptr fs:[00000030h]		1_2_03A4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A4260B mov eax, dword ptr fs:[00000030h]		1_2_03A4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72619 mov eax, dword ptr fs:[00000030h]		1_2_03A72619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AF866E mov eax, dword ptr fs:[00000030h]		1_2_03AF866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AF866E mov eax, dword ptr fs:[00000030h]		1_2_03AF866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6A660 mov eax, dword ptr fs:[00000030h]		1_2_03A6A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6A660 mov eax, dword ptr fs:[00000030h]		1_2_03A6A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A62674 mov eax, dword ptr fs:[00000030h]		1_2_03A62674
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A4C640 mov eax, dword ptr fs:[00000030h]		1_2_03A4C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB05A7 mov eax, dword ptr fs:[00000030h]		1_2_03AB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB05A7 mov eax, dword ptr fs:[00000030h]		1_2_03AB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB05A7 mov eax, dword ptr fs:[00000030h]		1_2_03AB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A545B1 mov eax, dword ptr fs:[00000030h]		1_2_03A545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A545B1 mov eax, dword ptr fs:[00000030h]		1_2_03A545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A32582 mov eax, dword ptr fs:[00000030h]		1_2_03A32582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A32582 mov ecx, dword ptr fs:[00000030h]		1_2_03A32582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A64588 mov eax, dword ptr fs:[00000030h]		1_2_03A64588
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6E59C mov eax, dword ptr fs:[00000030h]		1_2_03A6E59C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]		1_2_03A5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]		1_2_03A5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]		1_2_03A5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]		1_2_03A5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]		1_2_03A5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]		1_2_03A5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]		1_2_03A5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]		1_2_03A5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A325E0 mov eax, dword ptr fs:[00000030h]		1_2_03A325E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6C5ED mov eax, dword ptr fs:[00000030h]		1_2_03A6C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6C5ED mov eax, dword ptr fs:[00000030h]		1_2_03A6C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6E5CF mov eax, dword ptr fs:[00000030h]		1_2_03A6E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6E5CF mov eax, dword ptr fs:[00000030h]		1_2_03A6E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A365D0 mov eax, dword ptr fs:[00000030h]		1_2_03A365D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6A5D0 mov eax, dword ptr fs:[00000030h]		1_2_03A6A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6A5D0 mov eax, dword ptr fs:[00000030h]		1_2_03A6A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40535 mov eax, dword ptr fs:[00000030h]		1_2_03A40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40535 mov eax, dword ptr fs:[00000030h]		1_2_03A40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40535 mov eax, dword ptr fs:[00000030h]		1_2_03A40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40535 mov eax, dword ptr fs:[00000030h]		1_2_03A40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40535 mov eax, dword ptr fs:[00000030h]		1_2_03A40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40535 mov eax, dword ptr fs:[00000030h]		1_2_03A40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5E53E mov eax, dword ptr fs:[00000030h]		1_2_03A5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5E53E mov eax, dword ptr fs:[00000030h]		1_2_03A5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5E53E mov eax, dword ptr fs:[00000030h]		1_2_03A5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5E53E mov eax, dword ptr fs:[00000030h]		1_2_03A5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5E53E mov eax, dword ptr fs:[00000030h]		1_2_03A5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AC6500 mov eax, dword ptr fs:[00000030h]		1_2_03AC6500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B04500 mov eax, dword ptr fs:[00000030h]		1_2_03B04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B04500 mov eax, dword ptr fs:[00000030h]		1_2_03B04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B04500 mov eax, dword ptr fs:[00000030h]		1_2_03B04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B04500 mov eax, dword ptr fs:[00000030h]		1_2_03B04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B04500 mov eax, dword ptr fs:[00000030h]		1_2_03B04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B04500 mov eax, dword ptr fs:[00000030h]		1_2_03B04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B04500 mov eax, dword ptr fs:[00000030h]		1_2_03B04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6656A mov eax, dword ptr fs:[00000030h]		1_2_03A6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6656A mov eax, dword ptr fs:[00000030h]		1_2_03A6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6656A mov eax, dword ptr fs:[00000030h]		1_2_03A6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A38550 mov eax, dword ptr fs:[00000030h]		1_2_03A38550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A38550 mov eax, dword ptr fs:[00000030h]		1_2_03A38550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A364AB mov eax, dword ptr fs:[00000030h]		1_2_03A364AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A644B0 mov ecx, dword ptr fs:[00000030h]		1_2_03A644B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ABA4B0 mov eax, dword ptr fs:[00000030h]		1_2_03ABA4B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AEA49A mov eax, dword ptr fs:[00000030h]		1_2_03AEA49A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A304E5 mov ecx, dword ptr fs:[00000030h]		1_2_03A304E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A2E420 mov eax, dword ptr fs:[00000030h]		1_2_03A2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A2E420 mov eax, dword ptr fs:[00000030h]		1_2_03A2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A2E420 mov eax, dword ptr fs:[00000030h]		1_2_03A2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A2C427 mov eax, dword ptr fs:[00000030h]		1_2_03A2C427
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB6420 mov eax, dword ptr fs:[00000030h]		1_2_03AB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB6420 mov eax, dword ptr fs:[00000030h]		1_2_03AB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB6420 mov eax, dword ptr fs:[00000030h]		1_2_03AB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB6420 mov eax, dword ptr fs:[00000030h]		1_2_03AB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB6420 mov eax, dword ptr fs:[00000030h]		1_2_03AB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB6420 mov eax, dword ptr fs:[00000030h]		1_2_03AB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB6420 mov eax, dword ptr fs:[00000030h]		1_2_03AB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6A430 mov eax, dword ptr fs:[00000030h]		1_2_03A6A430
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A68402 mov eax, dword ptr fs:[00000030h]		1_2_03A68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A68402 mov eax, dword ptr fs:[00000030h]		1_2_03A68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A68402 mov eax, dword ptr fs:[00000030h]		1_2_03A68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ABC460 mov ecx, dword ptr fs:[00000030h]		1_2_03ABC460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5A470 mov eax, dword ptr fs:[00000030h]		1_2_03A5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5A470 mov eax, dword ptr fs:[00000030h]		1_2_03A5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5A470 mov eax, dword ptr fs:[00000030h]		1_2_03A5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6E443 mov eax, dword ptr fs:[00000030h]		1_2_03A6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6E443 mov eax, dword ptr fs:[00000030h]		1_2_03A6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6E443 mov eax, dword ptr fs:[00000030h]		1_2_03A6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6E443 mov eax, dword ptr fs:[00000030h]		1_2_03A6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6E443 mov eax, dword ptr fs:[00000030h]		1_2_03A6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6E443 mov eax, dword ptr fs:[00000030h]		1_2_03A6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6E443 mov eax, dword ptr fs:[00000030h]		1_2_03A6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6E443 mov eax, dword ptr fs:[00000030h]		1_2_03A6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AEA456 mov eax, dword ptr fs:[00000030h]		1_2_03AEA456
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A2645D mov eax, dword ptr fs:[00000030h]		1_2_03A2645D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5245A mov eax, dword ptr fs:[00000030h]		1_2_03A5245A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40BBE mov eax, dword ptr fs:[00000030h]		1_2_03A40BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40BBE mov eax, dword ptr fs:[00000030h]		1_2_03A40BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AE4BB0 mov eax, dword ptr fs:[00000030h]		1_2_03AE4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AE4BB0 mov eax, dword ptr fs:[00000030h]		1_2_03AE4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A38BF0 mov eax, dword ptr fs:[00000030h]		1_2_03A38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A38BF0 mov eax, dword ptr fs:[00000030h]		1_2_03A38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A38BF0 mov eax, dword ptr fs:[00000030h]		1_2_03A38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5EBFC mov eax, dword ptr fs:[00000030h]		1_2_03A5EBFC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ABCBF0 mov eax, dword ptr fs:[00000030h]		1_2_03ABCBF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A50BCB mov eax, dword ptr fs:[00000030h]		1_2_03A50BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A50BCB mov eax, dword ptr fs:[00000030h]		1_2_03A50BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A50BCB mov eax, dword ptr fs:[00000030h]		1_2_03A50BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A30BCD mov eax, dword ptr fs:[00000030h]		1_2_03A30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A30BCD mov eax, dword ptr fs:[00000030h]		1_2_03A30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A30BCD mov eax, dword ptr fs:[00000030h]		1_2_03A30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ADEBD0 mov eax, dword ptr fs:[00000030h]		1_2_03ADEBD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5EB20 mov eax, dword ptr fs:[00000030h]		1_2_03A5EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5EB20 mov eax, dword ptr fs:[00000030h]		1_2_03A5EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AF8B28 mov eax, dword ptr fs:[00000030h]		1_2_03AF8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AF8B28 mov eax, dword ptr fs:[00000030h]		1_2_03AF8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AAEB1D mov eax, dword ptr fs:[00000030h]		1_2_03AAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AAEB1D mov eax, dword ptr fs:[00000030h]		1_2_03AAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AAEB1D mov eax, dword ptr fs:[00000030h]		1_2_03AAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AAEB1D mov eax, dword ptr fs:[00000030h]		1_2_03AAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AAEB1D mov eax, dword ptr fs:[00000030h]		1_2_03AAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AAEB1D mov eax, dword ptr fs:[00000030h]		1_2_03AAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AAEB1D mov eax, dword ptr fs:[00000030h]		1_2_03AAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AAEB1D mov eax, dword ptr fs:[00000030h]		1_2_03AAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AAEB1D mov eax, dword ptr fs:[00000030h]		1_2_03AAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A2CB7E mov eax, dword ptr fs:[00000030h]		1_2_03A2CB7E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AE4B4B mov eax, dword ptr fs:[00000030h]		1_2_03AE4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AE4B4B mov eax, dword ptr fs:[00000030h]		1_2_03AE4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AC6B40 mov eax, dword ptr fs:[00000030h]		1_2_03AC6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AC6B40 mov eax, dword ptr fs:[00000030h]		1_2_03AC6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AFAB40 mov eax, dword ptr fs:[00000030h]		1_2_03AFAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AD8B42 mov eax, dword ptr fs:[00000030h]		1_2_03AD8B42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ADEB50 mov eax, dword ptr fs:[00000030h]		1_2_03ADEB50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A38AA0 mov eax, dword ptr fs:[00000030h]		1_2_03A38AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A38AA0 mov eax, dword ptr fs:[00000030h]		1_2_03A38AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A86AA4 mov eax, dword ptr fs:[00000030h]		1_2_03A86AA4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3EA80 mov eax, dword ptr fs:[00000030h]		1_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3EA80 mov eax, dword ptr fs:[00000030h]		1_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3EA80 mov eax, dword ptr fs:[00000030h]		1_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3EA80 mov eax, dword ptr fs:[00000030h]		1_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3EA80 mov eax, dword ptr fs:[00000030h]		1_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3EA80 mov eax, dword ptr fs:[00000030h]		1_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3EA80 mov eax, dword ptr fs:[00000030h]		1_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3EA80 mov eax, dword ptr fs:[00000030h]		1_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3EA80 mov eax, dword ptr fs:[00000030h]		1_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B04A80 mov eax, dword ptr fs:[00000030h]		1_2_03B04A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A68A90 mov edx, dword ptr fs:[00000030h]		1_2_03A68A90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6AAEE mov eax, dword ptr fs:[00000030h]		1_2_03A6AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6AAEE mov eax, dword ptr fs:[00000030h]		1_2_03A6AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A86ACC mov eax, dword ptr fs:[00000030h]		1_2_03A86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A86ACC mov eax, dword ptr fs:[00000030h]		1_2_03A86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A86ACC mov eax, dword ptr fs:[00000030h]		1_2_03A86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A30AD0 mov eax, dword ptr fs:[00000030h]		1_2_03A30AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A64AD0 mov eax, dword ptr fs:[00000030h]		1_2_03A64AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A64AD0 mov eax, dword ptr fs:[00000030h]		1_2_03A64AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6CA24 mov eax, dword ptr fs:[00000030h]		1_2_03A6CA24
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5EA2E mov eax, dword ptr fs:[00000030h]		1_2_03A5EA2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A54A35 mov eax, dword ptr fs:[00000030h]		1_2_03A54A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A54A35 mov eax, dword ptr fs:[00000030h]		1_2_03A54A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6CA38 mov eax, dword ptr fs:[00000030h]		1_2_03A6CA38
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ABCA11 mov eax, dword ptr fs:[00000030h]		1_2_03ABCA11
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6CA6F mov eax, dword ptr fs:[00000030h]		1_2_03A6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6CA6F mov eax, dword ptr fs:[00000030h]		1_2_03A6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6CA6F mov eax, dword ptr fs:[00000030h]		1_2_03A6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ADEA60 mov eax, dword ptr fs:[00000030h]		1_2_03ADEA60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AACA72 mov eax, dword ptr fs:[00000030h]		1_2_03AACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AACA72 mov eax, dword ptr fs:[00000030h]		1_2_03AACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A36A50 mov eax, dword ptr fs:[00000030h]		1_2_03A36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A36A50 mov eax, dword ptr fs:[00000030h]		1_2_03A36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A36A50 mov eax, dword ptr fs:[00000030h]		1_2_03A36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A36A50 mov eax, dword ptr fs:[00000030h]		1_2_03A36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A36A50 mov eax, dword ptr fs:[00000030h]		1_2_03A36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A36A50 mov eax, dword ptr fs:[00000030h]		1_2_03A36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A36A50 mov eax, dword ptr fs:[00000030h]		1_2_03A36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40A5B mov eax, dword ptr fs:[00000030h]		1_2_03A40A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40A5B mov eax, dword ptr fs:[00000030h]		1_2_03A40A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A429A0 mov eax, dword ptr fs:[00000030h]		1_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A429A0 mov eax, dword ptr fs:[00000030h]		1_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A429A0 mov eax, dword ptr fs:[00000030h]		1_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A429A0 mov eax, dword ptr fs:[00000030h]		1_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A429A0 mov eax, dword ptr fs:[00000030h]		1_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A429A0 mov eax, dword ptr fs:[00000030h]		1_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A429A0 mov eax, dword ptr fs:[00000030h]		1_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A429A0 mov eax, dword ptr fs:[00000030h]		1_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A429A0 mov eax, dword ptr fs:[00000030h]		1_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A429A0 mov eax, dword ptr fs:[00000030h]		1_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A429A0 mov eax, dword ptr fs:[00000030h]		1_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A429A0 mov eax, dword ptr fs:[00000030h]		1_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A429A0 mov eax, dword ptr fs:[00000030h]		1_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A309AD mov eax, dword ptr fs:[00000030h]		1_2_03A309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A309AD mov eax, dword ptr fs:[00000030h]		1_2_03A309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB89B3 mov esi, dword ptr fs:[00000030h]		1_2_03AB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB89B3 mov eax, dword ptr fs:[00000030h]		1_2_03AB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB89B3 mov eax, dword ptr fs:[00000030h]		1_2_03AB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ABE9E0 mov eax, dword ptr fs:[00000030h]		1_2_03ABE9E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A629F9 mov eax, dword ptr fs:[00000030h]		1_2_03A629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A629F9 mov eax, dword ptr fs:[00000030h]		1_2_03A629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AC69C0 mov eax, dword ptr fs:[00000030h]		1_2_03AC69C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3A9D0 mov eax, dword ptr fs:[00000030h]		1_2_03A3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3A9D0 mov eax, dword ptr fs:[00000030h]		1_2_03A3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3A9D0 mov eax, dword ptr fs:[00000030h]		1_2_03A3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3A9D0 mov eax, dword ptr fs:[00000030h]		1_2_03A3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3A9D0 mov eax, dword ptr fs:[00000030h]		1_2_03A3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3A9D0 mov eax, dword ptr fs:[00000030h]		1_2_03A3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A649D0 mov eax, dword ptr fs:[00000030h]		1_2_03A649D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AFA9D3 mov eax, dword ptr fs:[00000030h]		1_2_03AFA9D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB892A mov eax, dword ptr fs:[00000030h]		1_2_03AB892A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AC892B mov eax, dword ptr fs:[00000030h]		1_2_03AC892B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AAE908 mov eax, dword ptr fs:[00000030h]		1_2_03AAE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AAE908 mov eax, dword ptr fs:[00000030h]		1_2_03AAE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ABC912 mov eax, dword ptr fs:[00000030h]		1_2_03ABC912
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A28918 mov eax, dword ptr fs:[00000030h]		1_2_03A28918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A28918 mov eax, dword ptr fs:[00000030h]		1_2_03A28918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A56962 mov eax, dword ptr fs:[00000030h]		1_2_03A56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A56962 mov eax, dword ptr fs:[00000030h]		1_2_03A56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A56962 mov eax, dword ptr fs:[00000030h]		1_2_03A56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A7096E mov eax, dword ptr fs:[00000030h]		1_2_03A7096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A7096E mov edx, dword ptr fs:[00000030h]		1_2_03A7096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A7096E mov eax, dword ptr fs:[00000030h]		1_2_03A7096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AD4978 mov eax, dword ptr fs:[00000030h]		1_2_03AD4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AD4978 mov eax, dword ptr fs:[00000030h]		1_2_03AD4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ABC97C mov eax, dword ptr fs:[00000030h]		1_2_03ABC97C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB0946 mov eax, dword ptr fs:[00000030h]		1_2_03AB0946
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A30887 mov eax, dword ptr fs:[00000030h]		1_2_03A30887
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ABC89D mov eax, dword ptr fs:[00000030h]		1_2_03ABC89D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AFA8E4 mov eax, dword ptr fs:[00000030h]		1_2_03AFA8E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6C8F9 mov eax, dword ptr fs:[00000030h]		1_2_03A6C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6C8F9 mov eax, dword ptr fs:[00000030h]		1_2_03A6C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5E8C0 mov eax, dword ptr fs:[00000030h]		1_2_03A5E8C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A52835 mov eax, dword ptr fs:[00000030h]		1_2_03A52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A52835 mov eax, dword ptr fs:[00000030h]		1_2_03A52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A52835 mov eax, dword ptr fs:[00000030h]		1_2_03A52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A52835 mov ecx, dword ptr fs:[00000030h]		1_2_03A52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A52835 mov eax, dword ptr fs:[00000030h]		1_2_03A52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A52835 mov eax, dword ptr fs:[00000030h]		1_2_03A52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6A830 mov eax, dword ptr fs:[00000030h]		1_2_03A6A830
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AD483A mov eax, dword ptr fs:[00000030h]		1_2_03AD483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AD483A mov eax, dword ptr fs:[00000030h]		1_2_03AD483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ABC810 mov eax, dword ptr fs:[00000030h]		1_2_03ABC810
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ABE872 mov eax, dword ptr fs:[00000030h]		1_2_03ABE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ABE872 mov eax, dword ptr fs:[00000030h]		1_2_03ABE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AC6870 mov eax, dword ptr fs:[00000030h]		1_2_03AC6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AC6870 mov eax, dword ptr fs:[00000030h]		1_2_03AC6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A42840 mov ecx, dword ptr fs:[00000030h]		1_2_03A42840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A60854 mov eax, dword ptr fs:[00000030h]		1_2_03A60854
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A34859 mov eax, dword ptr fs:[00000030h]		1_2_03A34859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A34859 mov eax, dword ptr fs:[00000030h]		1_2_03A34859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6CF80 mov eax, dword ptr fs:[00000030h]		1_2_03A6CF80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A62F98 mov eax, dword ptr fs:[00000030h]		1_2_03A62F98
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A62F98 mov eax, dword ptr fs:[00000030h]		1_2_03A62F98
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A4CFE0 mov eax, dword ptr fs:[00000030h]		1_2_03A4CFE0

Source: C:\Users\user\Desktop\RFQ details folder.exe

Code function: 0_2_00DB80A9 GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,

0_2_00DB80A9

Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00D8A155 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00D8A155
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00D8A124 SetUnhandledExceptionFilter,		0_2_00D8A124

HIPS / PFW / Operating System Protection Evasion

Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	NtCreateFile: Direct from: 0x77752FEC			Jump to behavior
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	NtOpenFile: Direct from: 0x77752DCC			Jump to behavior
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	NtSetInformationThread: Direct from: 0x777463F9			Jump to behavior
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	NtQueryInformationToken: Direct from: 0x77752CAC			Jump to behavior
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	NtTerminateThread: Direct from: 0x77752FCC			Jump to behavior
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	NtProtectVirtualMemory: Direct from: 0x77752F9C			Jump to behavior
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	NtSetInformationProcess: Direct from: 0x77752C5C			Jump to behavior
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	NtNotifyChangeKey: Direct from: 0x77753C2C			Jump to behavior
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	NtOpenKeyEx: Direct from: 0x77752B9C			Jump to behavior
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	NtOpenSection: Direct from: 0x77752E0C			Jump to behavior
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	NtAllocateVirtualMemory: Direct from: 0x777548EC			Jump to behavior
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	NtQueryVolumeInformationFile: Direct from: 0x77752F2C			Jump to behavior
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	NtQuerySystemInformation: Direct from: 0x777548CC			Jump to behavior
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	NtAllocateVirtualMemory: Direct from: 0x77752BEC			Jump to behavior
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	NtDeviceIoControlFile: Direct from: 0x77752AEC			Jump to behavior
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	NtCreateUserProcess: Direct from: 0x7775371C			Jump to behavior
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	NtWriteVirtualMemory: Direct from: 0x7775490C			Jump to behavior
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	NtQueryInformationProcess: Direct from: 0x77752C26			Jump to behavior
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	NtResumeThread: Direct from: 0x77752FBC			Jump to behavior
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	NtCreateKey: Direct from: 0x77752C6C			Jump to behavior
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	NtReadVirtualMemory: Direct from: 0x77752E8C			Jump to behavior
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	NtSetInformationThread: Direct from: 0x77752B4C			Jump to behavior
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	NtQueryAttributesFile: Direct from: 0x77752E6C			Jump to behavior
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	NtAllocateVirtualMemory: Direct from: 0x77753C9C			Jump to behavior
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	NtClose: Direct from: 0x77752B6C
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	NtCreateMutant: Direct from: 0x777535CC			Jump to behavior
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	NtWriteVirtualMemory: Direct from: 0x77752E3C			Jump to behavior
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	NtMapViewOfSection: Direct from: 0x77752D1C			Jump to behavior
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	NtResumeThread: Direct from: 0x777536AC			Jump to behavior
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	NtReadFile: Direct from: 0x77752ADC			Jump to behavior
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	NtQuerySystemInformation: Direct from: 0x77752DFC			Jump to behavior
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	NtDelayExecution: Direct from: 0x77752DDC			Jump to behavior
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	NtAllocateVirtualMemory: Direct from: 0x77752BFC			Jump to behavior

Source: C:\Users\user\Desktop\RFQ details folder.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe protection: execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\reg.exe protection: execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Section loaded: NULL target: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe protection: read write			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Section loaded: NULL target: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe protection: execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write			Jump to behavior

Source: C:\Windows\SysWOW64\reg.exe

Thread register set: target process: 7248

Jump to behavior

Source: C:\Users\user\Desktop\RFQ details folder.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 2FEF008

Jump to behavior

Source: C:\Users\user\Desktop\RFQ details folder.exe

Code function: 0_2_00DB87B1 LogonUserW,

0_2_00DB87B1

Source: C:\Users\user\Desktop\RFQ details folder.exe

Code function: 0_2_00D63B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00D63B3A

Source: C:\Users\user\Desktop\RFQ details folder.exe

Code function: 0_2_00D648D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00D648D7

Source: C:\Users\user\Desktop\RFQ details folder.exe

Code function: 0_2_00DC4C53 mouse_event,

0_2_00DC4C53

Source: C:\Users\user\Desktop\RFQ details folder.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\RFQ details folder.exe"			Jump to behavior
Source: C:\Program Files (x86)\yDDAlOJrVlJOMgzZheStqffCErzxMCQeNFsCYZihjRALYrQJdJsTIu\99mXjPxVfM3v.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\SysWOW64\reg.exe"			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"			Jump to behavior

Source: C:\Users\user\Desktop\RFQ details folder.exe

Code function: 0_2_00DB7CAF GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00DB7CAF

Source: C:\Users\user\Desktop\RFQ details folder.exe

Code function: 0_2_00DB874B AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00DB874B

Source: RFQ details folder.exe	Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: 99mXjPxVfM3v.exe, 00000007.00000000.1301326656.0000000001A30000.00000002.00000001.00040000.00000000.sdmp, 99mXjPxVfM3v.exe, 00000007.00000002.3676909128.0000000001A31000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: XProgram Manager
Source: RFQ details folder.exe, 99mXjPxVfM3v.exe, 00000007.00000000.1301326656.0000000001A30000.00000002.00000001.00040000.00000000.sdmp, 99mXjPxVfM3v.exe, 00000007.00000002.3676909128.0000000001A31000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: 99mXjPxVfM3v.exe, 00000007.00000000.1301326656.0000000001A30000.00000002.00000001.00040000.00000000.sdmp, 99mXjPxVfM3v.exe, 00000007.00000002.3676909128.0000000001A31000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: 99mXjPxVfM3v.exe, 00000007.00000000.1301326656.0000000001A30000.00000002.00000001.00040000.00000000.sdmp, 99mXjPxVfM3v.exe, 00000007.00000002.3676909128.0000000001A31000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection

Source: C:\Users\user\Desktop\RFQ details folder.exe

Code function: 0_2_00D8862B cpuid

0_2_00D8862B

Source: C:\Users\user\Desktop\RFQ details folder.exe

Code function: 0_2_00D94E87 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00D94E87

Source: C:\Users\user\Desktop\RFQ details folder.exe

Code function: 0_2_00DA1E06 GetUserNameW,

0_2_00DA1E06

Source: C:\Users\user\Desktop\RFQ details folder.exe

Code function: 0_2_00D93F3A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00D93F3A

Source: C:\Users\user\Desktop\RFQ details folder.exe

Code function: 0_2_00D649A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00D649A0

Stealing of Sensitive Information

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1404778921.0000000003790000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3676000841.0000000003050000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3675864670.0000000003000000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1404313483.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3681688673.0000000007F20000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3675258966.0000000000A00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3677471460.0000000004EC0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1405459163.0000000005C50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\reg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data			Jump to behavior

Source: C:\Windows\SysWOW64\reg.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Jump to behavior

Source: RFQ details folder.exe	Binary or memory string: WIN_81
Source: RFQ details folder.exe	Binary or memory string: WIN_XP
Source: RFQ details folder.exe	Binary or memory string: WIN_XPe
Source: RFQ details folder.exe	Binary or memory string: WIN_VISTA
Source: RFQ details folder.exe	Binary or memory string: WIN_7
Source: RFQ details folder.exe	Binary or memory string: WIN_8
Source: RFQ details folder.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Remote Access Functionality

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1404778921.0000000003790000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3676000841.0000000003050000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3675864670.0000000003000000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1404313483.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3681688673.0000000007F20000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3675258966.0000000000A00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3677471460.0000000004EC0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1405459163.0000000005C50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00DD6283 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_00DD6283
Source: C:\Users\user\Desktop\RFQ details folder.exe	Code function: 0_2_00DD6747 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00DD6747