Windows Analysis Report
Commercial Invoice Packing list.exe

Overview

General Information

Sample name: Commercial Invoice Packing list.exe
Analysis ID: 1522687
MD5: 584c4505475c015b4a7b0b73b60a6e73
SHA1: b8abcb6fbba8aec4c83cf245fc03b522cd27d864
SHA256: bc50c75d095285bf6687dfc4e5a94d83b43514328d199f95ec1c593598ebc206
Tags: exe
Infos:

Detection

FormBook
Score: 88
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected FormBook
AI detected suspicious sample
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Maps a DLL or memory area into another process
Switches to a custom stack to bypass stack traces
Writes to foreign memory regions
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
Sigma detected: Uncommon Svchost Parent Process
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: Commercial Invoice Packing list.exe ReversingLabs: Detection: 34%
Source: Commercial Invoice Packing list.exe Virustotal: Detection: 29% Perma Link
Yara detected FormBook
Source: Yara match File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000002.1438605926.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.1438335528.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: Commercial Invoice Packing list.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: Commercial Invoice Packing list.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: Binary string: wntdll.pdbUGP source: svchost.exe, 00000002.00000003.1397508645.0000000003A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1438634394.0000000003D9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1438634394.0000000003C00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1395710369.0000000003800000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: svchost.exe, svchost.exe, 00000002.00000003.1397508645.0000000003A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1438634394.0000000003D9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1438634394.0000000003C00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1395710369.0000000003800000.00000004.00000020.00020000.00000000.sdmp

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000002.1438605926.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.1438335528.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.1438605926.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.1438335528.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: Commercial Invoice Packing list.exe
Contains functionality to call native functions
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_0042C473 NtClose, 2_2_0042C473
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C735C0 NtCreateMutant,LdrInitializeThunk, 2_2_03C735C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72B60 NtClose,LdrInitializeThunk, 2_2_03C72B60
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72DF0 NtQuerySystemInformation,LdrInitializeThunk, 2_2_03C72DF0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C74340 NtSetContextThread, 2_2_03C74340
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C73090 NtSetValueKey, 2_2_03C73090
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C73010 NtOpenDirectoryObject, 2_2_03C73010
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C74650 NtSuspendThread, 2_2_03C74650
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72BE0 NtQueryValueKey, 2_2_03C72BE0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72BF0 NtAllocateVirtualMemory, 2_2_03C72BF0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72B80 NtQueryInformationFile, 2_2_03C72B80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72BA0 NtEnumerateValueKey, 2_2_03C72BA0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72AD0 NtReadFile, 2_2_03C72AD0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72AF0 NtWriteFile, 2_2_03C72AF0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72AB0 NtWaitForSingleObject, 2_2_03C72AB0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C739B0 NtGetContextThread, 2_2_03C739B0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72FE0 NtCreateFile, 2_2_03C72FE0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72F90 NtProtectVirtualMemory, 2_2_03C72F90
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72FA0 NtQuerySection, 2_2_03C72FA0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72FB0 NtResumeThread, 2_2_03C72FB0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72F60 NtCreateProcessEx, 2_2_03C72F60
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72F30 NtCreateSection, 2_2_03C72F30
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72EE0 NtQueueApcThread, 2_2_03C72EE0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72E80 NtReadVirtualMemory, 2_2_03C72E80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72EA0 NtAdjustPrivilegesToken, 2_2_03C72EA0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72E30 NtWriteVirtualMemory, 2_2_03C72E30
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72DD0 NtDelayExecution, 2_2_03C72DD0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72DB0 NtEnumerateKey, 2_2_03C72DB0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C73D70 NtOpenThread, 2_2_03C73D70
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72D00 NtSetInformationFile, 2_2_03C72D00
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72D10 NtMapViewOfSection, 2_2_03C72D10
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C73D10 NtOpenProcessToken, 2_2_03C73D10
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72D30 NtUnmapViewOfSection, 2_2_03C72D30
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72CC0 NtQueryVirtualMemory, 2_2_03C72CC0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72CF0 NtOpenProcess, 2_2_03C72CF0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72CA0 NtQueryInformationToken, 2_2_03C72CA0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72C60 NtCreateKey, 2_2_03C72C60
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72C70 NtFreeVirtualMemory, 2_2_03C72C70
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72C00 NtQueryInformationProcess, 2_2_03C72C00
Detected potential crypto function
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_00402920 2_2_00402920
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_00401240 2_2_00401240
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_00403200 2_2_00403200
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_0042EAE3 2_2_0042EAE3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_00402410 2_2_00402410
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_0040FCAA 2_2_0040FCAA
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_0040FCB3 2_2_0040FCB3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_004045C4 2_2_004045C4
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_00402610 2_2_00402610
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_0041662E 2_2_0041662E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_00416633 2_2_00416633
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_0040FED3 2_2_0040FED3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_0040DF53 2_2_0040DF53
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4E3F0 2_2_03C4E3F0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D003E6 2_2_03D003E6
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C8739A 2_2_03C8739A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2D34C 2_2_03C2D34C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CFA352 2_2_03CFA352
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF132D 2_2_03CF132D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5B2C0 2_2_03C5B2C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE12ED 2_2_03CE12ED
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C452A0 2_2_03C452A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE0274 2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF81CC 2_2_03CF81CC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4B1B0 2_2_03C4B1B0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D001AA 2_2_03D001AA
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C7516C 2_2_03C7516C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2F172 2_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D0B16B 2_2_03D0B16B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C30100 2_2_03C30100
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDA118 2_2_03CDA118
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CEF0CC 2_2_03CEF0CC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C470C0 2_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF70E9 2_2_03CF70E9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CFF0E0 2_2_03CFF0E0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3C7C0 2_2_03C3C7C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CFF7B0 2_2_03CFF7B0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C64750 2_2_03C64750
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40770 2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF16CC 2_2_03CF16CC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5C6E0 2_2_03C5C6E0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D00591 2_2_03D00591
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDD5B0 2_2_03CDD5B0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF7571 2_2_03CF7571
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40535 2_2_03C40535
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CEE4F6 2_2_03CEE4F6
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF2446 2_2_03CF2446
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C31460 2_2_03C31460
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CFF43F 2_2_03CFF43F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF6BD7 2_2_03CF6BD7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C7DBF9 2_2_03C7DBF9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5FB80 2_2_03C5FB80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CFAB40 2_2_03CFAB40
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CFFB76 2_2_03CFFB76
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CEDAC6 2_2_03CEDAC6
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3EA80 2_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDDAAC 2_2_03CDDAAC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C85AA0 2_2_03C85AA0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CFFA49 2_2_03CFFA49
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF7A46 2_2_03CF7A46
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB3A6C 2_2_03CB3A6C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C429A0 2_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D0A9A6 2_2_03D0A9A6
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C49950 2_2_03C49950
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5B950 2_2_03C5B950
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C56962 2_2_03C56962
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C438E0 2_2_03C438E0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6E8F0 2_2_03C6E8F0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C268B8 2_2_03C268B8
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C42840 2_2_03C42840
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4A840 2_2_03C4A840
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAD800 2_2_03CAD800
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C32FC8 2_2_03C32FC8
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4CFE0 2_2_03C4CFE0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C41F92 2_2_03C41F92
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CFFFB1 2_2_03CFFFB1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB4F40 2_2_03CB4F40
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CFFF09 2_2_03CFFF09
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C82F28 2_2_03C82F28
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C60F30 2_2_03C60F30
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CFEEDB 2_2_03CFEEDB
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C52E90 2_2_03C52E90
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CFCE93 2_2_03CFCE93
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C49EB0 2_2_03C49EB0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40E59 2_2_03C40E59
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CFEE26 2_2_03CFEE26
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5FDC0 2_2_03C5FDC0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3ADE0 2_2_03C3ADE0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C58DBF 2_2_03C58DBF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C43D40 2_2_03C43D40
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF1D5A 2_2_03CF1D5A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF7D73 2_2_03CF7D73
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4AD00 2_2_03C4AD00
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C30CF2 2_2_03C30CF2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CFFCF2 2_2_03CFFCF2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE0CB5 2_2_03CE0CB5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40C00 2_2_03C40C00
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB9C32 2_2_03CB9C32
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\svchost.exe Code function: String function: 03C75130 appears 36 times
Source: C:\Windows\SysWOW64\svchost.exe Code function: String function: 03C2B970 appears 265 times
Source: C:\Windows\SysWOW64\svchost.exe Code function: String function: 03C87E54 appears 89 times
Source: C:\Windows\SysWOW64\svchost.exe Code function: String function: 03CAEA12 appears 86 times
Source: C:\Windows\SysWOW64\svchost.exe Code function: String function: 03CBF290 appears 105 times
Uses 32bit PE files
Source: Commercial Invoice Packing list.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Yara signature match
Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.1438605926.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.1438335528.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: classification engine Classification label: mal88.troj.evad.winEXE@3/1@0/0
Source: C:\Users\user\Desktop\Commercial Invoice Packing list.exe File created: C:\Users\user~1\AppData\Local\Temp\bezzo Jump to behavior
Source: Commercial Invoice Packing list.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Commercial Invoice Packing list.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\Commercial Invoice Packing list.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: Commercial Invoice Packing list.exe ReversingLabs: Detection: 34%
Source: Commercial Invoice Packing list.exe Virustotal: Detection: 29%
Source: C:\Users\user\Desktop\Commercial Invoice Packing list.exe File read: C:\Users\user\Desktop\Commercial Invoice Packing list.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Commercial Invoice Packing list.exe "C:\Users\user\Desktop\Commercial Invoice Packing list.exe"
Source: C:\Users\user\Desktop\Commercial Invoice Packing list.exe Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Commercial Invoice Packing list.exe"
Source: C:\Users\user\Desktop\Commercial Invoice Packing list.exe Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Commercial Invoice Packing list.exe" Jump to behavior
Source: C:\Users\user\Desktop\Commercial Invoice Packing list.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\Commercial Invoice Packing list.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\Desktop\Commercial Invoice Packing list.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\Commercial Invoice Packing list.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\Commercial Invoice Packing list.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\Commercial Invoice Packing list.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\Commercial Invoice Packing list.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\Commercial Invoice Packing list.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\Commercial Invoice Packing list.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\Commercial Invoice Packing list.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\Commercial Invoice Packing list.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Commercial Invoice Packing list.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32 Jump to behavior
Source: Commercial Invoice Packing list.exe Static file information: File size 1400397 > 1048576
Source: Binary string: wntdll.pdbUGP source: svchost.exe, 00000002.00000003.1397508645.0000000003A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1438634394.0000000003D9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1438634394.0000000003C00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1395710369.0000000003800000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: svchost.exe, svchost.exe, 00000002.00000003.1397508645.0000000003A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1438634394.0000000003D9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1438634394.0000000003C00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1395710369.0000000003800000.00000004.00000020.00020000.00000000.sdmp
PE file contains an invalid checksum
Source: Commercial Invoice Packing list.exe Static PE information: real checksum: 0xa2135 should be: 0x161b9e
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_0042D853 push edi; iretd 2_2_0042D85C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_0041A036 push edi; ret 2_2_0041A03F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_0040D1BA push ss; retf 2_2_0040D1BB
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_0040222C push ecx; retf 2_2_0040231F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_0041AA87 push edi; iretd 2_2_0041AA93
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_0040D3DC push es; ret 2_2_0040D3E2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_00415474 push edx; ret 2_2_00415475
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_0041543B push ebp; iretd 2_2_0041543C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_004034A0 push eax; ret 2_2_004034A2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_00418D13 push edi; ret 2_2_00418D14
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_00408682 push fs; iretd 2_2_00408684
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_00413F43 pushfd ; iretw 2_2_004140C6
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_00423737 push 8DB602B4h; retf 2_2_0042373D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C309AD push ecx; mov dword ptr [esp], ecx 2_2_03C309B6

Malware Analysis System Evasion
barindex
Switches to a custom stack to bypass stack traces
Source: C:\Users\user\Desktop\Commercial Invoice Packing list.exe API/Special instruction interceptor: Address: 41CB254
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_0041480C rdtsc 2_2_0041480C
Found large amount of non-executed APIs
Source: C:\Windows\SysWOW64\svchost.exe API coverage: 0.7 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\SysWOW64\svchost.exe TID: 6172 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Windows\SysWOW64\svchost.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_0041480C rdtsc 2_2_0041480C
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_004175E3 LdrLoadDll, 2_2_004175E3
Contains functionality to read the PEB
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CEC3CD mov eax, dword ptr fs:[00000030h] 2_2_03CEC3CD
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3A3C0 mov eax, dword ptr fs:[00000030h] 2_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3A3C0 mov eax, dword ptr fs:[00000030h] 2_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3A3C0 mov eax, dword ptr fs:[00000030h] 2_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3A3C0 mov eax, dword ptr fs:[00000030h] 2_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3A3C0 mov eax, dword ptr fs:[00000030h] 2_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3A3C0 mov eax, dword ptr fs:[00000030h] 2_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C383C0 mov eax, dword ptr fs:[00000030h] 2_2_03C383C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C383C0 mov eax, dword ptr fs:[00000030h] 2_2_03C383C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C383C0 mov eax, dword ptr fs:[00000030h] 2_2_03C383C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C383C0 mov eax, dword ptr fs:[00000030h] 2_2_03C383C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CEB3D0 mov ecx, dword ptr fs:[00000030h] 2_2_03CEB3D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CEF3E6 mov eax, dword ptr fs:[00000030h] 2_2_03CEF3E6
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D053FC mov eax, dword ptr fs:[00000030h] 2_2_03D053FC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C403E9 mov eax, dword ptr fs:[00000030h] 2_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C403E9 mov eax, dword ptr fs:[00000030h] 2_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C403E9 mov eax, dword ptr fs:[00000030h] 2_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C403E9 mov eax, dword ptr fs:[00000030h] 2_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C403E9 mov eax, dword ptr fs:[00000030h] 2_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C403E9 mov eax, dword ptr fs:[00000030h] 2_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C403E9 mov eax, dword ptr fs:[00000030h] 2_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C403E9 mov eax, dword ptr fs:[00000030h] 2_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4E3F0 mov eax, dword ptr fs:[00000030h] 2_2_03C4E3F0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4E3F0 mov eax, dword ptr fs:[00000030h] 2_2_03C4E3F0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4E3F0 mov eax, dword ptr fs:[00000030h] 2_2_03C4E3F0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C663FF mov eax, dword ptr fs:[00000030h] 2_2_03C663FF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2E388 mov eax, dword ptr fs:[00000030h] 2_2_03C2E388
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2E388 mov eax, dword ptr fs:[00000030h] 2_2_03C2E388
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2E388 mov eax, dword ptr fs:[00000030h] 2_2_03C2E388
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5438F mov eax, dword ptr fs:[00000030h] 2_2_03C5438F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5438F mov eax, dword ptr fs:[00000030h] 2_2_03C5438F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D0539D mov eax, dword ptr fs:[00000030h] 2_2_03D0539D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C8739A mov eax, dword ptr fs:[00000030h] 2_2_03C8739A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C8739A mov eax, dword ptr fs:[00000030h] 2_2_03C8739A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C28397 mov eax, dword ptr fs:[00000030h] 2_2_03C28397
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C28397 mov eax, dword ptr fs:[00000030h] 2_2_03C28397
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C28397 mov eax, dword ptr fs:[00000030h] 2_2_03C28397
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C533A5 mov eax, dword ptr fs:[00000030h] 2_2_03C533A5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C633A0 mov eax, dword ptr fs:[00000030h] 2_2_03C633A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C633A0 mov eax, dword ptr fs:[00000030h] 2_2_03C633A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h] 2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h] 2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h] 2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h] 2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h] 2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h] 2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h] 2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h] 2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h] 2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h] 2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h] 2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h] 2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h] 2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h] 2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h] 2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2D34C mov eax, dword ptr fs:[00000030h] 2_2_03C2D34C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2D34C mov eax, dword ptr fs:[00000030h] 2_2_03C2D34C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D05341 mov eax, dword ptr fs:[00000030h] 2_2_03D05341
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C29353 mov eax, dword ptr fs:[00000030h] 2_2_03C29353
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C29353 mov eax, dword ptr fs:[00000030h] 2_2_03C29353
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB035C mov eax, dword ptr fs:[00000030h] 2_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB035C mov eax, dword ptr fs:[00000030h] 2_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB035C mov eax, dword ptr fs:[00000030h] 2_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB035C mov ecx, dword ptr fs:[00000030h] 2_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB035C mov eax, dword ptr fs:[00000030h] 2_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB035C mov eax, dword ptr fs:[00000030h] 2_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CFA352 mov eax, dword ptr fs:[00000030h] 2_2_03CFA352
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CEF367 mov eax, dword ptr fs:[00000030h] 2_2_03CEF367
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CD437C mov eax, dword ptr fs:[00000030h] 2_2_03CD437C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C37370 mov eax, dword ptr fs:[00000030h] 2_2_03C37370
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C37370 mov eax, dword ptr fs:[00000030h] 2_2_03C37370
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C37370 mov eax, dword ptr fs:[00000030h] 2_2_03C37370
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB930B mov eax, dword ptr fs:[00000030h] 2_2_03CB930B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB930B mov eax, dword ptr fs:[00000030h] 2_2_03CB930B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB930B mov eax, dword ptr fs:[00000030h] 2_2_03CB930B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6A30B mov eax, dword ptr fs:[00000030h] 2_2_03C6A30B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6A30B mov eax, dword ptr fs:[00000030h] 2_2_03C6A30B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6A30B mov eax, dword ptr fs:[00000030h] 2_2_03C6A30B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2C310 mov ecx, dword ptr fs:[00000030h] 2_2_03C2C310
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C50310 mov ecx, dword ptr fs:[00000030h] 2_2_03C50310
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF132D mov eax, dword ptr fs:[00000030h] 2_2_03CF132D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF132D mov eax, dword ptr fs:[00000030h] 2_2_03CF132D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5F32A mov eax, dword ptr fs:[00000030h] 2_2_03C5F32A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C27330 mov eax, dword ptr fs:[00000030h] 2_2_03C27330
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3A2C3 mov eax, dword ptr fs:[00000030h] 2_2_03C3A2C3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3A2C3 mov eax, dword ptr fs:[00000030h] 2_2_03C3A2C3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3A2C3 mov eax, dword ptr fs:[00000030h] 2_2_03C3A2C3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3A2C3 mov eax, dword ptr fs:[00000030h] 2_2_03C3A2C3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3A2C3 mov eax, dword ptr fs:[00000030h] 2_2_03C3A2C3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5B2C0 mov eax, dword ptr fs:[00000030h] 2_2_03C5B2C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5B2C0 mov eax, dword ptr fs:[00000030h] 2_2_03C5B2C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5B2C0 mov eax, dword ptr fs:[00000030h] 2_2_03C5B2C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5B2C0 mov eax, dword ptr fs:[00000030h] 2_2_03C5B2C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5B2C0 mov eax, dword ptr fs:[00000030h] 2_2_03C5B2C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5B2C0 mov eax, dword ptr fs:[00000030h] 2_2_03C5B2C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5B2C0 mov eax, dword ptr fs:[00000030h] 2_2_03C5B2C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C392C5 mov eax, dword ptr fs:[00000030h] 2_2_03C392C5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C392C5 mov eax, dword ptr fs:[00000030h] 2_2_03C392C5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2B2D3 mov eax, dword ptr fs:[00000030h] 2_2_03C2B2D3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2B2D3 mov eax, dword ptr fs:[00000030h] 2_2_03C2B2D3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2B2D3 mov eax, dword ptr fs:[00000030h] 2_2_03C2B2D3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5F2D0 mov eax, dword ptr fs:[00000030h] 2_2_03C5F2D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5F2D0 mov eax, dword ptr fs:[00000030h] 2_2_03C5F2D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE12ED mov eax, dword ptr fs:[00000030h] 2_2_03CE12ED
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE12ED mov eax, dword ptr fs:[00000030h] 2_2_03CE12ED
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE12ED mov eax, dword ptr fs:[00000030h] 2_2_03CE12ED
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE12ED mov eax, dword ptr fs:[00000030h] 2_2_03CE12ED
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE12ED mov eax, dword ptr fs:[00000030h] 2_2_03CE12ED
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE12ED mov eax, dword ptr fs:[00000030h] 2_2_03CE12ED
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE12ED mov eax, dword ptr fs:[00000030h] 2_2_03CE12ED
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE12ED mov eax, dword ptr fs:[00000030h] 2_2_03CE12ED
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE12ED mov eax, dword ptr fs:[00000030h] 2_2_03CE12ED
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE12ED mov eax, dword ptr fs:[00000030h] 2_2_03CE12ED
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE12ED mov eax, dword ptr fs:[00000030h] 2_2_03CE12ED
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE12ED mov eax, dword ptr fs:[00000030h] 2_2_03CE12ED
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE12ED mov eax, dword ptr fs:[00000030h] 2_2_03CE12ED
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE12ED mov eax, dword ptr fs:[00000030h] 2_2_03CE12ED
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C402E1 mov eax, dword ptr fs:[00000030h] 2_2_03C402E1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C402E1 mov eax, dword ptr fs:[00000030h] 2_2_03C402E1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C402E1 mov eax, dword ptr fs:[00000030h] 2_2_03C402E1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D052E2 mov eax, dword ptr fs:[00000030h] 2_2_03D052E2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CEF2F8 mov eax, dword ptr fs:[00000030h] 2_2_03CEF2F8
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C292FF mov eax, dword ptr fs:[00000030h] 2_2_03C292FF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6E284 mov eax, dword ptr fs:[00000030h] 2_2_03C6E284
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6E284 mov eax, dword ptr fs:[00000030h] 2_2_03C6E284
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB0283 mov eax, dword ptr fs:[00000030h] 2_2_03CB0283
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB0283 mov eax, dword ptr fs:[00000030h] 2_2_03CB0283
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB0283 mov eax, dword ptr fs:[00000030h] 2_2_03CB0283
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D05283 mov eax, dword ptr fs:[00000030h] 2_2_03D05283
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6329E mov eax, dword ptr fs:[00000030h] 2_2_03C6329E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6329E mov eax, dword ptr fs:[00000030h] 2_2_03C6329E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C402A0 mov eax, dword ptr fs:[00000030h] 2_2_03C402A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C402A0 mov eax, dword ptr fs:[00000030h] 2_2_03C402A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C452A0 mov eax, dword ptr fs:[00000030h] 2_2_03C452A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C452A0 mov eax, dword ptr fs:[00000030h] 2_2_03C452A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C452A0 mov eax, dword ptr fs:[00000030h] 2_2_03C452A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C452A0 mov eax, dword ptr fs:[00000030h] 2_2_03C452A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF92A6 mov eax, dword ptr fs:[00000030h] 2_2_03CF92A6
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF92A6 mov eax, dword ptr fs:[00000030h] 2_2_03CF92A6
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF92A6 mov eax, dword ptr fs:[00000030h] 2_2_03CF92A6
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF92A6 mov eax, dword ptr fs:[00000030h] 2_2_03CF92A6
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC62A0 mov eax, dword ptr fs:[00000030h] 2_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC62A0 mov ecx, dword ptr fs:[00000030h] 2_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC62A0 mov eax, dword ptr fs:[00000030h] 2_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC62A0 mov eax, dword ptr fs:[00000030h] 2_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC62A0 mov eax, dword ptr fs:[00000030h] 2_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC62A0 mov eax, dword ptr fs:[00000030h] 2_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC72A0 mov eax, dword ptr fs:[00000030h] 2_2_03CC72A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC72A0 mov eax, dword ptr fs:[00000030h] 2_2_03CC72A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB92BC mov eax, dword ptr fs:[00000030h] 2_2_03CB92BC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB92BC mov eax, dword ptr fs:[00000030h] 2_2_03CB92BC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB92BC mov ecx, dword ptr fs:[00000030h] 2_2_03CB92BC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB92BC mov ecx, dword ptr fs:[00000030h] 2_2_03CB92BC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C29240 mov eax, dword ptr fs:[00000030h] 2_2_03C29240
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C29240 mov eax, dword ptr fs:[00000030h] 2_2_03C29240
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6724D mov eax, dword ptr fs:[00000030h] 2_2_03C6724D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2A250 mov eax, dword ptr fs:[00000030h] 2_2_03C2A250
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CEB256 mov eax, dword ptr fs:[00000030h] 2_2_03CEB256
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CEB256 mov eax, dword ptr fs:[00000030h] 2_2_03CEB256
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C36259 mov eax, dword ptr fs:[00000030h] 2_2_03C36259
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C34260 mov eax, dword ptr fs:[00000030h] 2_2_03C34260
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C34260 mov eax, dword ptr fs:[00000030h] 2_2_03C34260
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C34260 mov eax, dword ptr fs:[00000030h] 2_2_03C34260
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CFD26B mov eax, dword ptr fs:[00000030h] 2_2_03CFD26B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CFD26B mov eax, dword ptr fs:[00000030h] 2_2_03CFD26B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2826B mov eax, dword ptr fs:[00000030h] 2_2_03C2826B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C59274 mov eax, dword ptr fs:[00000030h] 2_2_03C59274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C71270 mov eax, dword ptr fs:[00000030h] 2_2_03C71270
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C71270 mov eax, dword ptr fs:[00000030h] 2_2_03C71270
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h] 2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h] 2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h] 2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h] 2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h] 2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h] 2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h] 2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h] 2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h] 2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h] 2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h] 2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h] 2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C67208 mov eax, dword ptr fs:[00000030h] 2_2_03C67208
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C67208 mov eax, dword ptr fs:[00000030h] 2_2_03C67208
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D05227 mov eax, dword ptr fs:[00000030h] 2_2_03D05227
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2823B mov eax, dword ptr fs:[00000030h] 2_2_03C2823B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF61C3 mov eax, dword ptr fs:[00000030h] 2_2_03CF61C3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF61C3 mov eax, dword ptr fs:[00000030h] 2_2_03CF61C3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6D1D0 mov eax, dword ptr fs:[00000030h] 2_2_03C6D1D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6D1D0 mov ecx, dword ptr fs:[00000030h] 2_2_03C6D1D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAE1D0 mov eax, dword ptr fs:[00000030h] 2_2_03CAE1D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAE1D0 mov eax, dword ptr fs:[00000030h] 2_2_03CAE1D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAE1D0 mov ecx, dword ptr fs:[00000030h] 2_2_03CAE1D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAE1D0 mov eax, dword ptr fs:[00000030h] 2_2_03CAE1D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAE1D0 mov eax, dword ptr fs:[00000030h] 2_2_03CAE1D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D051CB mov eax, dword ptr fs:[00000030h] 2_2_03D051CB
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C551EF mov eax, dword ptr fs:[00000030h] 2_2_03C551EF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C551EF mov eax, dword ptr fs:[00000030h] 2_2_03C551EF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C551EF mov eax, dword ptr fs:[00000030h] 2_2_03C551EF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C551EF mov eax, dword ptr fs:[00000030h] 2_2_03C551EF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C551EF mov eax, dword ptr fs:[00000030h] 2_2_03C551EF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C551EF mov eax, dword ptr fs:[00000030h] 2_2_03C551EF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C551EF mov eax, dword ptr fs:[00000030h] 2_2_03C551EF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C551EF mov eax, dword ptr fs:[00000030h] 2_2_03C551EF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C551EF mov eax, dword ptr fs:[00000030h] 2_2_03C551EF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C551EF mov eax, dword ptr fs:[00000030h] 2_2_03C551EF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C551EF mov eax, dword ptr fs:[00000030h] 2_2_03C551EF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C551EF mov eax, dword ptr fs:[00000030h] 2_2_03C551EF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C551EF mov eax, dword ptr fs:[00000030h] 2_2_03C551EF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C351ED mov eax, dword ptr fs:[00000030h] 2_2_03C351ED
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D061E5 mov eax, dword ptr fs:[00000030h] 2_2_03D061E5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C601F8 mov eax, dword ptr fs:[00000030h] 2_2_03C601F8
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C70185 mov eax, dword ptr fs:[00000030h] 2_2_03C70185
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CEC188 mov eax, dword ptr fs:[00000030h] 2_2_03CEC188
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CEC188 mov eax, dword ptr fs:[00000030h] 2_2_03CEC188
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB019F mov eax, dword ptr fs:[00000030h] 2_2_03CB019F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB019F mov eax, dword ptr fs:[00000030h] 2_2_03CB019F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB019F mov eax, dword ptr fs:[00000030h] 2_2_03CB019F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB019F mov eax, dword ptr fs:[00000030h] 2_2_03CB019F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2A197 mov eax, dword ptr fs:[00000030h] 2_2_03C2A197
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2A197 mov eax, dword ptr fs:[00000030h] 2_2_03C2A197
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2A197 mov eax, dword ptr fs:[00000030h] 2_2_03C2A197
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C87190 mov eax, dword ptr fs:[00000030h] 2_2_03C87190
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE11A4 mov eax, dword ptr fs:[00000030h] 2_2_03CE11A4
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE11A4 mov eax, dword ptr fs:[00000030h] 2_2_03CE11A4
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE11A4 mov eax, dword ptr fs:[00000030h] 2_2_03CE11A4
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CE11A4 mov eax, dword ptr fs:[00000030h] 2_2_03CE11A4
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4B1B0 mov eax, dword ptr fs:[00000030h] 2_2_03C4B1B0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D05152 mov eax, dword ptr fs:[00000030h] 2_2_03D05152
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC4144 mov eax, dword ptr fs:[00000030h] 2_2_03CC4144
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC4144 mov eax, dword ptr fs:[00000030h] 2_2_03CC4144
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC4144 mov ecx, dword ptr fs:[00000030h] 2_2_03CC4144
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC4144 mov eax, dword ptr fs:[00000030h] 2_2_03CC4144
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC4144 mov eax, dword ptr fs:[00000030h] 2_2_03CC4144
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C29148 mov eax, dword ptr fs:[00000030h] 2_2_03C29148
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C29148 mov eax, dword ptr fs:[00000030h] 2_2_03C29148
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C29148 mov eax, dword ptr fs:[00000030h] 2_2_03C29148
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C29148 mov eax, dword ptr fs:[00000030h] 2_2_03C29148
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C37152 mov eax, dword ptr fs:[00000030h] 2_2_03C37152
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2C156 mov eax, dword ptr fs:[00000030h] 2_2_03C2C156
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C36154 mov eax, dword ptr fs:[00000030h] 2_2_03C36154
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C36154 mov eax, dword ptr fs:[00000030h] 2_2_03C36154
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2F172 mov eax, dword ptr fs:[00000030h] 2_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2F172 mov eax, dword ptr fs:[00000030h] 2_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2F172 mov eax, dword ptr fs:[00000030h] 2_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2F172 mov eax, dword ptr fs:[00000030h] 2_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2F172 mov eax, dword ptr fs:[00000030h] 2_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2F172 mov eax, dword ptr fs:[00000030h] 2_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2F172 mov eax, dword ptr fs:[00000030h] 2_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2F172 mov eax, dword ptr fs:[00000030h] 2_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2F172 mov eax, dword ptr fs:[00000030h] 2_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2F172 mov eax, dword ptr fs:[00000030h] 2_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2F172 mov eax, dword ptr fs:[00000030h] 2_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2F172 mov eax, dword ptr fs:[00000030h] 2_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2F172 mov eax, dword ptr fs:[00000030h] 2_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2F172 mov eax, dword ptr fs:[00000030h] 2_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2F172 mov eax, dword ptr fs:[00000030h] 2_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2F172 mov eax, dword ptr fs:[00000030h] 2_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2F172 mov eax, dword ptr fs:[00000030h] 2_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2F172 mov eax, dword ptr fs:[00000030h] 2_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2F172 mov eax, dword ptr fs:[00000030h] 2_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2F172 mov eax, dword ptr fs:[00000030h] 2_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2F172 mov eax, dword ptr fs:[00000030h] 2_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC9179 mov eax, dword ptr fs:[00000030h] 2_2_03CC9179
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDA118 mov ecx, dword ptr fs:[00000030h] 2_2_03CDA118
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDA118 mov eax, dword ptr fs:[00000030h] 2_2_03CDA118
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDA118 mov eax, dword ptr fs:[00000030h] 2_2_03CDA118
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CDA118 mov eax, dword ptr fs:[00000030h] 2_2_03CDA118
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF0115 mov eax, dword ptr fs:[00000030h] 2_2_03CF0115
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C60124 mov eax, dword ptr fs:[00000030h] 2_2_03C60124
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C31131 mov eax, dword ptr fs:[00000030h] 2_2_03C31131
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C31131 mov eax, dword ptr fs:[00000030h] 2_2_03C31131
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2B136 mov eax, dword ptr fs:[00000030h] 2_2_03C2B136
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2B136 mov eax, dword ptr fs:[00000030h] 2_2_03C2B136
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2B136 mov eax, dword ptr fs:[00000030h] 2_2_03C2B136
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2B136 mov eax, dword ptr fs:[00000030h] 2_2_03C2B136
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C470C0 mov eax, dword ptr fs:[00000030h] 2_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C470C0 mov ecx, dword ptr fs:[00000030h] 2_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C470C0 mov ecx, dword ptr fs:[00000030h] 2_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C470C0 mov eax, dword ptr fs:[00000030h] 2_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C470C0 mov ecx, dword ptr fs:[00000030h] 2_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C470C0 mov ecx, dword ptr fs:[00000030h] 2_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C470C0 mov eax, dword ptr fs:[00000030h] 2_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C470C0 mov eax, dword ptr fs:[00000030h] 2_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C470C0 mov eax, dword ptr fs:[00000030h] 2_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C470C0 mov eax, dword ptr fs:[00000030h] 2_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C470C0 mov eax, dword ptr fs:[00000030h] 2_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C470C0 mov eax, dword ptr fs:[00000030h] 2_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C470C0 mov eax, dword ptr fs:[00000030h] 2_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C470C0 mov eax, dword ptr fs:[00000030h] 2_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C470C0 mov eax, dword ptr fs:[00000030h] 2_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C470C0 mov eax, dword ptr fs:[00000030h] 2_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C470C0 mov eax, dword ptr fs:[00000030h] 2_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C470C0 mov eax, dword ptr fs:[00000030h] 2_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D050D9 mov eax, dword ptr fs:[00000030h] 2_2_03D050D9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAD0C0 mov eax, dword ptr fs:[00000030h] 2_2_03CAD0C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAD0C0 mov eax, dword ptr fs:[00000030h] 2_2_03CAD0C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB20DE mov eax, dword ptr fs:[00000030h] 2_2_03CB20DE
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C590DB mov eax, dword ptr fs:[00000030h] 2_2_03C590DB
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C550E4 mov eax, dword ptr fs:[00000030h] 2_2_03C550E4
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C550E4 mov ecx, dword ptr fs:[00000030h] 2_2_03C550E4
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2A0E3 mov ecx, dword ptr fs:[00000030h] 2_2_03C2A0E3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C380E9 mov eax, dword ptr fs:[00000030h] 2_2_03C380E9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2C0F0 mov eax, dword ptr fs:[00000030h] 2_2_03C2C0F0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C720F0 mov ecx, dword ptr fs:[00000030h] 2_2_03C720F0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3208A mov eax, dword ptr fs:[00000030h] 2_2_03C3208A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2D08D mov eax, dword ptr fs:[00000030h] 2_2_03C2D08D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C35096 mov eax, dword ptr fs:[00000030h] 2_2_03C35096
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5D090 mov eax, dword ptr fs:[00000030h] 2_2_03C5D090
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5D090 mov eax, dword ptr fs:[00000030h] 2_2_03C5D090
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6909C mov eax, dword ptr fs:[00000030h] 2_2_03C6909C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF60B8 mov eax, dword ptr fs:[00000030h] 2_2_03CF60B8
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF60B8 mov ecx, dword ptr fs:[00000030h] 2_2_03CF60B8
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C32050 mov eax, dword ptr fs:[00000030h] 2_2_03C32050
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CD705E mov ebx, dword ptr fs:[00000030h] 2_2_03CD705E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CD705E mov eax, dword ptr fs:[00000030h] 2_2_03CD705E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5B052 mov eax, dword ptr fs:[00000030h] 2_2_03C5B052
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB106E mov eax, dword ptr fs:[00000030h] 2_2_03CB106E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D05060 mov eax, dword ptr fs:[00000030h] 2_2_03D05060
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C41070 mov eax, dword ptr fs:[00000030h] 2_2_03C41070
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C41070 mov ecx, dword ptr fs:[00000030h] 2_2_03C41070
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C41070 mov eax, dword ptr fs:[00000030h] 2_2_03C41070
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C41070 mov eax, dword ptr fs:[00000030h] 2_2_03C41070
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C41070 mov eax, dword ptr fs:[00000030h] 2_2_03C41070
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C41070 mov eax, dword ptr fs:[00000030h] 2_2_03C41070
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C41070 mov eax, dword ptr fs:[00000030h] 2_2_03C41070
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C41070 mov eax, dword ptr fs:[00000030h] 2_2_03C41070
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C41070 mov eax, dword ptr fs:[00000030h] 2_2_03C41070
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C41070 mov eax, dword ptr fs:[00000030h] 2_2_03C41070
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C41070 mov eax, dword ptr fs:[00000030h] 2_2_03C41070
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C41070 mov eax, dword ptr fs:[00000030h] 2_2_03C41070
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C41070 mov eax, dword ptr fs:[00000030h] 2_2_03C41070
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5C073 mov eax, dword ptr fs:[00000030h] 2_2_03C5C073
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAD070 mov ecx, dword ptr fs:[00000030h] 2_2_03CAD070
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB4000 mov ecx, dword ptr fs:[00000030h] 2_2_03CB4000
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4E016 mov eax, dword ptr fs:[00000030h] 2_2_03C4E016
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4E016 mov eax, dword ptr fs:[00000030h] 2_2_03C4E016
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4E016 mov eax, dword ptr fs:[00000030h] 2_2_03C4E016
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4E016 mov eax, dword ptr fs:[00000030h] 2_2_03C4E016
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2A020 mov eax, dword ptr fs:[00000030h] 2_2_03C2A020
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2C020 mov eax, dword ptr fs:[00000030h] 2_2_03C2C020
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF903E mov eax, dword ptr fs:[00000030h] 2_2_03CF903E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF903E mov eax, dword ptr fs:[00000030h] 2_2_03CF903E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF903E mov eax, dword ptr fs:[00000030h] 2_2_03CF903E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF903E mov eax, dword ptr fs:[00000030h] 2_2_03CF903E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3C7C0 mov eax, dword ptr fs:[00000030h] 2_2_03C3C7C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C357C0 mov eax, dword ptr fs:[00000030h] 2_2_03C357C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C357C0 mov eax, dword ptr fs:[00000030h] 2_2_03C357C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C357C0 mov eax, dword ptr fs:[00000030h] 2_2_03C357C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB07C3 mov eax, dword ptr fs:[00000030h] 2_2_03CB07C3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3D7E0 mov ecx, dword ptr fs:[00000030h] 2_2_03C3D7E0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C527ED mov eax, dword ptr fs:[00000030h] 2_2_03C527ED
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C527ED mov eax, dword ptr fs:[00000030h] 2_2_03C527ED
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C527ED mov eax, dword ptr fs:[00000030h] 2_2_03C527ED
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C347FB mov eax, dword ptr fs:[00000030h] 2_2_03C347FB
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C347FB mov eax, dword ptr fs:[00000030h] 2_2_03C347FB
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CEF78A mov eax, dword ptr fs:[00000030h] 2_2_03CEF78A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB97A9 mov eax, dword ptr fs:[00000030h] 2_2_03CB97A9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CBF7AF mov eax, dword ptr fs:[00000030h] 2_2_03CBF7AF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CBF7AF mov eax, dword ptr fs:[00000030h] 2_2_03CBF7AF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CBF7AF mov eax, dword ptr fs:[00000030h] 2_2_03CBF7AF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CBF7AF mov eax, dword ptr fs:[00000030h] 2_2_03CBF7AF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CBF7AF mov eax, dword ptr fs:[00000030h] 2_2_03CBF7AF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D037B6 mov eax, dword ptr fs:[00000030h] 2_2_03D037B6
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C307AF mov eax, dword ptr fs:[00000030h] 2_2_03C307AF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5D7B0 mov eax, dword ptr fs:[00000030h] 2_2_03C5D7B0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2F7BA mov eax, dword ptr fs:[00000030h] 2_2_03C2F7BA
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2F7BA mov eax, dword ptr fs:[00000030h] 2_2_03C2F7BA
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2F7BA mov eax, dword ptr fs:[00000030h] 2_2_03C2F7BA
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2F7BA mov eax, dword ptr fs:[00000030h] 2_2_03C2F7BA
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2F7BA mov eax, dword ptr fs:[00000030h] 2_2_03C2F7BA
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2F7BA mov eax, dword ptr fs:[00000030h] 2_2_03C2F7BA
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2F7BA mov eax, dword ptr fs:[00000030h] 2_2_03C2F7BA
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2F7BA mov eax, dword ptr fs:[00000030h] 2_2_03C2F7BA
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2F7BA mov eax, dword ptr fs:[00000030h] 2_2_03C2F7BA
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C43740 mov eax, dword ptr fs:[00000030h] 2_2_03C43740
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C43740 mov eax, dword ptr fs:[00000030h] 2_2_03C43740
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C43740 mov eax, dword ptr fs:[00000030h] 2_2_03C43740
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6674D mov esi, dword ptr fs:[00000030h] 2_2_03C6674D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6674D mov eax, dword ptr fs:[00000030h] 2_2_03C6674D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6674D mov eax, dword ptr fs:[00000030h] 2_2_03C6674D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C30750 mov eax, dword ptr fs:[00000030h] 2_2_03C30750
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72750 mov eax, dword ptr fs:[00000030h] 2_2_03C72750
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72750 mov eax, dword ptr fs:[00000030h] 2_2_03C72750
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D03749 mov eax, dword ptr fs:[00000030h] 2_2_03D03749
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB4755 mov eax, dword ptr fs:[00000030h] 2_2_03CB4755
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2B765 mov eax, dword ptr fs:[00000030h] 2_2_03C2B765
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2B765 mov eax, dword ptr fs:[00000030h] 2_2_03C2B765
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2B765 mov eax, dword ptr fs:[00000030h] 2_2_03C2B765
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2B765 mov eax, dword ptr fs:[00000030h] 2_2_03C2B765
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C38770 mov eax, dword ptr fs:[00000030h] 2_2_03C38770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h] 2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h] 2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h] 2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h] 2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h] 2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h] 2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h] 2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h] 2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h] 2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h] 2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h] 2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h] 2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C37703 mov eax, dword ptr fs:[00000030h] 2_2_03C37703
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C35702 mov eax, dword ptr fs:[00000030h] 2_2_03C35702
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C35702 mov eax, dword ptr fs:[00000030h] 2_2_03C35702
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6C700 mov eax, dword ptr fs:[00000030h] 2_2_03C6C700
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C30710 mov eax, dword ptr fs:[00000030h] 2_2_03C30710
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C60710 mov eax, dword ptr fs:[00000030h] 2_2_03C60710
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6F71F mov eax, dword ptr fs:[00000030h] 2_2_03C6F71F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6F71F mov eax, dword ptr fs:[00000030h] 2_2_03C6F71F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CEF72E mov eax, dword ptr fs:[00000030h] 2_2_03CEF72E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C33720 mov eax, dword ptr fs:[00000030h] 2_2_03C33720
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4F720 mov eax, dword ptr fs:[00000030h] 2_2_03C4F720
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4F720 mov eax, dword ptr fs:[00000030h] 2_2_03C4F720
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4F720 mov eax, dword ptr fs:[00000030h] 2_2_03C4F720
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF972B mov eax, dword ptr fs:[00000030h] 2_2_03CF972B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6C720 mov eax, dword ptr fs:[00000030h] 2_2_03C6C720
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6C720 mov eax, dword ptr fs:[00000030h] 2_2_03C6C720
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D0B73C mov eax, dword ptr fs:[00000030h] 2_2_03D0B73C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D0B73C mov eax, dword ptr fs:[00000030h] 2_2_03D0B73C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D0B73C mov eax, dword ptr fs:[00000030h] 2_2_03D0B73C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03D0B73C mov eax, dword ptr fs:[00000030h] 2_2_03D0B73C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C29730 mov eax, dword ptr fs:[00000030h] 2_2_03C29730
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C29730 mov eax, dword ptr fs:[00000030h] 2_2_03C29730
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C65734 mov eax, dword ptr fs:[00000030h] 2_2_03C65734
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3973A mov eax, dword ptr fs:[00000030h] 2_2_03C3973A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3973A mov eax, dword ptr fs:[00000030h] 2_2_03C3973A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6273C mov eax, dword ptr fs:[00000030h] 2_2_03C6273C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6273C mov ecx, dword ptr fs:[00000030h] 2_2_03C6273C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6273C mov eax, dword ptr fs:[00000030h] 2_2_03C6273C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAC730 mov eax, dword ptr fs:[00000030h] 2_2_03CAC730
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6A6C7 mov ebx, dword ptr fs:[00000030h] 2_2_03C6A6C7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6A6C7 mov eax, dword ptr fs:[00000030h] 2_2_03C6A6C7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3B6C0 mov eax, dword ptr fs:[00000030h] 2_2_03C3B6C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3B6C0 mov eax, dword ptr fs:[00000030h] 2_2_03C3B6C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3B6C0 mov eax, dword ptr fs:[00000030h] 2_2_03C3B6C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3B6C0 mov eax, dword ptr fs:[00000030h] 2_2_03C3B6C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3B6C0 mov eax, dword ptr fs:[00000030h] 2_2_03C3B6C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C3B6C0 mov eax, dword ptr fs:[00000030h] 2_2_03C3B6C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF16CC mov eax, dword ptr fs:[00000030h] 2_2_03CF16CC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF16CC mov eax, dword ptr fs:[00000030h] 2_2_03CF16CC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF16CC mov eax, dword ptr fs:[00000030h] 2_2_03CF16CC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF16CC mov eax, dword ptr fs:[00000030h] 2_2_03CF16CC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CEF6C7 mov eax, dword ptr fs:[00000030h] 2_2_03CEF6C7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C616CF mov eax, dword ptr fs:[00000030h] 2_2_03C616CF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC36EE mov eax, dword ptr fs:[00000030h] 2_2_03CC36EE
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC36EE mov eax, dword ptr fs:[00000030h] 2_2_03CC36EE
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC36EE mov eax, dword ptr fs:[00000030h] 2_2_03CC36EE
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC36EE mov eax, dword ptr fs:[00000030h] 2_2_03CC36EE
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC36EE mov eax, dword ptr fs:[00000030h] 2_2_03CC36EE
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CC36EE mov eax, dword ptr fs:[00000030h] 2_2_03CC36EE
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5D6E0 mov eax, dword ptr fs:[00000030h] 2_2_03C5D6E0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C5D6E0 mov eax, dword ptr fs:[00000030h] 2_2_03C5D6E0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C636EF mov eax, dword ptr fs:[00000030h] 2_2_03C636EF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAE6F2 mov eax, dword ptr fs:[00000030h] 2_2_03CAE6F2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAE6F2 mov eax, dword ptr fs:[00000030h] 2_2_03CAE6F2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAE6F2 mov eax, dword ptr fs:[00000030h] 2_2_03CAE6F2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAE6F2 mov eax, dword ptr fs:[00000030h] 2_2_03CAE6F2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB06F1 mov eax, dword ptr fs:[00000030h] 2_2_03CB06F1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB06F1 mov eax, dword ptr fs:[00000030h] 2_2_03CB06F1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CED6F0 mov eax, dword ptr fs:[00000030h] 2_2_03CED6F0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB368C mov eax, dword ptr fs:[00000030h] 2_2_03CB368C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB368C mov eax, dword ptr fs:[00000030h] 2_2_03CB368C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB368C mov eax, dword ptr fs:[00000030h] 2_2_03CB368C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CB368C mov eax, dword ptr fs:[00000030h] 2_2_03CB368C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C34690 mov eax, dword ptr fs:[00000030h] 2_2_03C34690
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C34690 mov eax, dword ptr fs:[00000030h] 2_2_03C34690
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6C6A6 mov eax, dword ptr fs:[00000030h] 2_2_03C6C6A6
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2D6AA mov eax, dword ptr fs:[00000030h] 2_2_03C2D6AA
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2D6AA mov eax, dword ptr fs:[00000030h] 2_2_03C2D6AA
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C276B2 mov eax, dword ptr fs:[00000030h] 2_2_03C276B2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C276B2 mov eax, dword ptr fs:[00000030h] 2_2_03C276B2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C276B2 mov eax, dword ptr fs:[00000030h] 2_2_03C276B2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C666B0 mov eax, dword ptr fs:[00000030h] 2_2_03C666B0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4C640 mov eax, dword ptr fs:[00000030h] 2_2_03C4C640
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF866E mov eax, dword ptr fs:[00000030h] 2_2_03CF866E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CF866E mov eax, dword ptr fs:[00000030h] 2_2_03CF866E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6A660 mov eax, dword ptr fs:[00000030h] 2_2_03C6A660
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6A660 mov eax, dword ptr fs:[00000030h] 2_2_03C6A660
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C69660 mov eax, dword ptr fs:[00000030h] 2_2_03C69660
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C69660 mov eax, dword ptr fs:[00000030h] 2_2_03C69660
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C62674 mov eax, dword ptr fs:[00000030h] 2_2_03C62674
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C61607 mov eax, dword ptr fs:[00000030h] 2_2_03C61607
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03CAE609 mov eax, dword ptr fs:[00000030h] 2_2_03CAE609
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C6F603 mov eax, dword ptr fs:[00000030h] 2_2_03C6F603
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4260B mov eax, dword ptr fs:[00000030h] 2_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4260B mov eax, dword ptr fs:[00000030h] 2_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4260B mov eax, dword ptr fs:[00000030h] 2_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4260B mov eax, dword ptr fs:[00000030h] 2_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4260B mov eax, dword ptr fs:[00000030h] 2_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4260B mov eax, dword ptr fs:[00000030h] 2_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4260B mov eax, dword ptr fs:[00000030h] 2_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C33616 mov eax, dword ptr fs:[00000030h] 2_2_03C33616
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C33616 mov eax, dword ptr fs:[00000030h] 2_2_03C33616
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C72619 mov eax, dword ptr fs:[00000030h] 2_2_03C72619
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C4E627 mov eax, dword ptr fs:[00000030h] 2_2_03C4E627
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2F626 mov eax, dword ptr fs:[00000030h] 2_2_03C2F626
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2F626 mov eax, dword ptr fs:[00000030h] 2_2_03C2F626
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2F626 mov eax, dword ptr fs:[00000030h] 2_2_03C2F626
Source: C:\Windows\SysWOW64\svchost.exe Code function: 2_2_03C2F626 mov eax, dword ptr fs:[00000030h] 2_2_03C2F626

HIPS / PFW / Operating System Protection Evasion
barindex
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\Commercial Invoice Packing list.exe Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\Desktop\Commercial Invoice Packing list.exe Memory written: C:\Windows\SysWOW64\svchost.exe base: 315C008 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Commercial Invoice Packing list.exe Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Commercial Invoice Packing list.exe" Jump to behavior
Source: Commercial Invoice Packing list.exe Binary or memory string: @3PDASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000002.1438605926.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.1438335528.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000002.1438605926.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.1438335528.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1522687 Sample: Commercial Invoice Packing ... Startdate: 30/09/2024 Architecture: WINDOWS Score: 88 11 Malicious sample detected (through community Yara rule) 2->11 13 Multi AV Scanner detection for submitted file 2->13 15 Yara detected FormBook 2->15 17 4 other signatures 2->17 6 Commercial Invoice Packing list.exe 1 2->6         started        process3 signatures4 19 Writes to foreign memory regions 6->19 21 Maps a DLL or memory area into another process 6->21 9 svchost.exe 6->9         started        process5
⊘No contacted IP infos