Analysis Report invoice.exe

AV Detection:

Yara detected FormBook

Source: Yara match	File source: 00000001.00000002.694812494.0000000000B70000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.923792314.0000000002380000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.694586179.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.923314997.0000000000150000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.694843913.0000000000BA0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.662094900.00000000029D0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 1.2.invoice.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.invoice.exe.29d0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.invoice.exe.29d0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.invoice.exe.400000.1.unpack, type: UNPACKEDPE

Machine Learning detection for sample

Source: invoice.exe

Joe Sandbox ML: detected

Antivirus or Machine Learning detection for unpacked file

Source: 0.2.invoice.exe.29d0000.2.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 1.2.invoice.exe.400000.1.unpack	Avira: Label: TR/Crypt.ZPACK.Gen

Software Vulnerabilities:

Found inlined nop instructions (likely shell or obfuscated code)

Source: C:\Users\user\Desktop\invoice.exe	Code function: 4x nop then pop ebx		1_2_00407AD7
Source: C:\Users\user\Desktop\invoice.exe	Code function: 4x nop then pop ebx		1_2_00407A9C
Source: C:\Users\user\Desktop\invoice.exe	Code function: 4x nop then pop edi		1_2_00416CA6
Source: C:\Windows\SysWOW64\control.exe	Code function: 4x nop then pop edi		6_2_02396CA6

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic

Snort IDS: 1201 ATTACK-RESPONSES 403 Forbidden 34.102.136.180:80 -> 192.168.2.4:49764

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: GET /saf0/?UnSpxn_=BtLohM+uB3q4k/LlKf4h6h9jKhMOWhQYAUT20pwPFuxXeQimTiRkUGHppPy1CbtFE5UV&nHux40=pRmTZBcPIFQHkvP0 HTTP/1.1Host: www.laborexchanges.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /saf0/?nHux40=pRmTZBcPIFQHkvP0&UnSpxn_=l0vU6hoQQSceldQJGhZQQ6qERl0xu4TDj5AxNJURkYQ12iJDSWINmeiyVLwn1GCX+dbx HTTP/1.1Host: www.rmcfoods.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /saf0/?UnSpxn_=KK0m7Tuk2BKDUiTVJC/eZPZggliL1QGXIKfUCxB6Gg0A7hnmP0tvgutH2fljjdRiWXxo&nHux40=pRmTZBcPIFQHkvP0 HTTP/1.1Host: www.nigeriamoney.lifeConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 34.102.136.180 34.102.136.180

Internet Provider seen in connection with other malware

Source: Joe Sandbox View	ASN Name: A2HOSTINGUS A2HOSTINGUS
Source: Joe Sandbox View	ASN Name: DIMENOCUS DIMENOCUS
Source: Joe Sandbox View	ASN Name: GOOGLEUS GOOGLEUS

Contains functionality to download additional files from the internet

Source: C:\Windows\explorer.exe

Code function: 4_2_06C017A2 getaddrinfo,setsockopt,recv,

4_2_06C017A2

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /saf0/?UnSpxn_=BtLohM+uB3q4k/LlKf4h6h9jKhMOWhQYAUT20pwPFuxXeQimTiRkUGHppPy1CbtFE5UV&nHux40=pRmTZBcPIFQHkvP0 HTTP/1.1Host: www.laborexchanges.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /saf0/?nHux40=pRmTZBcPIFQHkvP0&UnSpxn_=l0vU6hoQQSceldQJGhZQQ6qERl0xu4TDj5AxNJURkYQ12iJDSWINmeiyVLwn1GCX+dbx HTTP/1.1Host: www.rmcfoods.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /saf0/?UnSpxn_=KK0m7Tuk2BKDUiTVJC/eZPZggliL1QGXIKfUCxB6Gg0A7hnmP0tvgutH2fljjdRiWXxo&nHux40=pRmTZBcPIFQHkvP0 HTTP/1.1Host: www.nigeriamoney.lifeConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: www.montesida.com

Urls found in memory or binary data

Source: explorer.exe, 00000004.00000000.680205230.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: explorer.exe, 00000004.00000000.666096636.0000000002B50000.00000002.00000001.sdmp	String found in binary or memory: http://www.%s.comPA
Source: explorer.exe, 00000004.00000000.680205230.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000004.00000000.680205230.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 00000004.00000000.680205230.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000004.00000000.680205230.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000004.00000000.680205230.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000004.00000000.680205230.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000004.00000000.680205230.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: explorer.exe, 00000004.00000000.680205230.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 00000004.00000000.680205230.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000004.00000000.680205230.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 00000004.00000000.680205230.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 00000004.00000000.680205230.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 00000004.00000000.680205230.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000004.00000000.680205230.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 00000004.00000000.680205230.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000004.00000000.680205230.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000004.00000000.680205230.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 00000004.00000000.680205230.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 00000004.00000000.680205230.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 00000004.00000000.680205230.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 00000004.00000000.680205230.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000004.00000000.680205230.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 00000004.00000000.680205230.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000004.00000000.680205230.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 00000004.00000000.680205230.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: control.exe, 00000006.00000002.925130650.0000000004E2F000.00000004.00000001.sdmp	String found in binary or memory: https://www.rmcfoods.com/saf0/?nHux40=pRmTZBcPIFQHkvP0&UnSpxn_=l0vU6hoQQSceldQJGhZQQ6qERl0xu4TDj5AxN

E-Banking Fraud:

Yara detected FormBook

Source: Yara match	File source: 00000001.00000002.694812494.0000000000B70000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.923792314.0000000002380000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.694586179.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.923314997.0000000000150000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.694843913.0000000000BA0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.662094900.00000000029D0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 1.2.invoice.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.invoice.exe.29d0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.invoice.exe.29d0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.invoice.exe.400000.1.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Source: 00000001.00000002.694812494.0000000000B70000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.694812494.0000000000B70000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.923792314.0000000002380000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.923792314.0000000002380000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.694586179.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.694586179.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.923314997.0000000000150000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.923314997.0000000000150000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.694843913.0000000000BA0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.694843913.0000000000BA0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.662094900.00000000029D0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.662094900.00000000029D0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.invoice.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.invoice.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.invoice.exe.29d0000.2.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.invoice.exe.29d0000.2.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.invoice.exe.29d0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.invoice.exe.29d0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.invoice.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.invoice.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Executable has a suspicious name (potential lure to open the executable)

Source: invoice.exe

Static file information: Suspicious name

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: invoice.exe

Contains functionality to call native functions

Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_0041A050 NtClose,		1_2_0041A050
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_0041A100 NtAllocateVirtualMemory,		1_2_0041A100
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00419F20 NtCreateFile,		1_2_00419F20
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00419FD0 NtReadFile,		1_2_00419FD0
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_0041A0FA NtAllocateVirtualMemory,		1_2_0041A0FA
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00419F1A NtCreateFile,		1_2_00419F1A
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00419FCB NtReadFile,		1_2_00419FCB
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F198F0 NtReadVirtualMemory,LdrInitializeThunk,		1_2_00F198F0
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F19860 NtQuerySystemInformation,LdrInitializeThunk,		1_2_00F19860
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F19840 NtDelayExecution,LdrInitializeThunk,		1_2_00F19840
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F199A0 NtCreateSection,LdrInitializeThunk,		1_2_00F199A0
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F19910 NtAdjustPrivilegesToken,LdrInitializeThunk,		1_2_00F19910
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F19A50 NtCreateFile,LdrInitializeThunk,		1_2_00F19A50
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F19A20 NtResumeThread,LdrInitializeThunk,		1_2_00F19A20
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F19A00 NtProtectVirtualMemory,LdrInitializeThunk,		1_2_00F19A00
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F195D0 NtClose,LdrInitializeThunk,		1_2_00F195D0
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F19540 NtReadFile,LdrInitializeThunk,		1_2_00F19540
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F196E0 NtFreeVirtualMemory,LdrInitializeThunk,		1_2_00F196E0
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F19660 NtAllocateVirtualMemory,LdrInitializeThunk,		1_2_00F19660
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F197A0 NtUnmapViewOfSection,LdrInitializeThunk,		1_2_00F197A0
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F19780 NtMapViewOfSection,LdrInitializeThunk,		1_2_00F19780
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F19710 NtQueryInformationToken,LdrInitializeThunk,		1_2_00F19710
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F198A0 NtWriteVirtualMemory,		1_2_00F198A0
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F1B040 NtSuspendThread,		1_2_00F1B040
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F19820 NtEnumerateKey,		1_2_00F19820
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F199D0 NtCreateProcessEx,		1_2_00F199D0
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F19950 NtQueueApcThread,		1_2_00F19950
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F19A80 NtOpenDirectoryObject,		1_2_00F19A80
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F19A10 NtQuerySection,		1_2_00F19A10
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F1A3B0 NtGetContextThread,		1_2_00F1A3B0
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F19B00 NtSetValueKey,		1_2_00F19B00
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F195F0 NtQueryInformationFile,		1_2_00F195F0
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F19560 NtWriteFile,		1_2_00F19560
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F1AD30 NtSetContextThread,		1_2_00F1AD30
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F19520 NtWaitForSingleObject,		1_2_00F19520
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F196D0 NtCreateKey,		1_2_00F196D0
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F19670 NtQueryInformationProcess,		1_2_00F19670
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F19650 NtQueryValueKey,		1_2_00F19650
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F19610 NtEnumerateValueKey,		1_2_00F19610
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F19FE0 NtCreateMutant,		1_2_00F19FE0
Source: C:\Windows\explorer.exe	Code function: 4_2_06C00A52 NtCreateFile,		4_2_06C00A52
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04479540 NtReadFile,LdrInitializeThunk,		6_2_04479540
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044795D0 NtClose,LdrInitializeThunk,		6_2_044795D0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04479650 NtQueryValueKey,LdrInitializeThunk,		6_2_04479650
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04479660 NtAllocateVirtualMemory,LdrInitializeThunk,		6_2_04479660
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044796D0 NtCreateKey,LdrInitializeThunk,		6_2_044796D0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044796E0 NtFreeVirtualMemory,LdrInitializeThunk,		6_2_044796E0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04479710 NtQueryInformationToken,LdrInitializeThunk,		6_2_04479710
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04479FE0 NtCreateMutant,LdrInitializeThunk,		6_2_04479FE0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04479780 NtMapViewOfSection,LdrInitializeThunk,		6_2_04479780
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04479840 NtDelayExecution,LdrInitializeThunk,		6_2_04479840
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04479860 NtQuerySystemInformation,LdrInitializeThunk,		6_2_04479860
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04479910 NtAdjustPrivilegesToken,LdrInitializeThunk,		6_2_04479910
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044799A0 NtCreateSection,LdrInitializeThunk,		6_2_044799A0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04479A50 NtCreateFile,LdrInitializeThunk,		6_2_04479A50
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04479560 NtWriteFile,		6_2_04479560
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04479520 NtWaitForSingleObject,		6_2_04479520
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0447AD30 NtSetContextThread,		6_2_0447AD30
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044795F0 NtQueryInformationFile,		6_2_044795F0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04479670 NtQueryInformationProcess,		6_2_04479670
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04479610 NtEnumerateValueKey,		6_2_04479610
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04479760 NtOpenProcess,		6_2_04479760
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0447A770 NtOpenThread,		6_2_0447A770
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04479770 NtSetInformationFile,		6_2_04479770
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0447A710 NtOpenProcessToken,		6_2_0447A710
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04479730 NtQueryVirtualMemory,		6_2_04479730
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044797A0 NtUnmapViewOfSection,		6_2_044797A0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0447B040 NtSuspendThread,		6_2_0447B040
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04479820 NtEnumerateKey,		6_2_04479820
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044798F0 NtReadVirtualMemory,		6_2_044798F0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044798A0 NtWriteVirtualMemory,		6_2_044798A0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04479950 NtQueueApcThread,		6_2_04479950
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044799D0 NtCreateProcessEx,		6_2_044799D0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04479A00 NtProtectVirtualMemory,		6_2_04479A00
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04479A10 NtQuerySection,		6_2_04479A10
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04479A20 NtResumeThread,		6_2_04479A20
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04479A80 NtOpenDirectoryObject,		6_2_04479A80
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04479B00 NtSetValueKey,		6_2_04479B00
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0447A3B0 NtGetContextThread,		6_2_0447A3B0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0239A050 NtClose,		6_2_0239A050
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0239A100 NtAllocateVirtualMemory,		6_2_0239A100
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_02399F20 NtCreateFile,		6_2_02399F20
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_02399FD0 NtReadFile,		6_2_02399FD0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0239A0FA NtAllocateVirtualMemory,		6_2_0239A0FA
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_02399F1A NtCreateFile,		6_2_02399F1A
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_02399FCB NtReadFile,		6_2_02399FCB

Detected potential crypto function

Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_0030E1CF		0_2_0030E1CF
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_003230AC		0_2_003230AC
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_00322904		0_2_00322904
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_0032425D		0_2_0032425D
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_0030AAC8		0_2_0030AAC8
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_0031A33E		0_2_0031A33E
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_00312B17		0_2_00312B17
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_00313364		0_2_00313364
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_00322392		0_2_00322392
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_0030AD1B		0_2_0030AD1B
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_00312623		0_2_00312623
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_00321E20		0_2_00321E20
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_00314E9B		0_2_00314E9B
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_00311F20		0_2_00311F20
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_00312F2F		0_2_00312F2F
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_00313799		0_2_00313799
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_003230AC		1_2_003230AC
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00322904		1_2_00322904
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_0030E1CF		1_2_0030E1CF
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_0032425D		1_2_0032425D
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_0030AAC8		1_2_0030AAC8
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_0031A33E		1_2_0031A33E
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00312B17		1_2_00312B17
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00313364		1_2_00313364
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00322392		1_2_00322392
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_0030AD1B		1_2_0030AD1B
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00312623		1_2_00312623
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00321E20		1_2_00321E20
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00314E9B		1_2_00314E9B
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00311F20		1_2_00311F20
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00312F2F		1_2_00312F2F
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00313799		1_2_00313799
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00401030		1_2_00401030
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_0041E837		1_2_0041E837
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_0041E19A		1_2_0041E19A
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_0041DB18		1_2_0041DB18
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_0041E38D		1_2_0041E38D
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00402D87		1_2_00402D87
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00402D90		1_2_00402D90
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_0041DE20		1_2_0041DE20
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00409E30		1_2_00409E30
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00402FB0		1_2_00402FB0
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00FA28EC		1_2_00FA28EC
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F020A0		1_2_00F020A0
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00FA20A8		1_2_00FA20A8
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EEB090		1_2_00EEB090
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00FAE824		1_2_00FAE824
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F91002		1_2_00F91002
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EF4120		1_2_00EF4120
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EDF900		1_2_00EDF900
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00FA22AE		1_2_00FA22AE
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F903DA		1_2_00F903DA
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F9DBD2		1_2_00F9DBD2
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F0EBB0		1_2_00F0EBB0
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00FA2B28		1_2_00FA2B28
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F9D466		1_2_00F9D466
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EE841F		1_2_00EE841F
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EED5E0		1_2_00EED5E0
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00FA25DD		1_2_00FA25DD
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F02581		1_2_00F02581
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00FA1D55		1_2_00FA1D55
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00ED0D20		1_2_00ED0D20
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00FA2D07		1_2_00FA2D07
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00FA2EF7		1_2_00FA2EF7
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EF6E30		1_2_00EF6E30
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F9D616		1_2_00F9D616
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00FA1FF1		1_2_00FA1FF1
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00FADFCE		1_2_00FADFCE
Source: C:\Windows\explorer.exe	Code function: 4_2_06C00A52		4_2_06C00A52
Source: C:\Windows\explorer.exe	Code function: 4_2_06BFF882		4_2_06BFF882
Source: C:\Windows\explorer.exe	Code function: 4_2_06BF8CF2		4_2_06BF8CF2
Source: C:\Windows\explorer.exe	Code function: 4_2_06BF8CE9		4_2_06BF8CE9
Source: C:\Windows\explorer.exe	Code function: 4_2_06C03A0C		4_2_06C03A0C
Source: C:\Windows\explorer.exe	Code function: 4_2_06BF7072		4_2_06BF7072
Source: C:\Windows\explorer.exe	Code function: 4_2_06BF7069		4_2_06BF7069
Source: C:\Windows\explorer.exe	Code function: 4_2_06BFBB22		4_2_06BFBB22
Source: C:\Windows\explorer.exe	Code function: 4_2_06BFBB1F		4_2_06BFBB1F
Source: C:\Windows\explorer.exe	Code function: 4_2_06BFE152		4_2_06BFE152
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044FD466		6_2_044FD466
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0444841F		6_2_0444841F
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04501D55		6_2_04501D55
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04502D07		6_2_04502D07
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04430D20		6_2_04430D20
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_045025DD		6_2_045025DD
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0444D5E0		6_2_0444D5E0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04462581		6_2_04462581
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044FD616		6_2_044FD616
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04456E30		6_2_04456E30
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04502EF7		6_2_04502EF7
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0450DFCE		6_2_0450DFCE
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04501FF1		6_2_04501FF1
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044F1002		6_2_044F1002
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0450E824		6_2_0450E824
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_045028EC		6_2_045028EC
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0444B090		6_2_0444B090
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044620A0		6_2_044620A0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_045020A8		6_2_045020A8
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0443F900		6_2_0443F900
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04454120		6_2_04454120
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_045022AE		6_2_045022AE
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04502B28		6_2_04502B28
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044F03DA		6_2_044F03DA
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044FDBD2		6_2_044FDBD2
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0446EBB0		6_2_0446EBB0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0239E38D		6_2_0239E38D
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0239E837		6_2_0239E837
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0239E19A		6_2_0239E19A
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_02389E30		6_2_02389E30
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_02382FB0		6_2_02382FB0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_02382D90		6_2_02382D90
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_02382D87		6_2_02382D87

Found potential string decryption / allocating functions

Source: C:\Windows\SysWOW64\control.exe	Code function: String function: 0443B150 appears 45 times
Source: C:\Users\user\Desktop\invoice.exe	Code function: String function: 00310BAA appears 42 times
Source: C:\Users\user\Desktop\invoice.exe	Code function: String function: 00307570 appears 126 times
Source: C:\Users\user\Desktop\invoice.exe	Code function: String function: 00316090 appears 80 times
Source: C:\Users\user\Desktop\invoice.exe	Code function: String function: 00EDB150 appears 45 times

Sample file is different than original file name gathered from version info

Source: invoice.exe, 00000000.00000003.657254130.0000000002D3F000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs invoice.exe
Source: invoice.exe, 00000001.00000002.694907659.0000000000C1A000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameCONTROL.EXEj% vs invoice.exe
Source: invoice.exe, 00000001.00000002.695325238.000000000115F000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs invoice.exe

Yara signature match

Source: 00000001.00000002.694812494.0000000000B70000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.694812494.0000000000B70000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.923792314.0000000002380000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.923792314.0000000002380000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.694586179.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.694586179.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.923314997.0000000000150000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.923314997.0000000000150000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.694843913.0000000000BA0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.694843913.0000000000BA0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.662094900.00000000029D0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.662094900.00000000029D0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.invoice.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.invoice.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.invoice.exe.29d0000.2.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.invoice.exe.29d0000.2.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.invoice.exe.29d0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.invoice.exe.29d0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.invoice.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.invoice.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Classification label

Source: classification engine

Classification label: mal100.troj.evad.winEXE@7/0@4/3

Creates mutexes

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6756:120:WilError_01

PE file has an executable .text section and no other executable section

Source: invoice.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Source: C:\Users\user\Desktop\invoice.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Reads the hosts file

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Sample reads its own file content

Source: C:\Users\user\Desktop\invoice.exe

File read: C:\Users\user\Desktop\invoice.exe

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\invoice.exe 'C:\Users\user\Desktop\invoice.exe'
Source: unknown	Process created: C:\Users\user\Desktop\invoice.exe C:\Users\user\Desktop\invoice.exe
Source: unknown	Process created: C:\Windows\SysWOW64\control.exe C:\Windows\SysWOW64\control.exe
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\invoice.exe'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\invoice.exe	Process created: C:\Users\user\Desktop\invoice.exe C:\Users\user\Desktop\invoice.exe			Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\invoice.exe'			Jump to behavior

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: invoice.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:	Binary string: wscui.pdbUGP source: explorer.exe, 00000004.00000002.934975474.0000000005A00000.00000002.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: invoice.exe, 00000000.00000003.660665803.0000000002A90000.00000004.00000001.sdmp, invoice.exe, 00000001.00000002.695023549.0000000000EB0000.00000040.00000001.sdmp, control.exe, 00000006.00000002.924534412.000000000452F000.00000040.00000001.sdmp
Source:	Binary string: control.pdb source: invoice.exe, 00000001.00000002.694907659.0000000000C1A000.00000004.00000020.sdmp
Source:	Binary string: wntdll.pdb source: invoice.exe, control.exe
Source:	Binary string: control.pdbUGP source: invoice.exe, 00000001.00000002.694907659.0000000000C1A000.00000004.00000020.sdmp
Source:	Binary string: wscui.pdb source: explorer.exe, 00000004.00000002.934975474.0000000005A00000.00000002.00000001.sdmp

PE file contains a valid data directory to section mapping

Source: invoice.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: invoice.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: invoice.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: invoice.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: invoice.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation:

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_003160D5 push ecx; ret		0_2_003160E8
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_0032F311 push eax; ret		0_2_0032F341
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_0032F390 push eax; ret		0_2_0032F341
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_0030F55D push ecx; ret		0_2_0030F570
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_003160D5 push ecx; ret		1_2_003160E8
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_0030F55D push ecx; ret		1_2_0030F570
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00416855 push ebx; retf		1_2_00416858
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_0041D075 push eax; ret		1_2_0041D0C8
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_0041D0C2 push eax; ret		1_2_0041D0C8
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_0041D0CB push eax; ret		1_2_0041D132
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_0041D12C push eax; ret		1_2_0041D132
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00416B05 push edx; ret		1_2_00416B08
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_004163B0 push esi; iretd		1_2_0041640A
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_0041E5D3 push es; ret		1_2_0041E5E8
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F2D0D1 push ecx; ret		1_2_00F2D0E4
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0448D0D1 push ecx; ret		6_2_0448D0E4
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_02396B05 push edx; ret		6_2_02396B08
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_023963B0 push esi; iretd		6_2_0239640A
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0239D075 push eax; ret		6_2_0239D0C8
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_02396855 push ebx; retf		6_2_02396858
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0239E0AA push esp; retf 0000h		6_2_0239E0B5
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0239D0CB push eax; ret		6_2_0239D132
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0239D0C2 push eax; ret		6_2_0239D0C8
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0239D12C push eax; ret		6_2_0239D132
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0239E5D3 push es; ret		6_2_0239E5E8

Hooking and other Techniques for Hiding and Protection:

Modifies the prolog of user mode functions (user mode inline hooks)

Source: explorer.exe

User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x87 0x7E 0xE9

Extensive use of GetProcAddress (often used to hide API calls)

Source: C:\Users\user\Desktop\invoice.exe

Code function: 0_2_0030E1CF RtlEncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_0030E1CF

Disables application error messsages (SetErrorMode)

Source: C:\Windows\SysWOW64\control.exe

Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion:

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\invoice.exe	RDTSC instruction interceptor: First address: 00000000004098E4 second address: 00000000004098EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\invoice.exe	RDTSC instruction interceptor: First address: 0000000000409B4E second address: 0000000000409B54 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\control.exe	RDTSC instruction interceptor: First address: 00000000023898E4 second address: 00000000023898EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\control.exe	RDTSC instruction interceptor: First address: 0000000002389B4E second address: 0000000002389B54 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\invoice.exe

Code function: 1_2_00409A80 rdtsc

1_2_00409A80

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\explorer.exe TID: 3484	Thread sleep count: 40 > 30			Jump to behavior
Source: C:\Windows\explorer.exe TID: 3484	Thread sleep time: -80000s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\control.exe TID: 6540	Thread sleep time: -44000s >= -30000s			Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\control.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\control.exe	Last function: Thread delayed

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: explorer.exe, 00000004.00000000.675249381.00000000058C0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000004.00000000.678740166.000000000A60E000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000004.00000002.935455932.0000000006650000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000004.00000000.678740166.000000000A60E000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000004.00000000.673260391.0000000004710000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000[Wm
Source: explorer.exe, 00000004.00000000.678863688.000000000A716000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000/
Source: explorer.exe, 00000004.00000000.675249381.00000000058C0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000004.00000000.675249381.00000000058C0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 00000004.00000002.932678004.0000000004791000.00000004.00000001.sdmp	Binary or memory string: SI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI
Source: explorer.exe, 00000004.00000000.679085865.000000000A784000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000@
Source: explorer.exe, 00000004.00000000.675249381.00000000058C0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Queries a list of all running processes

Source: C:\Users\user\Desktop\invoice.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\invoice.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Process queried: DebugPort			Jump to behavior

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\invoice.exe

Code function: 1_2_00409A80 rdtsc

1_2_00409A80

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Users\user\Desktop\invoice.exe

Code function: 1_2_0040ACC0 LdrLoadDll,

1_2_0040ACC0

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\Desktop\invoice.exe

Code function: 0_2_0031EBDE EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_0031EBDE

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Source: C:\Users\user\Desktop\invoice.exe

Code function: 0_2_0031EBDE EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_0031EBDE

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_003311EC mov eax, dword ptr fs:[00000030h]		0_2_003311EC
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_00331229 mov eax, dword ptr fs:[00000030h]		0_2_00331229
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_0033128C mov eax, dword ptr fs:[00000030h]		0_2_0033128C
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_003306F8 mov eax, dword ptr fs:[00000030h]		0_2_003306F8
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00ED58EC mov eax, dword ptr fs:[00000030h]		1_2_00ED58EC
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00ED40E1 mov eax, dword ptr fs:[00000030h]		1_2_00ED40E1
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00ED40E1 mov eax, dword ptr fs:[00000030h]		1_2_00ED40E1
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00ED40E1 mov eax, dword ptr fs:[00000030h]		1_2_00ED40E1
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F6B8D0 mov eax, dword ptr fs:[00000030h]		1_2_00F6B8D0
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F6B8D0 mov ecx, dword ptr fs:[00000030h]		1_2_00F6B8D0
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F6B8D0 mov eax, dword ptr fs:[00000030h]		1_2_00F6B8D0
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F6B8D0 mov eax, dword ptr fs:[00000030h]		1_2_00F6B8D0
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F6B8D0 mov eax, dword ptr fs:[00000030h]		1_2_00F6B8D0
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F6B8D0 mov eax, dword ptr fs:[00000030h]		1_2_00F6B8D0
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F0F0BF mov ecx, dword ptr fs:[00000030h]		1_2_00F0F0BF
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F0F0BF mov eax, dword ptr fs:[00000030h]		1_2_00F0F0BF
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F0F0BF mov eax, dword ptr fs:[00000030h]		1_2_00F0F0BF
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F020A0 mov eax, dword ptr fs:[00000030h]		1_2_00F020A0
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F020A0 mov eax, dword ptr fs:[00000030h]		1_2_00F020A0
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F020A0 mov eax, dword ptr fs:[00000030h]		1_2_00F020A0
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F020A0 mov eax, dword ptr fs:[00000030h]		1_2_00F020A0
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F020A0 mov eax, dword ptr fs:[00000030h]		1_2_00F020A0
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F020A0 mov eax, dword ptr fs:[00000030h]		1_2_00F020A0
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F190AF mov eax, dword ptr fs:[00000030h]		1_2_00F190AF
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00ED9080 mov eax, dword ptr fs:[00000030h]		1_2_00ED9080
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F53884 mov eax, dword ptr fs:[00000030h]		1_2_00F53884
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F53884 mov eax, dword ptr fs:[00000030h]		1_2_00F53884
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F92073 mov eax, dword ptr fs:[00000030h]		1_2_00F92073
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00FA1074 mov eax, dword ptr fs:[00000030h]		1_2_00FA1074
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EF0050 mov eax, dword ptr fs:[00000030h]		1_2_00EF0050
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EF0050 mov eax, dword ptr fs:[00000030h]		1_2_00EF0050
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EEB02A mov eax, dword ptr fs:[00000030h]		1_2_00EEB02A
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EEB02A mov eax, dword ptr fs:[00000030h]		1_2_00EEB02A
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EEB02A mov eax, dword ptr fs:[00000030h]		1_2_00EEB02A
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EEB02A mov eax, dword ptr fs:[00000030h]		1_2_00EEB02A
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F0002D mov eax, dword ptr fs:[00000030h]		1_2_00F0002D
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F0002D mov eax, dword ptr fs:[00000030h]		1_2_00F0002D
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F0002D mov eax, dword ptr fs:[00000030h]		1_2_00F0002D
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F0002D mov eax, dword ptr fs:[00000030h]		1_2_00F0002D
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F0002D mov eax, dword ptr fs:[00000030h]		1_2_00F0002D
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F57016 mov eax, dword ptr fs:[00000030h]		1_2_00F57016
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F57016 mov eax, dword ptr fs:[00000030h]		1_2_00F57016
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F57016 mov eax, dword ptr fs:[00000030h]		1_2_00F57016
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00FA4015 mov eax, dword ptr fs:[00000030h]		1_2_00FA4015
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00FA4015 mov eax, dword ptr fs:[00000030h]		1_2_00FA4015
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EDB1E1 mov eax, dword ptr fs:[00000030h]		1_2_00EDB1E1
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EDB1E1 mov eax, dword ptr fs:[00000030h]		1_2_00EDB1E1
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EDB1E1 mov eax, dword ptr fs:[00000030h]		1_2_00EDB1E1
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F641E8 mov eax, dword ptr fs:[00000030h]		1_2_00F641E8
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F551BE mov eax, dword ptr fs:[00000030h]		1_2_00F551BE
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F551BE mov eax, dword ptr fs:[00000030h]		1_2_00F551BE
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F551BE mov eax, dword ptr fs:[00000030h]		1_2_00F551BE
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F551BE mov eax, dword ptr fs:[00000030h]		1_2_00F551BE
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F061A0 mov eax, dword ptr fs:[00000030h]		1_2_00F061A0
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F061A0 mov eax, dword ptr fs:[00000030h]		1_2_00F061A0
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F569A6 mov eax, dword ptr fs:[00000030h]		1_2_00F569A6
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F949A4 mov eax, dword ptr fs:[00000030h]		1_2_00F949A4
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F949A4 mov eax, dword ptr fs:[00000030h]		1_2_00F949A4
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F949A4 mov eax, dword ptr fs:[00000030h]		1_2_00F949A4
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F949A4 mov eax, dword ptr fs:[00000030h]		1_2_00F949A4
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F02990 mov eax, dword ptr fs:[00000030h]		1_2_00F02990
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EFC182 mov eax, dword ptr fs:[00000030h]		1_2_00EFC182
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F0A185 mov eax, dword ptr fs:[00000030h]		1_2_00F0A185
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EDC962 mov eax, dword ptr fs:[00000030h]		1_2_00EDC962
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EDB171 mov eax, dword ptr fs:[00000030h]		1_2_00EDB171
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EDB171 mov eax, dword ptr fs:[00000030h]		1_2_00EDB171
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EFB944 mov eax, dword ptr fs:[00000030h]		1_2_00EFB944
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EFB944 mov eax, dword ptr fs:[00000030h]		1_2_00EFB944
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F0513A mov eax, dword ptr fs:[00000030h]		1_2_00F0513A
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F0513A mov eax, dword ptr fs:[00000030h]		1_2_00F0513A
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EF4120 mov eax, dword ptr fs:[00000030h]		1_2_00EF4120
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EF4120 mov eax, dword ptr fs:[00000030h]		1_2_00EF4120
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EF4120 mov eax, dword ptr fs:[00000030h]		1_2_00EF4120
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EF4120 mov eax, dword ptr fs:[00000030h]		1_2_00EF4120
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EF4120 mov ecx, dword ptr fs:[00000030h]		1_2_00EF4120
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00ED9100 mov eax, dword ptr fs:[00000030h]		1_2_00ED9100
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00ED9100 mov eax, dword ptr fs:[00000030h]		1_2_00ED9100
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00ED9100 mov eax, dword ptr fs:[00000030h]		1_2_00ED9100
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F02AE4 mov eax, dword ptr fs:[00000030h]		1_2_00F02AE4
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F02ACB mov eax, dword ptr fs:[00000030h]		1_2_00F02ACB
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F0FAB0 mov eax, dword ptr fs:[00000030h]		1_2_00F0FAB0
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00ED52A5 mov eax, dword ptr fs:[00000030h]		1_2_00ED52A5
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00ED52A5 mov eax, dword ptr fs:[00000030h]		1_2_00ED52A5
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00ED52A5 mov eax, dword ptr fs:[00000030h]		1_2_00ED52A5
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00ED52A5 mov eax, dword ptr fs:[00000030h]		1_2_00ED52A5
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00ED52A5 mov eax, dword ptr fs:[00000030h]		1_2_00ED52A5
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EEAAB0 mov eax, dword ptr fs:[00000030h]		1_2_00EEAAB0
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EEAAB0 mov eax, dword ptr fs:[00000030h]		1_2_00EEAAB0
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F0D294 mov eax, dword ptr fs:[00000030h]		1_2_00F0D294
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F0D294 mov eax, dword ptr fs:[00000030h]		1_2_00F0D294
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F1927A mov eax, dword ptr fs:[00000030h]		1_2_00F1927A
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F8B260 mov eax, dword ptr fs:[00000030h]		1_2_00F8B260
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F8B260 mov eax, dword ptr fs:[00000030h]		1_2_00F8B260
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00FA8A62 mov eax, dword ptr fs:[00000030h]		1_2_00FA8A62
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F64257 mov eax, dword ptr fs:[00000030h]		1_2_00F64257
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F9EA55 mov eax, dword ptr fs:[00000030h]		1_2_00F9EA55
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00ED9240 mov eax, dword ptr fs:[00000030h]		1_2_00ED9240
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00ED9240 mov eax, dword ptr fs:[00000030h]		1_2_00ED9240
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00ED9240 mov eax, dword ptr fs:[00000030h]		1_2_00ED9240
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00ED9240 mov eax, dword ptr fs:[00000030h]		1_2_00ED9240
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F14A2C mov eax, dword ptr fs:[00000030h]		1_2_00F14A2C
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F14A2C mov eax, dword ptr fs:[00000030h]		1_2_00F14A2C
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EE8A0A mov eax, dword ptr fs:[00000030h]		1_2_00EE8A0A
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F9AA16 mov eax, dword ptr fs:[00000030h]		1_2_00F9AA16
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F9AA16 mov eax, dword ptr fs:[00000030h]		1_2_00F9AA16
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EF3A1C mov eax, dword ptr fs:[00000030h]		1_2_00EF3A1C
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EDAA16 mov eax, dword ptr fs:[00000030h]		1_2_00EDAA16
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EDAA16 mov eax, dword ptr fs:[00000030h]		1_2_00EDAA16
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00ED5210 mov eax, dword ptr fs:[00000030h]		1_2_00ED5210
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00ED5210 mov ecx, dword ptr fs:[00000030h]		1_2_00ED5210
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00ED5210 mov eax, dword ptr fs:[00000030h]		1_2_00ED5210
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00ED5210 mov eax, dword ptr fs:[00000030h]		1_2_00ED5210
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EFDBE9 mov eax, dword ptr fs:[00000030h]		1_2_00EFDBE9
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F003E2 mov eax, dword ptr fs:[00000030h]		1_2_00F003E2
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F003E2 mov eax, dword ptr fs:[00000030h]		1_2_00F003E2
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F003E2 mov eax, dword ptr fs:[00000030h]		1_2_00F003E2
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F003E2 mov eax, dword ptr fs:[00000030h]		1_2_00F003E2
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F003E2 mov eax, dword ptr fs:[00000030h]		1_2_00F003E2
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F003E2 mov eax, dword ptr fs:[00000030h]		1_2_00F003E2
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F553CA mov eax, dword ptr fs:[00000030h]		1_2_00F553CA
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F553CA mov eax, dword ptr fs:[00000030h]		1_2_00F553CA
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F04BAD mov eax, dword ptr fs:[00000030h]		1_2_00F04BAD
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F04BAD mov eax, dword ptr fs:[00000030h]		1_2_00F04BAD
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F04BAD mov eax, dword ptr fs:[00000030h]		1_2_00F04BAD
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00FA5BA5 mov eax, dword ptr fs:[00000030h]		1_2_00FA5BA5
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F0B390 mov eax, dword ptr fs:[00000030h]		1_2_00F0B390
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EE1B8F mov eax, dword ptr fs:[00000030h]		1_2_00EE1B8F
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EE1B8F mov eax, dword ptr fs:[00000030h]		1_2_00EE1B8F
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F02397 mov eax, dword ptr fs:[00000030h]		1_2_00F02397
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F9138A mov eax, dword ptr fs:[00000030h]		1_2_00F9138A
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F8D380 mov ecx, dword ptr fs:[00000030h]		1_2_00F8D380
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F03B7A mov eax, dword ptr fs:[00000030h]		1_2_00F03B7A
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F03B7A mov eax, dword ptr fs:[00000030h]		1_2_00F03B7A
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EDDB60 mov ecx, dword ptr fs:[00000030h]		1_2_00EDDB60
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00FA8B58 mov eax, dword ptr fs:[00000030h]		1_2_00FA8B58
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EDDB40 mov eax, dword ptr fs:[00000030h]		1_2_00EDDB40
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EDF358 mov eax, dword ptr fs:[00000030h]		1_2_00EDF358
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F9131B mov eax, dword ptr fs:[00000030h]		1_2_00F9131B
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F914FB mov eax, dword ptr fs:[00000030h]		1_2_00F914FB
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F56CF0 mov eax, dword ptr fs:[00000030h]		1_2_00F56CF0
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F56CF0 mov eax, dword ptr fs:[00000030h]		1_2_00F56CF0
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F56CF0 mov eax, dword ptr fs:[00000030h]		1_2_00F56CF0
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00FA8CD6 mov eax, dword ptr fs:[00000030h]		1_2_00FA8CD6
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EE849B mov eax, dword ptr fs:[00000030h]		1_2_00EE849B
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EF746D mov eax, dword ptr fs:[00000030h]		1_2_00EF746D
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F6C450 mov eax, dword ptr fs:[00000030h]		1_2_00F6C450
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F6C450 mov eax, dword ptr fs:[00000030h]		1_2_00F6C450
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F0A44B mov eax, dword ptr fs:[00000030h]		1_2_00F0A44B
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F0BC2C mov eax, dword ptr fs:[00000030h]		1_2_00F0BC2C
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00FA740D mov eax, dword ptr fs:[00000030h]		1_2_00FA740D
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00FA740D mov eax, dword ptr fs:[00000030h]		1_2_00FA740D
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00FA740D mov eax, dword ptr fs:[00000030h]		1_2_00FA740D
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F91C06 mov eax, dword ptr fs:[00000030h]		1_2_00F91C06
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F91C06 mov eax, dword ptr fs:[00000030h]		1_2_00F91C06
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F91C06 mov eax, dword ptr fs:[00000030h]		1_2_00F91C06
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F91C06 mov eax, dword ptr fs:[00000030h]		1_2_00F91C06
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F91C06 mov eax, dword ptr fs:[00000030h]		1_2_00F91C06
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F91C06 mov eax, dword ptr fs:[00000030h]		1_2_00F91C06
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F91C06 mov eax, dword ptr fs:[00000030h]		1_2_00F91C06
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F91C06 mov eax, dword ptr fs:[00000030h]		1_2_00F91C06
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F91C06 mov eax, dword ptr fs:[00000030h]		1_2_00F91C06
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F91C06 mov eax, dword ptr fs:[00000030h]		1_2_00F91C06
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F91C06 mov eax, dword ptr fs:[00000030h]		1_2_00F91C06
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F91C06 mov eax, dword ptr fs:[00000030h]		1_2_00F91C06
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F91C06 mov eax, dword ptr fs:[00000030h]		1_2_00F91C06
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F91C06 mov eax, dword ptr fs:[00000030h]		1_2_00F91C06
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F56C0A mov eax, dword ptr fs:[00000030h]		1_2_00F56C0A
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F56C0A mov eax, dword ptr fs:[00000030h]		1_2_00F56C0A
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F56C0A mov eax, dword ptr fs:[00000030h]		1_2_00F56C0A
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F56C0A mov eax, dword ptr fs:[00000030h]		1_2_00F56C0A
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F88DF1 mov eax, dword ptr fs:[00000030h]		1_2_00F88DF1
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EED5E0 mov eax, dword ptr fs:[00000030h]		1_2_00EED5E0
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EED5E0 mov eax, dword ptr fs:[00000030h]		1_2_00EED5E0
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F9FDE2 mov eax, dword ptr fs:[00000030h]		1_2_00F9FDE2
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F9FDE2 mov eax, dword ptr fs:[00000030h]		1_2_00F9FDE2
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F9FDE2 mov eax, dword ptr fs:[00000030h]		1_2_00F9FDE2
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F9FDE2 mov eax, dword ptr fs:[00000030h]		1_2_00F9FDE2
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F56DC9 mov eax, dword ptr fs:[00000030h]		1_2_00F56DC9
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F56DC9 mov eax, dword ptr fs:[00000030h]		1_2_00F56DC9
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F56DC9 mov eax, dword ptr fs:[00000030h]		1_2_00F56DC9
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F56DC9 mov ecx, dword ptr fs:[00000030h]		1_2_00F56DC9
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F56DC9 mov eax, dword ptr fs:[00000030h]		1_2_00F56DC9
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F56DC9 mov eax, dword ptr fs:[00000030h]		1_2_00F56DC9
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F01DB5 mov eax, dword ptr fs:[00000030h]		1_2_00F01DB5
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F01DB5 mov eax, dword ptr fs:[00000030h]		1_2_00F01DB5
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F01DB5 mov eax, dword ptr fs:[00000030h]		1_2_00F01DB5
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F035A1 mov eax, dword ptr fs:[00000030h]		1_2_00F035A1
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00FA05AC mov eax, dword ptr fs:[00000030h]		1_2_00FA05AC
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00FA05AC mov eax, dword ptr fs:[00000030h]		1_2_00FA05AC
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00ED2D8A mov eax, dword ptr fs:[00000030h]		1_2_00ED2D8A
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00ED2D8A mov eax, dword ptr fs:[00000030h]		1_2_00ED2D8A
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00ED2D8A mov eax, dword ptr fs:[00000030h]		1_2_00ED2D8A
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00ED2D8A mov eax, dword ptr fs:[00000030h]		1_2_00ED2D8A
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00ED2D8A mov eax, dword ptr fs:[00000030h]		1_2_00ED2D8A
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F0FD9B mov eax, dword ptr fs:[00000030h]		1_2_00F0FD9B
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F0FD9B mov eax, dword ptr fs:[00000030h]		1_2_00F0FD9B
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F02581 mov eax, dword ptr fs:[00000030h]		1_2_00F02581
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F02581 mov eax, dword ptr fs:[00000030h]		1_2_00F02581
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F02581 mov eax, dword ptr fs:[00000030h]		1_2_00F02581
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F02581 mov eax, dword ptr fs:[00000030h]		1_2_00F02581
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EFC577 mov eax, dword ptr fs:[00000030h]		1_2_00EFC577
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EFC577 mov eax, dword ptr fs:[00000030h]		1_2_00EFC577
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F13D43 mov eax, dword ptr fs:[00000030h]		1_2_00F13D43
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F53540 mov eax, dword ptr fs:[00000030h]		1_2_00F53540
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F83D40 mov eax, dword ptr fs:[00000030h]		1_2_00F83D40
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EF7D50 mov eax, dword ptr fs:[00000030h]		1_2_00EF7D50
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F9E539 mov eax, dword ptr fs:[00000030h]		1_2_00F9E539
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F5A537 mov eax, dword ptr fs:[00000030h]		1_2_00F5A537
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F04D3B mov eax, dword ptr fs:[00000030h]		1_2_00F04D3B
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F04D3B mov eax, dword ptr fs:[00000030h]		1_2_00F04D3B
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F04D3B mov eax, dword ptr fs:[00000030h]		1_2_00F04D3B
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00FA8D34 mov eax, dword ptr fs:[00000030h]		1_2_00FA8D34
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EE3D34 mov eax, dword ptr fs:[00000030h]		1_2_00EE3D34
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EE3D34 mov eax, dword ptr fs:[00000030h]		1_2_00EE3D34
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EE3D34 mov eax, dword ptr fs:[00000030h]		1_2_00EE3D34
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EE3D34 mov eax, dword ptr fs:[00000030h]		1_2_00EE3D34
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EE3D34 mov eax, dword ptr fs:[00000030h]		1_2_00EE3D34
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EE3D34 mov eax, dword ptr fs:[00000030h]		1_2_00EE3D34
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EE3D34 mov eax, dword ptr fs:[00000030h]		1_2_00EE3D34
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EE3D34 mov eax, dword ptr fs:[00000030h]		1_2_00EE3D34
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EE3D34 mov eax, dword ptr fs:[00000030h]		1_2_00EE3D34
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EE3D34 mov eax, dword ptr fs:[00000030h]		1_2_00EE3D34
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EE3D34 mov eax, dword ptr fs:[00000030h]		1_2_00EE3D34
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EE3D34 mov eax, dword ptr fs:[00000030h]		1_2_00EE3D34
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EE3D34 mov eax, dword ptr fs:[00000030h]		1_2_00EE3D34
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EDAD30 mov eax, dword ptr fs:[00000030h]		1_2_00EDAD30
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EE76E2 mov eax, dword ptr fs:[00000030h]		1_2_00EE76E2
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F016E0 mov ecx, dword ptr fs:[00000030h]		1_2_00F016E0
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00FA8ED6 mov eax, dword ptr fs:[00000030h]		1_2_00FA8ED6
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F18EC7 mov eax, dword ptr fs:[00000030h]		1_2_00F18EC7
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F8FEC0 mov eax, dword ptr fs:[00000030h]		1_2_00F8FEC0
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F036CC mov eax, dword ptr fs:[00000030h]		1_2_00F036CC
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F546A7 mov eax, dword ptr fs:[00000030h]		1_2_00F546A7
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00FA0EA5 mov eax, dword ptr fs:[00000030h]		1_2_00FA0EA5
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00FA0EA5 mov eax, dword ptr fs:[00000030h]		1_2_00FA0EA5
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00FA0EA5 mov eax, dword ptr fs:[00000030h]		1_2_00FA0EA5
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F6FE87 mov eax, dword ptr fs:[00000030h]		1_2_00F6FE87
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EE766D mov eax, dword ptr fs:[00000030h]		1_2_00EE766D
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EFAE73 mov eax, dword ptr fs:[00000030h]		1_2_00EFAE73
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EFAE73 mov eax, dword ptr fs:[00000030h]		1_2_00EFAE73
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EFAE73 mov eax, dword ptr fs:[00000030h]		1_2_00EFAE73
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EFAE73 mov eax, dword ptr fs:[00000030h]		1_2_00EFAE73
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EFAE73 mov eax, dword ptr fs:[00000030h]		1_2_00EFAE73
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EE7E41 mov eax, dword ptr fs:[00000030h]		1_2_00EE7E41
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EE7E41 mov eax, dword ptr fs:[00000030h]		1_2_00EE7E41
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EE7E41 mov eax, dword ptr fs:[00000030h]		1_2_00EE7E41
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EE7E41 mov eax, dword ptr fs:[00000030h]		1_2_00EE7E41
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EE7E41 mov eax, dword ptr fs:[00000030h]		1_2_00EE7E41
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EE7E41 mov eax, dword ptr fs:[00000030h]		1_2_00EE7E41
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F9AE44 mov eax, dword ptr fs:[00000030h]		1_2_00F9AE44
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F9AE44 mov eax, dword ptr fs:[00000030h]		1_2_00F9AE44
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F8FE3F mov eax, dword ptr fs:[00000030h]		1_2_00F8FE3F
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EDE620 mov eax, dword ptr fs:[00000030h]		1_2_00EDE620
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F0A61C mov eax, dword ptr fs:[00000030h]		1_2_00F0A61C
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F0A61C mov eax, dword ptr fs:[00000030h]		1_2_00F0A61C
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EDC600 mov eax, dword ptr fs:[00000030h]		1_2_00EDC600
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EDC600 mov eax, dword ptr fs:[00000030h]		1_2_00EDC600
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EDC600 mov eax, dword ptr fs:[00000030h]		1_2_00EDC600
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F08E00 mov eax, dword ptr fs:[00000030h]		1_2_00F08E00
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F91608 mov eax, dword ptr fs:[00000030h]		1_2_00F91608
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F137F5 mov eax, dword ptr fs:[00000030h]		1_2_00F137F5
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F57794 mov eax, dword ptr fs:[00000030h]		1_2_00F57794
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F57794 mov eax, dword ptr fs:[00000030h]		1_2_00F57794
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00F57794 mov eax, dword ptr fs:[00000030h]		1_2_00F57794
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00EE8794 mov eax, dword ptr fs:[00000030h]		1_2_00EE8794
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0446A44B mov eax, dword ptr fs:[00000030h]		6_2_0446A44B
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044CC450 mov eax, dword ptr fs:[00000030h]		6_2_044CC450
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044CC450 mov eax, dword ptr fs:[00000030h]		6_2_044CC450
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0445746D mov eax, dword ptr fs:[00000030h]		6_2_0445746D
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044B6C0A mov eax, dword ptr fs:[00000030h]		6_2_044B6C0A
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044B6C0A mov eax, dword ptr fs:[00000030h]		6_2_044B6C0A
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044B6C0A mov eax, dword ptr fs:[00000030h]		6_2_044B6C0A
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044B6C0A mov eax, dword ptr fs:[00000030h]		6_2_044B6C0A
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044F1C06 mov eax, dword ptr fs:[00000030h]		6_2_044F1C06
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044F1C06 mov eax, dword ptr fs:[00000030h]		6_2_044F1C06
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044F1C06 mov eax, dword ptr fs:[00000030h]		6_2_044F1C06
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044F1C06 mov eax, dword ptr fs:[00000030h]		6_2_044F1C06
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044F1C06 mov eax, dword ptr fs:[00000030h]		6_2_044F1C06
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044F1C06 mov eax, dword ptr fs:[00000030h]		6_2_044F1C06
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044F1C06 mov eax, dword ptr fs:[00000030h]		6_2_044F1C06
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044F1C06 mov eax, dword ptr fs:[00000030h]		6_2_044F1C06
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044F1C06 mov eax, dword ptr fs:[00000030h]		6_2_044F1C06
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044F1C06 mov eax, dword ptr fs:[00000030h]		6_2_044F1C06
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044F1C06 mov eax, dword ptr fs:[00000030h]		6_2_044F1C06
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044F1C06 mov eax, dword ptr fs:[00000030h]		6_2_044F1C06
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044F1C06 mov eax, dword ptr fs:[00000030h]		6_2_044F1C06
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044F1C06 mov eax, dword ptr fs:[00000030h]		6_2_044F1C06
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0450740D mov eax, dword ptr fs:[00000030h]		6_2_0450740D
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0450740D mov eax, dword ptr fs:[00000030h]		6_2_0450740D
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0450740D mov eax, dword ptr fs:[00000030h]		6_2_0450740D
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0446BC2C mov eax, dword ptr fs:[00000030h]		6_2_0446BC2C
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04508CD6 mov eax, dword ptr fs:[00000030h]		6_2_04508CD6
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044F14FB mov eax, dword ptr fs:[00000030h]		6_2_044F14FB
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044B6CF0 mov eax, dword ptr fs:[00000030h]		6_2_044B6CF0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044B6CF0 mov eax, dword ptr fs:[00000030h]		6_2_044B6CF0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044B6CF0 mov eax, dword ptr fs:[00000030h]		6_2_044B6CF0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0444849B mov eax, dword ptr fs:[00000030h]		6_2_0444849B
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04473D43 mov eax, dword ptr fs:[00000030h]		6_2_04473D43
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044B3540 mov eax, dword ptr fs:[00000030h]		6_2_044B3540
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044E3D40 mov eax, dword ptr fs:[00000030h]		6_2_044E3D40
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04457D50 mov eax, dword ptr fs:[00000030h]		6_2_04457D50
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0445C577 mov eax, dword ptr fs:[00000030h]		6_2_0445C577
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0445C577 mov eax, dword ptr fs:[00000030h]		6_2_0445C577
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04508D34 mov eax, dword ptr fs:[00000030h]		6_2_04508D34
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04443D34 mov eax, dword ptr fs:[00000030h]		6_2_04443D34
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04443D34 mov eax, dword ptr fs:[00000030h]		6_2_04443D34
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04443D34 mov eax, dword ptr fs:[00000030h]		6_2_04443D34
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04443D34 mov eax, dword ptr fs:[00000030h]		6_2_04443D34
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04443D34 mov eax, dword ptr fs:[00000030h]		6_2_04443D34
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04443D34 mov eax, dword ptr fs:[00000030h]		6_2_04443D34
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04443D34 mov eax, dword ptr fs:[00000030h]		6_2_04443D34
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04443D34 mov eax, dword ptr fs:[00000030h]		6_2_04443D34
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04443D34 mov eax, dword ptr fs:[00000030h]		6_2_04443D34
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04443D34 mov eax, dword ptr fs:[00000030h]		6_2_04443D34
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04443D34 mov eax, dword ptr fs:[00000030h]		6_2_04443D34
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04443D34 mov eax, dword ptr fs:[00000030h]		6_2_04443D34
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04443D34 mov eax, dword ptr fs:[00000030h]		6_2_04443D34
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0443AD30 mov eax, dword ptr fs:[00000030h]		6_2_0443AD30
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044FE539 mov eax, dword ptr fs:[00000030h]		6_2_044FE539
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044BA537 mov eax, dword ptr fs:[00000030h]		6_2_044BA537
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04464D3B mov eax, dword ptr fs:[00000030h]		6_2_04464D3B
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04464D3B mov eax, dword ptr fs:[00000030h]		6_2_04464D3B
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04464D3B mov eax, dword ptr fs:[00000030h]		6_2_04464D3B
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044B6DC9 mov eax, dword ptr fs:[00000030h]		6_2_044B6DC9
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044B6DC9 mov eax, dword ptr fs:[00000030h]		6_2_044B6DC9
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044B6DC9 mov eax, dword ptr fs:[00000030h]		6_2_044B6DC9
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044B6DC9 mov ecx, dword ptr fs:[00000030h]		6_2_044B6DC9
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044B6DC9 mov eax, dword ptr fs:[00000030h]		6_2_044B6DC9
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044B6DC9 mov eax, dword ptr fs:[00000030h]		6_2_044B6DC9
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0444D5E0 mov eax, dword ptr fs:[00000030h]		6_2_0444D5E0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0444D5E0 mov eax, dword ptr fs:[00000030h]		6_2_0444D5E0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044FFDE2 mov eax, dword ptr fs:[00000030h]		6_2_044FFDE2
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044FFDE2 mov eax, dword ptr fs:[00000030h]		6_2_044FFDE2
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044FFDE2 mov eax, dword ptr fs:[00000030h]		6_2_044FFDE2
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044FFDE2 mov eax, dword ptr fs:[00000030h]		6_2_044FFDE2
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044E8DF1 mov eax, dword ptr fs:[00000030h]		6_2_044E8DF1
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04462581 mov eax, dword ptr fs:[00000030h]		6_2_04462581
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04462581 mov eax, dword ptr fs:[00000030h]		6_2_04462581
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04462581 mov eax, dword ptr fs:[00000030h]		6_2_04462581
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04462581 mov eax, dword ptr fs:[00000030h]		6_2_04462581
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04432D8A mov eax, dword ptr fs:[00000030h]		6_2_04432D8A
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04432D8A mov eax, dword ptr fs:[00000030h]		6_2_04432D8A
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04432D8A mov eax, dword ptr fs:[00000030h]		6_2_04432D8A
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04432D8A mov eax, dword ptr fs:[00000030h]		6_2_04432D8A
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04432D8A mov eax, dword ptr fs:[00000030h]		6_2_04432D8A
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0446FD9B mov eax, dword ptr fs:[00000030h]		6_2_0446FD9B
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0446FD9B mov eax, dword ptr fs:[00000030h]		6_2_0446FD9B
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044635A1 mov eax, dword ptr fs:[00000030h]		6_2_044635A1
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04461DB5 mov eax, dword ptr fs:[00000030h]		6_2_04461DB5
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04461DB5 mov eax, dword ptr fs:[00000030h]		6_2_04461DB5
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04461DB5 mov eax, dword ptr fs:[00000030h]		6_2_04461DB5
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_045005AC mov eax, dword ptr fs:[00000030h]		6_2_045005AC
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_045005AC mov eax, dword ptr fs:[00000030h]		6_2_045005AC
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04447E41 mov eax, dword ptr fs:[00000030h]		6_2_04447E41
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04447E41 mov eax, dword ptr fs:[00000030h]		6_2_04447E41
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04447E41 mov eax, dword ptr fs:[00000030h]		6_2_04447E41
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04447E41 mov eax, dword ptr fs:[00000030h]		6_2_04447E41
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04447E41 mov eax, dword ptr fs:[00000030h]		6_2_04447E41
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04447E41 mov eax, dword ptr fs:[00000030h]		6_2_04447E41
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044FAE44 mov eax, dword ptr fs:[00000030h]		6_2_044FAE44
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044FAE44 mov eax, dword ptr fs:[00000030h]		6_2_044FAE44
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0444766D mov eax, dword ptr fs:[00000030h]		6_2_0444766D
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0445AE73 mov eax, dword ptr fs:[00000030h]		6_2_0445AE73
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0445AE73 mov eax, dword ptr fs:[00000030h]		6_2_0445AE73
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0445AE73 mov eax, dword ptr fs:[00000030h]		6_2_0445AE73
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0445AE73 mov eax, dword ptr fs:[00000030h]		6_2_0445AE73
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0445AE73 mov eax, dword ptr fs:[00000030h]		6_2_0445AE73
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0443C600 mov eax, dword ptr fs:[00000030h]		6_2_0443C600
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0443C600 mov eax, dword ptr fs:[00000030h]		6_2_0443C600
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0443C600 mov eax, dword ptr fs:[00000030h]		6_2_0443C600
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04468E00 mov eax, dword ptr fs:[00000030h]		6_2_04468E00
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044F1608 mov eax, dword ptr fs:[00000030h]		6_2_044F1608
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0446A61C mov eax, dword ptr fs:[00000030h]		6_2_0446A61C
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0446A61C mov eax, dword ptr fs:[00000030h]		6_2_0446A61C
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0443E620 mov eax, dword ptr fs:[00000030h]		6_2_0443E620
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044EFE3F mov eax, dword ptr fs:[00000030h]		6_2_044EFE3F
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04478EC7 mov eax, dword ptr fs:[00000030h]		6_2_04478EC7
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04508ED6 mov eax, dword ptr fs:[00000030h]		6_2_04508ED6
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044636CC mov eax, dword ptr fs:[00000030h]		6_2_044636CC
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044EFEC0 mov eax, dword ptr fs:[00000030h]		6_2_044EFEC0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044616E0 mov ecx, dword ptr fs:[00000030h]		6_2_044616E0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044476E2 mov eax, dword ptr fs:[00000030h]		6_2_044476E2
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044CFE87 mov eax, dword ptr fs:[00000030h]		6_2_044CFE87
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044B46A7 mov eax, dword ptr fs:[00000030h]		6_2_044B46A7
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04500EA5 mov eax, dword ptr fs:[00000030h]		6_2_04500EA5
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04500EA5 mov eax, dword ptr fs:[00000030h]		6_2_04500EA5
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04500EA5 mov eax, dword ptr fs:[00000030h]		6_2_04500EA5
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0444EF40 mov eax, dword ptr fs:[00000030h]		6_2_0444EF40
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0444FF60 mov eax, dword ptr fs:[00000030h]		6_2_0444FF60
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04508F6A mov eax, dword ptr fs:[00000030h]		6_2_04508F6A
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0446A70E mov eax, dword ptr fs:[00000030h]		6_2_0446A70E
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0446A70E mov eax, dword ptr fs:[00000030h]		6_2_0446A70E
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0445F716 mov eax, dword ptr fs:[00000030h]		6_2_0445F716
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044CFF10 mov eax, dword ptr fs:[00000030h]		6_2_044CFF10
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044CFF10 mov eax, dword ptr fs:[00000030h]		6_2_044CFF10
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0450070D mov eax, dword ptr fs:[00000030h]		6_2_0450070D
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0450070D mov eax, dword ptr fs:[00000030h]		6_2_0450070D
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04434F2E mov eax, dword ptr fs:[00000030h]		6_2_04434F2E
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04434F2E mov eax, dword ptr fs:[00000030h]		6_2_04434F2E
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0446E730 mov eax, dword ptr fs:[00000030h]		6_2_0446E730
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044737F5 mov eax, dword ptr fs:[00000030h]		6_2_044737F5
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04448794 mov eax, dword ptr fs:[00000030h]		6_2_04448794
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044B7794 mov eax, dword ptr fs:[00000030h]		6_2_044B7794
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044B7794 mov eax, dword ptr fs:[00000030h]		6_2_044B7794
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044B7794 mov eax, dword ptr fs:[00000030h]		6_2_044B7794
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04450050 mov eax, dword ptr fs:[00000030h]		6_2_04450050
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04450050 mov eax, dword ptr fs:[00000030h]		6_2_04450050
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04501074 mov eax, dword ptr fs:[00000030h]		6_2_04501074
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044F2073 mov eax, dword ptr fs:[00000030h]		6_2_044F2073
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04504015 mov eax, dword ptr fs:[00000030h]		6_2_04504015
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04504015 mov eax, dword ptr fs:[00000030h]		6_2_04504015
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044B7016 mov eax, dword ptr fs:[00000030h]		6_2_044B7016
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044B7016 mov eax, dword ptr fs:[00000030h]		6_2_044B7016
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044B7016 mov eax, dword ptr fs:[00000030h]		6_2_044B7016
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0446002D mov eax, dword ptr fs:[00000030h]		6_2_0446002D
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0446002D mov eax, dword ptr fs:[00000030h]		6_2_0446002D
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0446002D mov eax, dword ptr fs:[00000030h]		6_2_0446002D
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0446002D mov eax, dword ptr fs:[00000030h]		6_2_0446002D
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0446002D mov eax, dword ptr fs:[00000030h]		6_2_0446002D
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0444B02A mov eax, dword ptr fs:[00000030h]		6_2_0444B02A
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0444B02A mov eax, dword ptr fs:[00000030h]		6_2_0444B02A
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0444B02A mov eax, dword ptr fs:[00000030h]		6_2_0444B02A
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0444B02A mov eax, dword ptr fs:[00000030h]		6_2_0444B02A
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044CB8D0 mov eax, dword ptr fs:[00000030h]		6_2_044CB8D0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044CB8D0 mov ecx, dword ptr fs:[00000030h]		6_2_044CB8D0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044CB8D0 mov eax, dword ptr fs:[00000030h]		6_2_044CB8D0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044CB8D0 mov eax, dword ptr fs:[00000030h]		6_2_044CB8D0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044CB8D0 mov eax, dword ptr fs:[00000030h]		6_2_044CB8D0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044CB8D0 mov eax, dword ptr fs:[00000030h]		6_2_044CB8D0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044340E1 mov eax, dword ptr fs:[00000030h]		6_2_044340E1
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044340E1 mov eax, dword ptr fs:[00000030h]		6_2_044340E1
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044340E1 mov eax, dword ptr fs:[00000030h]		6_2_044340E1
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044358EC mov eax, dword ptr fs:[00000030h]		6_2_044358EC
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04439080 mov eax, dword ptr fs:[00000030h]		6_2_04439080
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044B3884 mov eax, dword ptr fs:[00000030h]		6_2_044B3884
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044B3884 mov eax, dword ptr fs:[00000030h]		6_2_044B3884
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044620A0 mov eax, dword ptr fs:[00000030h]		6_2_044620A0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044620A0 mov eax, dword ptr fs:[00000030h]		6_2_044620A0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044620A0 mov eax, dword ptr fs:[00000030h]		6_2_044620A0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044620A0 mov eax, dword ptr fs:[00000030h]		6_2_044620A0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044620A0 mov eax, dword ptr fs:[00000030h]		6_2_044620A0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044620A0 mov eax, dword ptr fs:[00000030h]		6_2_044620A0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044790AF mov eax, dword ptr fs:[00000030h]		6_2_044790AF
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0446F0BF mov ecx, dword ptr fs:[00000030h]		6_2_0446F0BF
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0446F0BF mov eax, dword ptr fs:[00000030h]		6_2_0446F0BF
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0446F0BF mov eax, dword ptr fs:[00000030h]		6_2_0446F0BF
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0445B944 mov eax, dword ptr fs:[00000030h]		6_2_0445B944
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0445B944 mov eax, dword ptr fs:[00000030h]		6_2_0445B944
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0443C962 mov eax, dword ptr fs:[00000030h]		6_2_0443C962
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0443B171 mov eax, dword ptr fs:[00000030h]		6_2_0443B171
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0443B171 mov eax, dword ptr fs:[00000030h]		6_2_0443B171
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04439100 mov eax, dword ptr fs:[00000030h]		6_2_04439100
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04439100 mov eax, dword ptr fs:[00000030h]		6_2_04439100
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04439100 mov eax, dword ptr fs:[00000030h]		6_2_04439100
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04454120 mov eax, dword ptr fs:[00000030h]		6_2_04454120
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04454120 mov eax, dword ptr fs:[00000030h]		6_2_04454120
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04454120 mov eax, dword ptr fs:[00000030h]		6_2_04454120
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04454120 mov eax, dword ptr fs:[00000030h]		6_2_04454120
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04454120 mov ecx, dword ptr fs:[00000030h]		6_2_04454120
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0446513A mov eax, dword ptr fs:[00000030h]		6_2_0446513A
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0446513A mov eax, dword ptr fs:[00000030h]		6_2_0446513A
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0443B1E1 mov eax, dword ptr fs:[00000030h]		6_2_0443B1E1
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0443B1E1 mov eax, dword ptr fs:[00000030h]		6_2_0443B1E1
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0443B1E1 mov eax, dword ptr fs:[00000030h]		6_2_0443B1E1
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044C41E8 mov eax, dword ptr fs:[00000030h]		6_2_044C41E8
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0446A185 mov eax, dword ptr fs:[00000030h]		6_2_0446A185
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0445C182 mov eax, dword ptr fs:[00000030h]		6_2_0445C182
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04462990 mov eax, dword ptr fs:[00000030h]		6_2_04462990
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044661A0 mov eax, dword ptr fs:[00000030h]		6_2_044661A0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044661A0 mov eax, dword ptr fs:[00000030h]		6_2_044661A0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044F49A4 mov eax, dword ptr fs:[00000030h]		6_2_044F49A4
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044F49A4 mov eax, dword ptr fs:[00000030h]		6_2_044F49A4
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044F49A4 mov eax, dword ptr fs:[00000030h]		6_2_044F49A4
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044F49A4 mov eax, dword ptr fs:[00000030h]		6_2_044F49A4
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044B69A6 mov eax, dword ptr fs:[00000030h]		6_2_044B69A6
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044B51BE mov eax, dword ptr fs:[00000030h]		6_2_044B51BE
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044B51BE mov eax, dword ptr fs:[00000030h]		6_2_044B51BE
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044B51BE mov eax, dword ptr fs:[00000030h]		6_2_044B51BE
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044B51BE mov eax, dword ptr fs:[00000030h]		6_2_044B51BE
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04439240 mov eax, dword ptr fs:[00000030h]		6_2_04439240
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04439240 mov eax, dword ptr fs:[00000030h]		6_2_04439240
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04439240 mov eax, dword ptr fs:[00000030h]		6_2_04439240
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04439240 mov eax, dword ptr fs:[00000030h]		6_2_04439240
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044FEA55 mov eax, dword ptr fs:[00000030h]		6_2_044FEA55
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044C4257 mov eax, dword ptr fs:[00000030h]		6_2_044C4257
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044EB260 mov eax, dword ptr fs:[00000030h]		6_2_044EB260
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044EB260 mov eax, dword ptr fs:[00000030h]		6_2_044EB260
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04508A62 mov eax, dword ptr fs:[00000030h]		6_2_04508A62
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0447927A mov eax, dword ptr fs:[00000030h]		6_2_0447927A
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04448A0A mov eax, dword ptr fs:[00000030h]		6_2_04448A0A
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04435210 mov eax, dword ptr fs:[00000030h]		6_2_04435210
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04435210 mov ecx, dword ptr fs:[00000030h]		6_2_04435210
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04435210 mov eax, dword ptr fs:[00000030h]		6_2_04435210
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04435210 mov eax, dword ptr fs:[00000030h]		6_2_04435210
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0443AA16 mov eax, dword ptr fs:[00000030h]		6_2_0443AA16
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_0443AA16 mov eax, dword ptr fs:[00000030h]		6_2_0443AA16
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04453A1C mov eax, dword ptr fs:[00000030h]		6_2_04453A1C
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044FAA16 mov eax, dword ptr fs:[00000030h]		6_2_044FAA16
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_044FAA16 mov eax, dword ptr fs:[00000030h]		6_2_044FAA16
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04474A2C mov eax, dword ptr fs:[00000030h]		6_2_04474A2C

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Desktop\invoice.exe

Code function: 0_2_00315367 GetProcessHeap,

0_2_00315367

Enables debug privileges

Source: C:\Users\user\Desktop\invoice.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Process token adjusted: Debug			Jump to behavior

Contains functionality to register its own exception handler

Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_00312537 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00312537
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_00312506 SetUnhandledExceptionFilter,		0_2_00312506
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00312537 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		1_2_00312537
Source: C:\Users\user\Desktop\invoice.exe	Code function: 1_2_00312506 SetUnhandledExceptionFilter,		1_2_00312506

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 109.73.164.114 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 68.66.248.44 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 34.102.136.180 80			Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\invoice.exe	Section loaded: unknown target: C:\Users\user\Desktop\invoice.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Section loaded: unknown target: C:\Windows\SysWOW64\control.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Section loaded: unknown target: C:\Windows\SysWOW64\control.exe protection: execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write			Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write			Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\invoice.exe	Thread register set: target process: 3424			Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Thread register set: target process: 3424			Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Users\user\Desktop\invoice.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Sample uses process hollowing technique

Source: C:\Users\user\Desktop\invoice.exe

Section unmapped: C:\Windows\SysWOW64\control.exe base address: B0000

Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\invoice.exe	Process created: C:\Users\user\Desktop\invoice.exe C:\Users\user\Desktop\invoice.exe			Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\invoice.exe'			Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: explorer.exe, 00000004.00000000.665199204.0000000000AD8000.00000004.00000020.sdmp	Binary or memory string: ProgmanMD6
Source: explorer.exe, 00000004.00000002.924109355.0000000001080000.00000002.00000001.sdmp, control.exe, 00000006.00000002.924221104.0000000002CD0000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000004.00000002.935436486.0000000005E50000.00000004.00000001.sdmp, control.exe, 00000006.00000002.924221104.0000000002CD0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000004.00000002.924109355.0000000001080000.00000002.00000001.sdmp, control.exe, 00000006.00000002.924221104.0000000002CD0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000004.00000002.924109355.0000000001080000.00000002.00000001.sdmp, control.exe, 00000006.00000002.924221104.0000000002CD0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000004.00000000.678863688.000000000A716000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWnd5D

Language, Device and Operating System Detection:

Contains functionality to query CPU information (cpuid)

Source: C:\Users\user\Desktop\invoice.exe

Code function: 0_2_00314831 cpuid

0_2_00314831

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\user\Desktop\invoice.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,		0_2_0031F994
Source: C:\Users\user\Desktop\invoice.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,		0_2_0031D99C
Source: C:\Users\user\Desktop\invoice.exe	Code function: EnumSystemLocalesW,		0_2_0031420B
Source: C:\Users\user\Desktop\invoice.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,		0_2_0031EA7A
Source: C:\Users\user\Desktop\invoice.exe	Code function: GetLocaleInfoW,		0_2_00314248
Source: C:\Users\user\Desktop\invoice.exe	Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP,		0_2_0031FABE
Source: C:\Users\user\Desktop\invoice.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson,		0_2_00316284
Source: C:\Users\user\Desktop\invoice.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,		0_2_0031FB6B
Source: C:\Users\user\Desktop\invoice.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,__invoke_watson,_LcidFromHexString,GetLocaleInfoW,		0_2_0031F3EB
Source: C:\Users\user\Desktop\invoice.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,		0_2_0031FC3F
Source: C:\Users\user\Desktop\invoice.exe	Code function: _LcidFromHexString,GetLocaleInfoW,		0_2_0031F5AF
Source: C:\Users\user\Desktop\invoice.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,_free,_free,		0_2_0031D594
Source: C:\Users\user\Desktop\invoice.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_memmove,_memmove,_memmove,_free,_free,_free,_free,_free,_free,_free,_free,_free,		0_2_0030E5FA
Source: C:\Users\user\Desktop\invoice.exe	Code function: EnumSystemLocalesW,		0_2_0031F65F
Source: C:\Users\user\Desktop\invoice.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,		0_2_0031F69F
Source: C:\Users\user\Desktop\invoice.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,		0_2_0031F71C
Source: C:\Users\user\Desktop\invoice.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,		0_2_0031F79F
Source: C:\Users\user\Desktop\invoice.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,		0_2_0031DF9E
Source: C:\Users\user\Desktop\invoice.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,		1_2_0031F994
Source: C:\Users\user\Desktop\invoice.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,		1_2_0031D99C
Source: C:\Users\user\Desktop\invoice.exe	Code function: EnumSystemLocalesW,		1_2_0031420B
Source: C:\Users\user\Desktop\invoice.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,		1_2_0031EA7A
Source: C:\Users\user\Desktop\invoice.exe	Code function: GetLocaleInfoW,		1_2_00314248
Source: C:\Users\user\Desktop\invoice.exe	Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP,		1_2_0031FABE
Source: C:\Users\user\Desktop\invoice.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson,		1_2_00316284
Source: C:\Users\user\Desktop\invoice.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,		1_2_0031FB6B
Source: C:\Users\user\Desktop\invoice.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,__invoke_watson,_LcidFromHexString,GetLocaleInfoW,		1_2_0031F3EB
Source: C:\Users\user\Desktop\invoice.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,		1_2_0031FC3F
Source: C:\Users\user\Desktop\invoice.exe	Code function: _LcidFromHexString,GetLocaleInfoW,		1_2_0031F5AF
Source: C:\Users\user\Desktop\invoice.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,_free,_free,		1_2_0031D594
Source: C:\Users\user\Desktop\invoice.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_memmove,_memmove,_memmove,_free,_free,_free,_free,_free,_free,_free,_free,_free,		1_2_0030E5FA
Source: C:\Users\user\Desktop\invoice.exe	Code function: EnumSystemLocalesW,		1_2_0031F65F
Source: C:\Users\user\Desktop\invoice.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,		1_2_0031F69F
Source: C:\Users\user\Desktop\invoice.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,		1_2_0031F71C
Source: C:\Users\user\Desktop\invoice.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,		1_2_0031F79F
Source: C:\Users\user\Desktop\invoice.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,		1_2_0031DF9E

Contains functionality to query local / system time

Source: C:\Users\user\Desktop\invoice.exe

Code function: 0_2_00317A48 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00317A48

Stealing of Sensitive Information:

Yara detected FormBook

Source: Yara match	File source: 00000001.00000002.694812494.0000000000B70000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.923792314.0000000002380000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.694586179.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.923314997.0000000000150000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.694843913.0000000000BA0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.662094900.00000000029D0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 1.2.invoice.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.invoice.exe.29d0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.invoice.exe.29d0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.invoice.exe.400000.1.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected FormBook

Source: Yara match	File source: 00000001.00000002.694812494.0000000000B70000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.923792314.0000000002380000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.694586179.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.923314997.0000000000150000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.694843913.0000000000BA0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.662094900.00000000029D0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 1.2.invoice.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.invoice.exe.29d0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.invoice.exe.29d0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.invoice.exe.400000.1.unpack, type: UNPACKEDPE