Analysis Report vOKMFxiCYt.exe

AV Detection:

Multi AV Scanner detection for submitted file

Source: vOKMFxiCYt.exe

ReversingLabs: Detection: 35%

Yara detected FormBook

Source: Yara match	File source: 00000001.00000002.272036979.00000000015B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.271729564.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.242174585.0000000003AC9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.504019492.0000000001140000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.272011723.0000000001580000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.503167127.0000000000E00000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.505106609.0000000004AF0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 1.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE

Machine Learning detection for sample

Source: vOKMFxiCYt.exe

Joe Sandbox ML: detected

Antivirus or Machine Learning detection for unpacked file

Source: 1.2.RegSvcs.exe.400000.0.unpack

Avira: Label: TR/Crypt.ZPACK.Gen

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic

Snort IDS: 1201 ATTACK-RESPONSES 403 Forbidden 34.102.136.180:80 -> 192.168.2.3:49737

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: GET /glt/?SP=cnxhAdAh&V4=RXCBf+kTtqMKofvvq54zDDgrcqehmcxCBUCamp/3E7fzZOB7U/XBgSeZZ5TRQ//94zw4 HTTP/1.1Host: www.tessuto.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /glt/?V4=MLpAZ0AK/spUlt1gTLvrDwTqfxMoBLVQzrzuTOkSqlsdFHJLAwBY2ZzU1xSBGMRzyeG8&SP=cnxhAdAh HTTP/1.1Host: www.reem.proConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /glt/?SP=cnxhAdAh&V4=oeIisVoovR5GVMPXvvkWG2hSa0zFuUbByopAkVC9hBB+Ndji49czoVDBLaeM7MDZ9TnP HTTP/1.1Host: www.themaskedstitcher.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /glt/?V4=hWCSv9Zrwql4NKRqpOYz8tuCeFQ4j+1tRbbWxD4HfruMRkMSYBHm3MJuhB2jB30ChDel&SP=cnxhAdAh HTTP/1.1Host: www.auctionpros.clubConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 198.49.23.141 198.49.23.141
Source: Joe Sandbox View	IP Address: 34.102.136.180 34.102.136.180

Internet Provider seen in connection with other malware

Source: Joe Sandbox View	ASN Name: NAMECHEAP-NETUS NAMECHEAP-NETUS
Source: Joe Sandbox View	ASN Name: GOOGLEUS GOOGLEUS

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /glt/?SP=cnxhAdAh&V4=RXCBf+kTtqMKofvvq54zDDgrcqehmcxCBUCamp/3E7fzZOB7U/XBgSeZZ5TRQ//94zw4 HTTP/1.1Host: www.tessuto.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /glt/?V4=MLpAZ0AK/spUlt1gTLvrDwTqfxMoBLVQzrzuTOkSqlsdFHJLAwBY2ZzU1xSBGMRzyeG8&SP=cnxhAdAh HTTP/1.1Host: www.reem.proConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /glt/?SP=cnxhAdAh&V4=oeIisVoovR5GVMPXvvkWG2hSa0zFuUbByopAkVC9hBB+Ndji49czoVDBLaeM7MDZ9TnP HTTP/1.1Host: www.themaskedstitcher.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /glt/?V4=hWCSv9Zrwql4NKRqpOYz8tuCeFQ4j+1tRbbWxD4HfruMRkMSYBHm3MJuhB2jB30ChDel&SP=cnxhAdAh HTTP/1.1Host: www.auctionpros.clubConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: www.tessuto.net

Tries to download or post to a non-existing http route (HTTP/1.1 404 Not Found / 503 Service Unavailable)

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 20 Nov 2020 19:05:26 GMTContent-Type: text/htmlContent-Length: 153Connection: closeServer: nginx/1.16.1Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.16.1</center></body></html>

Urls found in memory or binary data

Source: raserver.exe, 00000004.00000002.506812727.000000000574F000.00000004.00000001.sdmp	String found in binary or memory: http://cpanel.com/?utm_source=cpanelwhm&utm_medium=cplogo&utm_content=logolink&utm_campaign=
Source: explorer.exe, 00000002.00000000.257287184.0000000008907000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: explorer.exe, 00000002.00000000.257451779.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: vOKMFxiCYt.exe, 00000000.00000002.241858795.0000000002AC1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: explorer.exe, 00000002.00000000.257451779.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000002.00000000.257451779.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 00000002.00000000.257451779.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000002.00000000.257451779.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000002.00000000.257451779.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000002.00000000.257451779.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000002.00000000.257451779.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: explorer.exe, 00000002.00000000.257451779.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 00000002.00000000.257451779.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000002.00000000.257451779.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 00000002.00000000.257451779.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 00000002.00000000.257451779.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 00000002.00000000.257451779.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000002.00000000.257451779.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 00000002.00000000.257451779.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000002.00000000.257451779.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000002.00000000.257451779.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 00000002.00000000.257451779.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 00000002.00000000.257451779.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 00000002.00000000.257451779.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 00000002.00000000.257451779.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000002.00000000.257451779.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 00000002.00000000.257451779.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000002.00000000.257451779.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 00000002.00000000.257451779.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Creates a DirectInput object (often for capturing keystrokes)

Source: vOKMFxiCYt.exe, 00000000.00000002.241448279.0000000000D2A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Yara detected FormBook

Source: Yara match	File source: 00000001.00000002.272036979.00000000015B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.271729564.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.242174585.0000000003AC9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.504019492.0000000001140000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.272011723.0000000001580000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.503167127.0000000000E00000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.505106609.0000000004AF0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 1.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Source: 00000001.00000002.272036979.00000000015B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.272036979.00000000015B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.271729564.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.271729564.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.242174585.0000000003AC9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.242174585.0000000003AC9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.504019492.0000000001140000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.504019492.0000000001140000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.272011723.0000000001580000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.272011723.0000000001580000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.503167127.0000000000E00000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.503167127.0000000000E00000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.505106609.0000000004AF0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.505106609.0000000004AF0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Contains functionality to call native functions

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00419D60 NtCreateFile,		1_2_00419D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00419E10 NtReadFile,		1_2_00419E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00419E90 NtClose,		1_2_00419E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00419F40 NtAllocateVirtualMemory,		1_2_00419F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00419E8A NtClose,		1_2_00419E8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01699910 NtAdjustPrivilegesToken,LdrInitializeThunk,		1_2_01699910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016999A0 NtCreateSection,LdrInitializeThunk,		1_2_016999A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01699860 NtQuerySystemInformation,LdrInitializeThunk,		1_2_01699860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01699840 NtDelayExecution,LdrInitializeThunk,		1_2_01699840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016998F0 NtReadVirtualMemory,LdrInitializeThunk,		1_2_016998F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01699A50 NtCreateFile,LdrInitializeThunk,		1_2_01699A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01699A20 NtResumeThread,LdrInitializeThunk,		1_2_01699A20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01699A00 NtProtectVirtualMemory,LdrInitializeThunk,		1_2_01699A00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01699540 NtReadFile,LdrInitializeThunk,		1_2_01699540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016995D0 NtClose,LdrInitializeThunk,		1_2_016995D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01699710 NtQueryInformationToken,LdrInitializeThunk,		1_2_01699710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016997A0 NtUnmapViewOfSection,LdrInitializeThunk,		1_2_016997A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01699780 NtMapViewOfSection,LdrInitializeThunk,		1_2_01699780
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01699660 NtAllocateVirtualMemory,LdrInitializeThunk,		1_2_01699660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016996E0 NtFreeVirtualMemory,LdrInitializeThunk,		1_2_016996E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01699950 NtQueueApcThread,		1_2_01699950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016999D0 NtCreateProcessEx,		1_2_016999D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0169B040 NtSuspendThread,		1_2_0169B040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01699820 NtEnumerateKey,		1_2_01699820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016998A0 NtWriteVirtualMemory,		1_2_016998A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01699B00 NtSetValueKey,		1_2_01699B00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0169A3B0 NtGetContextThread,		1_2_0169A3B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01699A10 NtQuerySection,		1_2_01699A10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01699A80 NtOpenDirectoryObject,		1_2_01699A80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01699560 NtWriteFile,		1_2_01699560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01699520 NtWaitForSingleObject,		1_2_01699520
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0169AD30 NtSetContextThread,		1_2_0169AD30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016995F0 NtQueryInformationFile,		1_2_016995F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01699760 NtOpenProcess,		1_2_01699760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01699770 NtSetInformationFile,		1_2_01699770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0169A770 NtOpenThread,		1_2_0169A770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01699730 NtQueryVirtualMemory,		1_2_01699730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0169A710 NtOpenProcessToken,		1_2_0169A710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01699FE0 NtCreateMutant,		1_2_01699FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01699670 NtQueryInformationProcess,		1_2_01699670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01699650 NtQueryValueKey,		1_2_01699650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01699610 NtEnumerateValueKey,		1_2_01699610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016996D0 NtCreateKey,		1_2_016996D0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D99840 NtDelayExecution,LdrInitializeThunk,		4_2_04D99840
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D99860 NtQuerySystemInformation,LdrInitializeThunk,		4_2_04D99860
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D995D0 NtClose,LdrInitializeThunk,		4_2_04D995D0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D999A0 NtCreateSection,LdrInitializeThunk,		4_2_04D999A0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D99540 NtReadFile,LdrInitializeThunk,		4_2_04D99540
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D99910 NtAdjustPrivilegesToken,LdrInitializeThunk,		4_2_04D99910
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D996D0 NtCreateKey,LdrInitializeThunk,		4_2_04D996D0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D996E0 NtFreeVirtualMemory,LdrInitializeThunk,		4_2_04D996E0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D99A50 NtCreateFile,LdrInitializeThunk,		4_2_04D99A50
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D99650 NtQueryValueKey,LdrInitializeThunk,		4_2_04D99650
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D99660 NtAllocateVirtualMemory,LdrInitializeThunk,		4_2_04D99660
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D99FE0 NtCreateMutant,LdrInitializeThunk,		4_2_04D99FE0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D99780 NtMapViewOfSection,LdrInitializeThunk,		4_2_04D99780
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D99710 NtQueryInformationToken,LdrInitializeThunk,		4_2_04D99710
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D998F0 NtReadVirtualMemory,		4_2_04D998F0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D998A0 NtWriteVirtualMemory,		4_2_04D998A0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D9B040 NtSuspendThread,		4_2_04D9B040
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D99820 NtEnumerateKey,		4_2_04D99820
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D999D0 NtCreateProcessEx,		4_2_04D999D0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D995F0 NtQueryInformationFile,		4_2_04D995F0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D99950 NtQueueApcThread,		4_2_04D99950
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D99560 NtWriteFile,		4_2_04D99560
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D9AD30 NtSetContextThread,		4_2_04D9AD30
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D99520 NtWaitForSingleObject,		4_2_04D99520
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D99A80 NtOpenDirectoryObject,		4_2_04D99A80
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D99670 NtQueryInformationProcess,		4_2_04D99670
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D99610 NtEnumerateValueKey,		4_2_04D99610
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D99A10 NtQuerySection,		4_2_04D99A10
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D99A00 NtProtectVirtualMemory,		4_2_04D99A00
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D99A20 NtResumeThread,		4_2_04D99A20
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D9A3B0 NtGetContextThread,		4_2_04D9A3B0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D997A0 NtUnmapViewOfSection,		4_2_04D997A0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D99770 NtSetInformationFile,		4_2_04D99770
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D9A770 NtOpenThread,		4_2_04D9A770
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D99760 NtOpenProcess,		4_2_04D99760
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D9A710 NtOpenProcessToken,		4_2_04D9A710
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D99B00 NtSetValueKey,		4_2_04D99B00
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D99730 NtQueryVirtualMemory,		4_2_04D99730
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_00E19D60 NtCreateFile,		4_2_00E19D60
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_00E19E90 NtClose,		4_2_00E19E90
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_00E19E10 NtReadFile,		4_2_00E19E10
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_00E19F40 NtAllocateVirtualMemory,		4_2_00E19F40
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_00E19E8A NtClose,		4_2_00E19E8A

Detected potential crypto function

Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Code function: 0_2_0112E266		0_2_0112E266
Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Code function: 0_2_01126578		0_2_01126578
Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Code function: 0_2_01126569		0_2_01126569
Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Code function: 0_2_0112C7A8		0_2_0112C7A8
Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Code function: 0_2_01129748		0_2_01129748
Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Code function: 0_2_05004CC0		0_2_05004CC0
Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Code function: 0_2_05007E28		0_2_05007E28
Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Code function: 0_2_05008E28		0_2_05008E28
Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Code function: 0_2_05009B80		0_2_05009B80
Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Code function: 0_2_0500DAE8		0_2_0500DAE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00401030		1_2_00401030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0041D160		1_2_0041D160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0041DAD4		1_2_0041DAD4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00402D90		1_2_00402D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00409E40		1_2_00409E40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00409E3C		1_2_00409E3C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0041D686		1_2_0041D686
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0041DF72		1_2_0041DF72
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0041E7CC		1_2_0041E7CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00402FB0		1_2_00402FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01674120		1_2_01674120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0165F900		1_2_0165F900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01711002		1_2_01711002
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_017228EC		1_2_017228EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016820A0		1_2_016820A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_017220A8		1_2_017220A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0166B090		1_2_0166B090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01722B28		1_2_01722B28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0171DBD2		1_2_0171DBD2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0168EBB0		1_2_0168EBB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_017222AE		1_2_017222AE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01721D55		1_2_01721D55
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01650D20		1_2_01650D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01722D07		1_2_01722D07
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0166D5E0		1_2_0166D5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_017225DD		1_2_017225DD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01682581		1_2_01682581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0171D466		1_2_0171D466
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0166841F		1_2_0166841F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01721FF1		1_2_01721FF1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01676E30		1_2_01676E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0171D616		1_2_0171D616
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01722EF7		1_2_01722EF7
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E228EC		4_2_04E228EC
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D6B090		4_2_04D6B090
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E220A8		4_2_04E220A8
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D820A0		4_2_04D820A0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E1D466		4_2_04E1D466
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D6841F		4_2_04D6841F
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E11002		4_2_04E11002
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D6D5E0		4_2_04D6D5E0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E225DD		4_2_04E225DD
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D82581		4_2_04D82581
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E21D55		4_2_04E21D55
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D5F900		4_2_04D5F900
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E22D07		4_2_04E22D07
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D50D20		4_2_04D50D20
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D74120		4_2_04D74120
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E22EF7		4_2_04E22EF7
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E222AE		4_2_04E222AE
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D76E30		4_2_04D76E30
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E21FF1		4_2_04E21FF1
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E1DBD2		4_2_04E1DBD2
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D8EBB0		4_2_04D8EBB0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E22B28		4_2_04E22B28
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_00E1D160		4_2_00E1D160
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_00E02D90		4_2_00E02D90
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_00E09E40		4_2_00E09E40
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_00E09E3C		4_2_00E09E3C
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_00E02FB0		4_2_00E02FB0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_00E1DF72		4_2_00E1DF72

Found potential string decryption / allocating functions

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 0165B150 appears 35 times
Source: C:\Windows\SysWOW64\raserver.exe	Code function: String function: 04D5B150 appears 35 times

Sample file is different than original file name gathered from version info

Source: vOKMFxiCYt.exe	Binary or memory string: OriginalFilename vs vOKMFxiCYt.exe
Source: vOKMFxiCYt.exe, 00000000.00000002.240626128.0000000000622000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameLqei.exe4 vs vOKMFxiCYt.exe
Source: vOKMFxiCYt.exe, 00000000.00000002.245690399.0000000005C00000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameKedermister.dllT vs vOKMFxiCYt.exe
Source: vOKMFxiCYt.exe, 00000000.00000002.241448279.0000000000D2A000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs vOKMFxiCYt.exe
Source: vOKMFxiCYt.exe	Binary or memory string: OriginalFilenameLqei.exe4 vs vOKMFxiCYt.exe

Yara signature match

Source: 00000001.00000002.272036979.00000000015B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.272036979.00000000015B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.271729564.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.271729564.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.242174585.0000000003AC9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.242174585.0000000003AC9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.504019492.0000000001140000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.504019492.0000000001140000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.272011723.0000000001580000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.272011723.0000000001580000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.503167127.0000000000E00000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.503167127.0000000000E00000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.505106609.0000000004AF0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.505106609.0000000004AF0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)

Source: vOKMFxiCYt.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Classification label

Source: classification engine

Classification label: mal100.troj.evad.winEXE@7/1@4/4

Creates files inside the user directory

Source: C:\Users\user\Desktop\vOKMFxiCYt.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\vOKMFxiCYt.exe.log

Jump to behavior

Creates mutexes

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4104:120:WilError_01
Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Mutant created: \Sessions\1\BaseNamedObjects\DGxsVlh

PE file has an executable .text section and no other executable section

Source: vOKMFxiCYt.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Parts of this applications are using the .NET runtime (Probably coded in C#)

Source: C:\Users\user\Desktop\vOKMFxiCYt.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Reads software policies

Source: C:\Users\user\Desktop\vOKMFxiCYt.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Reads the hosts file

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Sample is known by Antivirus

Source: vOKMFxiCYt.exe

ReversingLabs: Detection: 35%

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\vOKMFxiCYt.exe 'C:\Users\user\Desktop\vOKMFxiCYt.exe'
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source: unknown	Process created: C:\Windows\SysWOW64\raserver.exe C:\Windows\SysWOW64\raserver.exe
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe			Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'			Jump to behavior

Uses Microsoft Silverlight

Source: C:\Users\user\Desktop\vOKMFxiCYt.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

PE file contains a COM descriptor data directory

Source: vOKMFxiCYt.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: vOKMFxiCYt.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:	Binary string: RegSvcs.pdb, source: raserver.exe, 00000004.00000002.506744729.000000000525F000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: RegSvcs.exe, 00000001.00000002.272089721.0000000001630000.00000040.00000001.sdmp, raserver.exe, 00000004.00000002.505341361.0000000004D30000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: RegSvcs.exe, raserver.exe
Source:	Binary string: RAServer.pdb source: RegSvcs.exe, 00000001.00000002.272464370.0000000001B70000.00000040.00000001.sdmp
Source:	Binary string: RegSvcs.pdb source: raserver.exe, 00000004.00000002.506744729.000000000525F000.00000004.00000001.sdmp
Source:	Binary string: RAServer.pdbGCTL source: RegSvcs.exe, 00000001.00000002.272464370.0000000001B70000.00000040.00000001.sdmp

Data Obfuscation:

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Code function: 0_2_006248FC push edx; retf		0_2_006248FD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00417A32 push es; iretd		1_2_00417A3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0041CEB5 push eax; ret		1_2_0041CF08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0041CF6C push eax; ret		1_2_0041CF72
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0041CF02 push eax; ret		1_2_0041CF08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0041CF0B push eax; ret		1_2_0041CF72
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016AD0D1 push ecx; ret		1_2_016AD0E4
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04DAD0D1 push ecx; ret		4_2_04DAD0E4
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_00E17A32 push es; iretd		4_2_00E17A3B
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_00E1CEB5 push eax; ret		4_2_00E1CF08
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_00E1CF6C push eax; ret		4_2_00E1CF72
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_00E1CF02 push eax; ret		4_2_00E1CF08
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_00E1CF0B push eax; ret		4_2_00E1CF72

Binary may include packed or encrypted code

Source: initial sample

Static PE information: section name: .text entropy: 7.62841280925

Hooking and other Techniques for Hiding and Protection:

Modifies the prolog of user mode functions (user mode inline hooks)

Source: explorer.exe

User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x86 0x6E 0xE5

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM_3

Source: Yara match	File source: 00000000.00000002.241947943.0000000002B43000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.241858795.0000000002AC1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vOKMFxiCYt.exe PID: 2764, type: MEMORY

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: vOKMFxiCYt.exe, 00000000.00000002.241947943.0000000002B43000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL
Source: vOKMFxiCYt.exe, 00000000.00000002.241947943.0000000002B43000.00000004.00000001.sdmp	Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME

Tries to detect virtualization through RDTSC time measurements

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	RDTSC instruction interceptor: First address: 00000000004098E4 second address: 00000000004098EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	RDTSC instruction interceptor: First address: 0000000000409B5E second address: 0000000000409B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\raserver.exe	RDTSC instruction interceptor: First address: 0000000000E098E4 second address: 0000000000E098EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\raserver.exe	RDTSC instruction interceptor: First address: 0000000000E09B5E second address: 0000000000E09B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 1_2_00409A90 rdtsc

1_2_00409A90

Contains long sleeps (>= 3 min)

Source: C:\Users\user\Desktop\vOKMFxiCYt.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\vOKMFxiCYt.exe TID: 4120	Thread sleep time: -50971s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\vOKMFxiCYt.exe TID: 5968	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Windows\explorer.exe TID: 6520	Thread sleep count: 40 > 30			Jump to behavior
Source: C:\Windows\explorer.exe TID: 6520	Thread sleep time: -80000s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe TID: 2432	Thread sleep time: -80000s >= -30000s			Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: explorer.exe, 00000002.00000000.245822763.0000000001398000.00000004.00000020.sdmp	Binary or memory string: 53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&t
Source: explorer.exe, 00000002.00000000.256810528.000000000871F000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000002.00000000.256810528.000000000871F000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000:
Source: vOKMFxiCYt.exe, 00000000.00000002.241947943.0000000002B43000.00000004.00000001.sdmp	Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 00000002.00000000.256631003.0000000008640000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000002.00000000.256227902.0000000008220000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: vOKMFxiCYt.exe, 00000000.00000002.241947943.0000000002B43000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: vOKMFxiCYt.exe, 00000000.00000002.241947943.0000000002B43000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II|update users set password = @password where user_id = @user_id
Source: explorer.exe, 00000002.00000000.256810528.000000000871F000.00000004.00000001.sdmp	Binary or memory string: 26700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATAK
Source: explorer.exe, 00000002.00000000.256810528.000000000871F000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}~
Source: explorer.exe, 00000002.00000000.256810528.000000000871F000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: explorer.exe, 00000002.00000002.516234509.0000000005603000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b},
Source: explorer.exe, 00000002.00000002.504133649.0000000001398000.00000004.00000020.sdmp	Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&t
Source: explorer.exe, 00000002.00000000.256227902.0000000008220000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000002.00000000.256227902.0000000008220000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: vOKMFxiCYt.exe, 00000000.00000002.241947943.0000000002B43000.00000004.00000001.sdmp	Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
Source: explorer.exe, 00000002.00000000.256227902.0000000008220000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Queries a list of all running processes

Source: C:\Users\user\Desktop\vOKMFxiCYt.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Checks if the current process is being debugged

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Process queried: DebugPort			Jump to behavior

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 1_2_00409A90 rdtsc

1_2_00409A90

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 1_2_0040ACD0 LdrLoadDll,

1_2_0040ACD0

Contains functionality to read the PEB

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0165C962 mov eax, dword ptr fs:[00000030h]		1_2_0165C962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0165B171 mov eax, dword ptr fs:[00000030h]		1_2_0165B171
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0165B171 mov eax, dword ptr fs:[00000030h]		1_2_0165B171
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0167B944 mov eax, dword ptr fs:[00000030h]		1_2_0167B944
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0167B944 mov eax, dword ptr fs:[00000030h]		1_2_0167B944
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01674120 mov eax, dword ptr fs:[00000030h]		1_2_01674120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01674120 mov eax, dword ptr fs:[00000030h]		1_2_01674120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01674120 mov eax, dword ptr fs:[00000030h]		1_2_01674120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01674120 mov eax, dword ptr fs:[00000030h]		1_2_01674120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01674120 mov ecx, dword ptr fs:[00000030h]		1_2_01674120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0168513A mov eax, dword ptr fs:[00000030h]		1_2_0168513A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0168513A mov eax, dword ptr fs:[00000030h]		1_2_0168513A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01659100 mov eax, dword ptr fs:[00000030h]		1_2_01659100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01659100 mov eax, dword ptr fs:[00000030h]		1_2_01659100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01659100 mov eax, dword ptr fs:[00000030h]		1_2_01659100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0165B1E1 mov eax, dword ptr fs:[00000030h]		1_2_0165B1E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0165B1E1 mov eax, dword ptr fs:[00000030h]		1_2_0165B1E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0165B1E1 mov eax, dword ptr fs:[00000030h]		1_2_0165B1E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016E41E8 mov eax, dword ptr fs:[00000030h]		1_2_016E41E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016861A0 mov eax, dword ptr fs:[00000030h]		1_2_016861A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016861A0 mov eax, dword ptr fs:[00000030h]		1_2_016861A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016D69A6 mov eax, dword ptr fs:[00000030h]		1_2_016D69A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016D51BE mov eax, dword ptr fs:[00000030h]		1_2_016D51BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016D51BE mov eax, dword ptr fs:[00000030h]		1_2_016D51BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016D51BE mov eax, dword ptr fs:[00000030h]		1_2_016D51BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016D51BE mov eax, dword ptr fs:[00000030h]		1_2_016D51BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0167C182 mov eax, dword ptr fs:[00000030h]		1_2_0167C182
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0168A185 mov eax, dword ptr fs:[00000030h]		1_2_0168A185
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01682990 mov eax, dword ptr fs:[00000030h]		1_2_01682990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01712073 mov eax, dword ptr fs:[00000030h]		1_2_01712073
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01721074 mov eax, dword ptr fs:[00000030h]		1_2_01721074
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01670050 mov eax, dword ptr fs:[00000030h]		1_2_01670050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01670050 mov eax, dword ptr fs:[00000030h]		1_2_01670050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0168002D mov eax, dword ptr fs:[00000030h]		1_2_0168002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0168002D mov eax, dword ptr fs:[00000030h]		1_2_0168002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0168002D mov eax, dword ptr fs:[00000030h]		1_2_0168002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0168002D mov eax, dword ptr fs:[00000030h]		1_2_0168002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0168002D mov eax, dword ptr fs:[00000030h]		1_2_0168002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0166B02A mov eax, dword ptr fs:[00000030h]		1_2_0166B02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0166B02A mov eax, dword ptr fs:[00000030h]		1_2_0166B02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0166B02A mov eax, dword ptr fs:[00000030h]		1_2_0166B02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0166B02A mov eax, dword ptr fs:[00000030h]		1_2_0166B02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01724015 mov eax, dword ptr fs:[00000030h]		1_2_01724015
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01724015 mov eax, dword ptr fs:[00000030h]		1_2_01724015
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016D7016 mov eax, dword ptr fs:[00000030h]		1_2_016D7016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016D7016 mov eax, dword ptr fs:[00000030h]		1_2_016D7016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016D7016 mov eax, dword ptr fs:[00000030h]		1_2_016D7016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016558EC mov eax, dword ptr fs:[00000030h]		1_2_016558EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016EB8D0 mov eax, dword ptr fs:[00000030h]		1_2_016EB8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016EB8D0 mov ecx, dword ptr fs:[00000030h]		1_2_016EB8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016EB8D0 mov eax, dword ptr fs:[00000030h]		1_2_016EB8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016EB8D0 mov eax, dword ptr fs:[00000030h]		1_2_016EB8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016EB8D0 mov eax, dword ptr fs:[00000030h]		1_2_016EB8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016EB8D0 mov eax, dword ptr fs:[00000030h]		1_2_016EB8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016990AF mov eax, dword ptr fs:[00000030h]		1_2_016990AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016820A0 mov eax, dword ptr fs:[00000030h]		1_2_016820A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016820A0 mov eax, dword ptr fs:[00000030h]		1_2_016820A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016820A0 mov eax, dword ptr fs:[00000030h]		1_2_016820A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016820A0 mov eax, dword ptr fs:[00000030h]		1_2_016820A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016820A0 mov eax, dword ptr fs:[00000030h]		1_2_016820A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016820A0 mov eax, dword ptr fs:[00000030h]		1_2_016820A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0168F0BF mov ecx, dword ptr fs:[00000030h]		1_2_0168F0BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0168F0BF mov eax, dword ptr fs:[00000030h]		1_2_0168F0BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0168F0BF mov eax, dword ptr fs:[00000030h]		1_2_0168F0BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01659080 mov eax, dword ptr fs:[00000030h]		1_2_01659080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016D3884 mov eax, dword ptr fs:[00000030h]		1_2_016D3884
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016D3884 mov eax, dword ptr fs:[00000030h]		1_2_016D3884
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0165DB60 mov ecx, dword ptr fs:[00000030h]		1_2_0165DB60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01683B7A mov eax, dword ptr fs:[00000030h]		1_2_01683B7A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01683B7A mov eax, dword ptr fs:[00000030h]		1_2_01683B7A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0165DB40 mov eax, dword ptr fs:[00000030h]		1_2_0165DB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01728B58 mov eax, dword ptr fs:[00000030h]		1_2_01728B58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0165F358 mov eax, dword ptr fs:[00000030h]		1_2_0165F358
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0171131B mov eax, dword ptr fs:[00000030h]		1_2_0171131B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016803E2 mov eax, dword ptr fs:[00000030h]		1_2_016803E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016803E2 mov eax, dword ptr fs:[00000030h]		1_2_016803E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016803E2 mov eax, dword ptr fs:[00000030h]		1_2_016803E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016803E2 mov eax, dword ptr fs:[00000030h]		1_2_016803E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016803E2 mov eax, dword ptr fs:[00000030h]		1_2_016803E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016803E2 mov eax, dword ptr fs:[00000030h]		1_2_016803E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0167DBE9 mov eax, dword ptr fs:[00000030h]		1_2_0167DBE9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016D53CA mov eax, dword ptr fs:[00000030h]		1_2_016D53CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016D53CA mov eax, dword ptr fs:[00000030h]		1_2_016D53CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01684BAD mov eax, dword ptr fs:[00000030h]		1_2_01684BAD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01684BAD mov eax, dword ptr fs:[00000030h]		1_2_01684BAD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01684BAD mov eax, dword ptr fs:[00000030h]		1_2_01684BAD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01725BA5 mov eax, dword ptr fs:[00000030h]		1_2_01725BA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01661B8F mov eax, dword ptr fs:[00000030h]		1_2_01661B8F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01661B8F mov eax, dword ptr fs:[00000030h]		1_2_01661B8F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0170D380 mov ecx, dword ptr fs:[00000030h]		1_2_0170D380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0168B390 mov eax, dword ptr fs:[00000030h]		1_2_0168B390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0171138A mov eax, dword ptr fs:[00000030h]		1_2_0171138A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01682397 mov eax, dword ptr fs:[00000030h]		1_2_01682397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0170B260 mov eax, dword ptr fs:[00000030h]		1_2_0170B260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0170B260 mov eax, dword ptr fs:[00000030h]		1_2_0170B260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01728A62 mov eax, dword ptr fs:[00000030h]		1_2_01728A62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0169927A mov eax, dword ptr fs:[00000030h]		1_2_0169927A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0171EA55 mov eax, dword ptr fs:[00000030h]		1_2_0171EA55
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01659240 mov eax, dword ptr fs:[00000030h]		1_2_01659240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01659240 mov eax, dword ptr fs:[00000030h]		1_2_01659240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01659240 mov eax, dword ptr fs:[00000030h]		1_2_01659240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01659240 mov eax, dword ptr fs:[00000030h]		1_2_01659240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016E4257 mov eax, dword ptr fs:[00000030h]		1_2_016E4257
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01694A2C mov eax, dword ptr fs:[00000030h]		1_2_01694A2C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01694A2C mov eax, dword ptr fs:[00000030h]		1_2_01694A2C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0171AA16 mov eax, dword ptr fs:[00000030h]		1_2_0171AA16
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0171AA16 mov eax, dword ptr fs:[00000030h]		1_2_0171AA16
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01668A0A mov eax, dword ptr fs:[00000030h]		1_2_01668A0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0165AA16 mov eax, dword ptr fs:[00000030h]		1_2_0165AA16
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0165AA16 mov eax, dword ptr fs:[00000030h]		1_2_0165AA16
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01655210 mov eax, dword ptr fs:[00000030h]		1_2_01655210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01655210 mov ecx, dword ptr fs:[00000030h]		1_2_01655210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01655210 mov eax, dword ptr fs:[00000030h]		1_2_01655210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01655210 mov eax, dword ptr fs:[00000030h]		1_2_01655210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01673A1C mov eax, dword ptr fs:[00000030h]		1_2_01673A1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01682AE4 mov eax, dword ptr fs:[00000030h]		1_2_01682AE4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01682ACB mov eax, dword ptr fs:[00000030h]		1_2_01682ACB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016552A5 mov eax, dword ptr fs:[00000030h]		1_2_016552A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016552A5 mov eax, dword ptr fs:[00000030h]		1_2_016552A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016552A5 mov eax, dword ptr fs:[00000030h]		1_2_016552A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016552A5 mov eax, dword ptr fs:[00000030h]		1_2_016552A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016552A5 mov eax, dword ptr fs:[00000030h]		1_2_016552A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0166AAB0 mov eax, dword ptr fs:[00000030h]		1_2_0166AAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0166AAB0 mov eax, dword ptr fs:[00000030h]		1_2_0166AAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0168FAB0 mov eax, dword ptr fs:[00000030h]		1_2_0168FAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0168D294 mov eax, dword ptr fs:[00000030h]		1_2_0168D294
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0168D294 mov eax, dword ptr fs:[00000030h]		1_2_0168D294
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0167C577 mov eax, dword ptr fs:[00000030h]		1_2_0167C577
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0167C577 mov eax, dword ptr fs:[00000030h]		1_2_0167C577
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01693D43 mov eax, dword ptr fs:[00000030h]		1_2_01693D43
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016D3540 mov eax, dword ptr fs:[00000030h]		1_2_016D3540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01677D50 mov eax, dword ptr fs:[00000030h]		1_2_01677D50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01728D34 mov eax, dword ptr fs:[00000030h]		1_2_01728D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0171E539 mov eax, dword ptr fs:[00000030h]		1_2_0171E539
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01663D34 mov eax, dword ptr fs:[00000030h]		1_2_01663D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01663D34 mov eax, dword ptr fs:[00000030h]		1_2_01663D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01663D34 mov eax, dword ptr fs:[00000030h]		1_2_01663D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01663D34 mov eax, dword ptr fs:[00000030h]		1_2_01663D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01663D34 mov eax, dword ptr fs:[00000030h]		1_2_01663D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01663D34 mov eax, dword ptr fs:[00000030h]		1_2_01663D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01663D34 mov eax, dword ptr fs:[00000030h]		1_2_01663D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01663D34 mov eax, dword ptr fs:[00000030h]		1_2_01663D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01663D34 mov eax, dword ptr fs:[00000030h]		1_2_01663D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01663D34 mov eax, dword ptr fs:[00000030h]		1_2_01663D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01663D34 mov eax, dword ptr fs:[00000030h]		1_2_01663D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01663D34 mov eax, dword ptr fs:[00000030h]		1_2_01663D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01663D34 mov eax, dword ptr fs:[00000030h]		1_2_01663D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01684D3B mov eax, dword ptr fs:[00000030h]		1_2_01684D3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01684D3B mov eax, dword ptr fs:[00000030h]		1_2_01684D3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01684D3B mov eax, dword ptr fs:[00000030h]		1_2_01684D3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0165AD30 mov eax, dword ptr fs:[00000030h]		1_2_0165AD30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016DA537 mov eax, dword ptr fs:[00000030h]		1_2_016DA537
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01708DF1 mov eax, dword ptr fs:[00000030h]		1_2_01708DF1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0166D5E0 mov eax, dword ptr fs:[00000030h]		1_2_0166D5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0166D5E0 mov eax, dword ptr fs:[00000030h]		1_2_0166D5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0171FDE2 mov eax, dword ptr fs:[00000030h]		1_2_0171FDE2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0171FDE2 mov eax, dword ptr fs:[00000030h]		1_2_0171FDE2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0171FDE2 mov eax, dword ptr fs:[00000030h]		1_2_0171FDE2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0171FDE2 mov eax, dword ptr fs:[00000030h]		1_2_0171FDE2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016D6DC9 mov eax, dword ptr fs:[00000030h]		1_2_016D6DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016D6DC9 mov eax, dword ptr fs:[00000030h]		1_2_016D6DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016D6DC9 mov eax, dword ptr fs:[00000030h]		1_2_016D6DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016D6DC9 mov ecx, dword ptr fs:[00000030h]		1_2_016D6DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016D6DC9 mov eax, dword ptr fs:[00000030h]		1_2_016D6DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016D6DC9 mov eax, dword ptr fs:[00000030h]		1_2_016D6DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016835A1 mov eax, dword ptr fs:[00000030h]		1_2_016835A1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01681DB5 mov eax, dword ptr fs:[00000030h]		1_2_01681DB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01681DB5 mov eax, dword ptr fs:[00000030h]		1_2_01681DB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01681DB5 mov eax, dword ptr fs:[00000030h]		1_2_01681DB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_017205AC mov eax, dword ptr fs:[00000030h]		1_2_017205AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_017205AC mov eax, dword ptr fs:[00000030h]		1_2_017205AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01682581 mov eax, dword ptr fs:[00000030h]		1_2_01682581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01682581 mov eax, dword ptr fs:[00000030h]		1_2_01682581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01682581 mov eax, dword ptr fs:[00000030h]		1_2_01682581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01682581 mov eax, dword ptr fs:[00000030h]		1_2_01682581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01652D8A mov eax, dword ptr fs:[00000030h]		1_2_01652D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01652D8A mov eax, dword ptr fs:[00000030h]		1_2_01652D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01652D8A mov eax, dword ptr fs:[00000030h]		1_2_01652D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01652D8A mov eax, dword ptr fs:[00000030h]		1_2_01652D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01652D8A mov eax, dword ptr fs:[00000030h]		1_2_01652D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0168FD9B mov eax, dword ptr fs:[00000030h]		1_2_0168FD9B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0168FD9B mov eax, dword ptr fs:[00000030h]		1_2_0168FD9B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0167746D mov eax, dword ptr fs:[00000030h]		1_2_0167746D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0168A44B mov eax, dword ptr fs:[00000030h]		1_2_0168A44B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016EC450 mov eax, dword ptr fs:[00000030h]		1_2_016EC450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016EC450 mov eax, dword ptr fs:[00000030h]		1_2_016EC450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0168BC2C mov eax, dword ptr fs:[00000030h]		1_2_0168BC2C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016D6C0A mov eax, dword ptr fs:[00000030h]		1_2_016D6C0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016D6C0A mov eax, dword ptr fs:[00000030h]		1_2_016D6C0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016D6C0A mov eax, dword ptr fs:[00000030h]		1_2_016D6C0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016D6C0A mov eax, dword ptr fs:[00000030h]		1_2_016D6C0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01711C06 mov eax, dword ptr fs:[00000030h]		1_2_01711C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01711C06 mov eax, dword ptr fs:[00000030h]		1_2_01711C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01711C06 mov eax, dword ptr fs:[00000030h]		1_2_01711C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01711C06 mov eax, dword ptr fs:[00000030h]		1_2_01711C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01711C06 mov eax, dword ptr fs:[00000030h]		1_2_01711C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01711C06 mov eax, dword ptr fs:[00000030h]		1_2_01711C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01711C06 mov eax, dword ptr fs:[00000030h]		1_2_01711C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01711C06 mov eax, dword ptr fs:[00000030h]		1_2_01711C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01711C06 mov eax, dword ptr fs:[00000030h]		1_2_01711C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01711C06 mov eax, dword ptr fs:[00000030h]		1_2_01711C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01711C06 mov eax, dword ptr fs:[00000030h]		1_2_01711C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01711C06 mov eax, dword ptr fs:[00000030h]		1_2_01711C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01711C06 mov eax, dword ptr fs:[00000030h]		1_2_01711C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01711C06 mov eax, dword ptr fs:[00000030h]		1_2_01711C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0172740D mov eax, dword ptr fs:[00000030h]		1_2_0172740D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0172740D mov eax, dword ptr fs:[00000030h]		1_2_0172740D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0172740D mov eax, dword ptr fs:[00000030h]		1_2_0172740D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_017114FB mov eax, dword ptr fs:[00000030h]		1_2_017114FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016D6CF0 mov eax, dword ptr fs:[00000030h]		1_2_016D6CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016D6CF0 mov eax, dword ptr fs:[00000030h]		1_2_016D6CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016D6CF0 mov eax, dword ptr fs:[00000030h]		1_2_016D6CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01728CD6 mov eax, dword ptr fs:[00000030h]		1_2_01728CD6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0166849B mov eax, dword ptr fs:[00000030h]		1_2_0166849B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0166FF60 mov eax, dword ptr fs:[00000030h]		1_2_0166FF60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01728F6A mov eax, dword ptr fs:[00000030h]		1_2_01728F6A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0166EF40 mov eax, dword ptr fs:[00000030h]		1_2_0166EF40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01654F2E mov eax, dword ptr fs:[00000030h]		1_2_01654F2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01654F2E mov eax, dword ptr fs:[00000030h]		1_2_01654F2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0168E730 mov eax, dword ptr fs:[00000030h]		1_2_0168E730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0168A70E mov eax, dword ptr fs:[00000030h]		1_2_0168A70E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0168A70E mov eax, dword ptr fs:[00000030h]		1_2_0168A70E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0167F716 mov eax, dword ptr fs:[00000030h]		1_2_0167F716
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016EFF10 mov eax, dword ptr fs:[00000030h]		1_2_016EFF10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016EFF10 mov eax, dword ptr fs:[00000030h]		1_2_016EFF10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0172070D mov eax, dword ptr fs:[00000030h]		1_2_0172070D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0172070D mov eax, dword ptr fs:[00000030h]		1_2_0172070D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016937F5 mov eax, dword ptr fs:[00000030h]		1_2_016937F5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01668794 mov eax, dword ptr fs:[00000030h]		1_2_01668794
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016D7794 mov eax, dword ptr fs:[00000030h]		1_2_016D7794
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016D7794 mov eax, dword ptr fs:[00000030h]		1_2_016D7794
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016D7794 mov eax, dword ptr fs:[00000030h]		1_2_016D7794
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0166766D mov eax, dword ptr fs:[00000030h]		1_2_0166766D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0167AE73 mov eax, dword ptr fs:[00000030h]		1_2_0167AE73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0167AE73 mov eax, dword ptr fs:[00000030h]		1_2_0167AE73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0167AE73 mov eax, dword ptr fs:[00000030h]		1_2_0167AE73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0167AE73 mov eax, dword ptr fs:[00000030h]		1_2_0167AE73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0167AE73 mov eax, dword ptr fs:[00000030h]		1_2_0167AE73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01667E41 mov eax, dword ptr fs:[00000030h]		1_2_01667E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01667E41 mov eax, dword ptr fs:[00000030h]		1_2_01667E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01667E41 mov eax, dword ptr fs:[00000030h]		1_2_01667E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01667E41 mov eax, dword ptr fs:[00000030h]		1_2_01667E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01667E41 mov eax, dword ptr fs:[00000030h]		1_2_01667E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01667E41 mov eax, dword ptr fs:[00000030h]		1_2_01667E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0171AE44 mov eax, dword ptr fs:[00000030h]		1_2_0171AE44
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0171AE44 mov eax, dword ptr fs:[00000030h]		1_2_0171AE44
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0165E620 mov eax, dword ptr fs:[00000030h]		1_2_0165E620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0170FE3F mov eax, dword ptr fs:[00000030h]		1_2_0170FE3F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0165C600 mov eax, dword ptr fs:[00000030h]		1_2_0165C600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0165C600 mov eax, dword ptr fs:[00000030h]		1_2_0165C600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0165C600 mov eax, dword ptr fs:[00000030h]		1_2_0165C600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01688E00 mov eax, dword ptr fs:[00000030h]		1_2_01688E00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0168A61C mov eax, dword ptr fs:[00000030h]		1_2_0168A61C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0168A61C mov eax, dword ptr fs:[00000030h]		1_2_0168A61C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01711608 mov eax, dword ptr fs:[00000030h]		1_2_01711608
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016676E2 mov eax, dword ptr fs:[00000030h]		1_2_016676E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016816E0 mov ecx, dword ptr fs:[00000030h]		1_2_016816E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01728ED6 mov eax, dword ptr fs:[00000030h]		1_2_01728ED6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016836CC mov eax, dword ptr fs:[00000030h]		1_2_016836CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01698EC7 mov eax, dword ptr fs:[00000030h]		1_2_01698EC7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0170FEC0 mov eax, dword ptr fs:[00000030h]		1_2_0170FEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016D46A7 mov eax, dword ptr fs:[00000030h]		1_2_016D46A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01720EA5 mov eax, dword ptr fs:[00000030h]		1_2_01720EA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01720EA5 mov eax, dword ptr fs:[00000030h]		1_2_01720EA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01720EA5 mov eax, dword ptr fs:[00000030h]		1_2_01720EA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016EFE87 mov eax, dword ptr fs:[00000030h]		1_2_016EFE87
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04DEB8D0 mov eax, dword ptr fs:[00000030h]		4_2_04DEB8D0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04DEB8D0 mov ecx, dword ptr fs:[00000030h]		4_2_04DEB8D0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04DEB8D0 mov eax, dword ptr fs:[00000030h]		4_2_04DEB8D0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04DEB8D0 mov eax, dword ptr fs:[00000030h]		4_2_04DEB8D0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04DEB8D0 mov eax, dword ptr fs:[00000030h]		4_2_04DEB8D0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04DEB8D0 mov eax, dword ptr fs:[00000030h]		4_2_04DEB8D0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E114FB mov eax, dword ptr fs:[00000030h]		4_2_04E114FB
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04DD6CF0 mov eax, dword ptr fs:[00000030h]		4_2_04DD6CF0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04DD6CF0 mov eax, dword ptr fs:[00000030h]		4_2_04DD6CF0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04DD6CF0 mov eax, dword ptr fs:[00000030h]		4_2_04DD6CF0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E28CD6 mov eax, dword ptr fs:[00000030h]		4_2_04E28CD6
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D558EC mov eax, dword ptr fs:[00000030h]		4_2_04D558EC
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D6849B mov eax, dword ptr fs:[00000030h]		4_2_04D6849B
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D59080 mov eax, dword ptr fs:[00000030h]		4_2_04D59080
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04DD3884 mov eax, dword ptr fs:[00000030h]		4_2_04DD3884
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04DD3884 mov eax, dword ptr fs:[00000030h]		4_2_04DD3884
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D8F0BF mov ecx, dword ptr fs:[00000030h]		4_2_04D8F0BF
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D8F0BF mov eax, dword ptr fs:[00000030h]		4_2_04D8F0BF
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D8F0BF mov eax, dword ptr fs:[00000030h]		4_2_04D8F0BF
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D990AF mov eax, dword ptr fs:[00000030h]		4_2_04D990AF
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D820A0 mov eax, dword ptr fs:[00000030h]		4_2_04D820A0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D820A0 mov eax, dword ptr fs:[00000030h]		4_2_04D820A0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D820A0 mov eax, dword ptr fs:[00000030h]		4_2_04D820A0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D820A0 mov eax, dword ptr fs:[00000030h]		4_2_04D820A0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D820A0 mov eax, dword ptr fs:[00000030h]		4_2_04D820A0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D820A0 mov eax, dword ptr fs:[00000030h]		4_2_04D820A0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D70050 mov eax, dword ptr fs:[00000030h]		4_2_04D70050
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D70050 mov eax, dword ptr fs:[00000030h]		4_2_04D70050
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04DEC450 mov eax, dword ptr fs:[00000030h]		4_2_04DEC450
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04DEC450 mov eax, dword ptr fs:[00000030h]		4_2_04DEC450
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E12073 mov eax, dword ptr fs:[00000030h]		4_2_04E12073
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D8A44B mov eax, dword ptr fs:[00000030h]		4_2_04D8A44B
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E21074 mov eax, dword ptr fs:[00000030h]		4_2_04E21074
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D7746D mov eax, dword ptr fs:[00000030h]		4_2_04D7746D
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04DD7016 mov eax, dword ptr fs:[00000030h]		4_2_04DD7016
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04DD7016 mov eax, dword ptr fs:[00000030h]		4_2_04DD7016
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04DD7016 mov eax, dword ptr fs:[00000030h]		4_2_04DD7016
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04DD6C0A mov eax, dword ptr fs:[00000030h]		4_2_04DD6C0A
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04DD6C0A mov eax, dword ptr fs:[00000030h]		4_2_04DD6C0A
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04DD6C0A mov eax, dword ptr fs:[00000030h]		4_2_04DD6C0A
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04DD6C0A mov eax, dword ptr fs:[00000030h]		4_2_04DD6C0A
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E11C06 mov eax, dword ptr fs:[00000030h]		4_2_04E11C06
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E11C06 mov eax, dword ptr fs:[00000030h]		4_2_04E11C06
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E11C06 mov eax, dword ptr fs:[00000030h]		4_2_04E11C06
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E11C06 mov eax, dword ptr fs:[00000030h]		4_2_04E11C06
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E11C06 mov eax, dword ptr fs:[00000030h]		4_2_04E11C06
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E11C06 mov eax, dword ptr fs:[00000030h]		4_2_04E11C06
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E11C06 mov eax, dword ptr fs:[00000030h]		4_2_04E11C06
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E11C06 mov eax, dword ptr fs:[00000030h]		4_2_04E11C06
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E11C06 mov eax, dword ptr fs:[00000030h]		4_2_04E11C06
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E11C06 mov eax, dword ptr fs:[00000030h]		4_2_04E11C06
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E11C06 mov eax, dword ptr fs:[00000030h]		4_2_04E11C06
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E11C06 mov eax, dword ptr fs:[00000030h]		4_2_04E11C06
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E11C06 mov eax, dword ptr fs:[00000030h]		4_2_04E11C06
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E11C06 mov eax, dword ptr fs:[00000030h]		4_2_04E11C06
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E2740D mov eax, dword ptr fs:[00000030h]		4_2_04E2740D
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E2740D mov eax, dword ptr fs:[00000030h]		4_2_04E2740D
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E2740D mov eax, dword ptr fs:[00000030h]		4_2_04E2740D
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D8BC2C mov eax, dword ptr fs:[00000030h]		4_2_04D8BC2C
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D8002D mov eax, dword ptr fs:[00000030h]		4_2_04D8002D
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D8002D mov eax, dword ptr fs:[00000030h]		4_2_04D8002D
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D8002D mov eax, dword ptr fs:[00000030h]		4_2_04D8002D
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D8002D mov eax, dword ptr fs:[00000030h]		4_2_04D8002D
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D8002D mov eax, dword ptr fs:[00000030h]		4_2_04D8002D
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E24015 mov eax, dword ptr fs:[00000030h]		4_2_04E24015
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E24015 mov eax, dword ptr fs:[00000030h]		4_2_04E24015
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D6B02A mov eax, dword ptr fs:[00000030h]		4_2_04D6B02A
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D6B02A mov eax, dword ptr fs:[00000030h]		4_2_04D6B02A
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D6B02A mov eax, dword ptr fs:[00000030h]		4_2_04D6B02A
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D6B02A mov eax, dword ptr fs:[00000030h]		4_2_04D6B02A
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E1FDE2 mov eax, dword ptr fs:[00000030h]		4_2_04E1FDE2
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E1FDE2 mov eax, dword ptr fs:[00000030h]		4_2_04E1FDE2
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E1FDE2 mov eax, dword ptr fs:[00000030h]		4_2_04E1FDE2
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E1FDE2 mov eax, dword ptr fs:[00000030h]		4_2_04E1FDE2
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E08DF1 mov eax, dword ptr fs:[00000030h]		4_2_04E08DF1
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04DD6DC9 mov eax, dword ptr fs:[00000030h]		4_2_04DD6DC9
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04DD6DC9 mov eax, dword ptr fs:[00000030h]		4_2_04DD6DC9
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04DD6DC9 mov eax, dword ptr fs:[00000030h]		4_2_04DD6DC9
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04DD6DC9 mov ecx, dword ptr fs:[00000030h]		4_2_04DD6DC9
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04DD6DC9 mov eax, dword ptr fs:[00000030h]		4_2_04DD6DC9
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04DD6DC9 mov eax, dword ptr fs:[00000030h]		4_2_04DD6DC9
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D5B1E1 mov eax, dword ptr fs:[00000030h]		4_2_04D5B1E1
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D5B1E1 mov eax, dword ptr fs:[00000030h]		4_2_04D5B1E1
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D5B1E1 mov eax, dword ptr fs:[00000030h]		4_2_04D5B1E1
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04DE41E8 mov eax, dword ptr fs:[00000030h]		4_2_04DE41E8
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D6D5E0 mov eax, dword ptr fs:[00000030h]		4_2_04D6D5E0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D6D5E0 mov eax, dword ptr fs:[00000030h]		4_2_04D6D5E0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D8FD9B mov eax, dword ptr fs:[00000030h]		4_2_04D8FD9B
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D8FD9B mov eax, dword ptr fs:[00000030h]		4_2_04D8FD9B
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D82990 mov eax, dword ptr fs:[00000030h]		4_2_04D82990
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E205AC mov eax, dword ptr fs:[00000030h]		4_2_04E205AC
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E205AC mov eax, dword ptr fs:[00000030h]		4_2_04E205AC
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D7C182 mov eax, dword ptr fs:[00000030h]		4_2_04D7C182
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D82581 mov eax, dword ptr fs:[00000030h]		4_2_04D82581
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D82581 mov eax, dword ptr fs:[00000030h]		4_2_04D82581
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D82581 mov eax, dword ptr fs:[00000030h]		4_2_04D82581
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D82581 mov eax, dword ptr fs:[00000030h]		4_2_04D82581
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D8A185 mov eax, dword ptr fs:[00000030h]		4_2_04D8A185
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D52D8A mov eax, dword ptr fs:[00000030h]		4_2_04D52D8A
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D52D8A mov eax, dword ptr fs:[00000030h]		4_2_04D52D8A
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D52D8A mov eax, dword ptr fs:[00000030h]		4_2_04D52D8A
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D52D8A mov eax, dword ptr fs:[00000030h]		4_2_04D52D8A
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D52D8A mov eax, dword ptr fs:[00000030h]		4_2_04D52D8A
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04DD51BE mov eax, dword ptr fs:[00000030h]		4_2_04DD51BE
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04DD51BE mov eax, dword ptr fs:[00000030h]		4_2_04DD51BE
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04DD51BE mov eax, dword ptr fs:[00000030h]		4_2_04DD51BE
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04DD51BE mov eax, dword ptr fs:[00000030h]		4_2_04DD51BE
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D81DB5 mov eax, dword ptr fs:[00000030h]		4_2_04D81DB5
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D81DB5 mov eax, dword ptr fs:[00000030h]		4_2_04D81DB5
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D81DB5 mov eax, dword ptr fs:[00000030h]		4_2_04D81DB5
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D861A0 mov eax, dword ptr fs:[00000030h]		4_2_04D861A0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D861A0 mov eax, dword ptr fs:[00000030h]		4_2_04D861A0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D835A1 mov eax, dword ptr fs:[00000030h]		4_2_04D835A1
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04DD69A6 mov eax, dword ptr fs:[00000030h]		4_2_04DD69A6
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D77D50 mov eax, dword ptr fs:[00000030h]		4_2_04D77D50
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D7B944 mov eax, dword ptr fs:[00000030h]		4_2_04D7B944
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D7B944 mov eax, dword ptr fs:[00000030h]		4_2_04D7B944
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D93D43 mov eax, dword ptr fs:[00000030h]		4_2_04D93D43
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04DD3540 mov eax, dword ptr fs:[00000030h]		4_2_04DD3540
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D7C577 mov eax, dword ptr fs:[00000030h]		4_2_04D7C577
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D7C577 mov eax, dword ptr fs:[00000030h]		4_2_04D7C577
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D5B171 mov eax, dword ptr fs:[00000030h]		4_2_04D5B171
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D5B171 mov eax, dword ptr fs:[00000030h]		4_2_04D5B171
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D5C962 mov eax, dword ptr fs:[00000030h]		4_2_04D5C962
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D59100 mov eax, dword ptr fs:[00000030h]		4_2_04D59100
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D59100 mov eax, dword ptr fs:[00000030h]		4_2_04D59100
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D59100 mov eax, dword ptr fs:[00000030h]		4_2_04D59100
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E28D34 mov eax, dword ptr fs:[00000030h]		4_2_04E28D34
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E1E539 mov eax, dword ptr fs:[00000030h]		4_2_04E1E539
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D8513A mov eax, dword ptr fs:[00000030h]		4_2_04D8513A
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D8513A mov eax, dword ptr fs:[00000030h]		4_2_04D8513A
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D63D34 mov eax, dword ptr fs:[00000030h]		4_2_04D63D34
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D63D34 mov eax, dword ptr fs:[00000030h]		4_2_04D63D34
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D63D34 mov eax, dword ptr fs:[00000030h]		4_2_04D63D34
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D63D34 mov eax, dword ptr fs:[00000030h]		4_2_04D63D34
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D63D34 mov eax, dword ptr fs:[00000030h]		4_2_04D63D34
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D63D34 mov eax, dword ptr fs:[00000030h]		4_2_04D63D34
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D63D34 mov eax, dword ptr fs:[00000030h]		4_2_04D63D34
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D63D34 mov eax, dword ptr fs:[00000030h]		4_2_04D63D34
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D63D34 mov eax, dword ptr fs:[00000030h]		4_2_04D63D34
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D63D34 mov eax, dword ptr fs:[00000030h]		4_2_04D63D34
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D63D34 mov eax, dword ptr fs:[00000030h]		4_2_04D63D34
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D63D34 mov eax, dword ptr fs:[00000030h]		4_2_04D63D34
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D63D34 mov eax, dword ptr fs:[00000030h]		4_2_04D63D34
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D84D3B mov eax, dword ptr fs:[00000030h]		4_2_04D84D3B
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D84D3B mov eax, dword ptr fs:[00000030h]		4_2_04D84D3B
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D84D3B mov eax, dword ptr fs:[00000030h]		4_2_04D84D3B
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D5AD30 mov eax, dword ptr fs:[00000030h]		4_2_04D5AD30
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04DDA537 mov eax, dword ptr fs:[00000030h]		4_2_04DDA537
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D74120 mov eax, dword ptr fs:[00000030h]		4_2_04D74120
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D74120 mov eax, dword ptr fs:[00000030h]		4_2_04D74120
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D74120 mov eax, dword ptr fs:[00000030h]		4_2_04D74120
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D74120 mov eax, dword ptr fs:[00000030h]		4_2_04D74120
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D74120 mov ecx, dword ptr fs:[00000030h]		4_2_04D74120
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D82ACB mov eax, dword ptr fs:[00000030h]		4_2_04D82ACB
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D836CC mov eax, dword ptr fs:[00000030h]		4_2_04D836CC
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D98EC7 mov eax, dword ptr fs:[00000030h]		4_2_04D98EC7
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E0FEC0 mov eax, dword ptr fs:[00000030h]		4_2_04E0FEC0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E28ED6 mov eax, dword ptr fs:[00000030h]		4_2_04E28ED6
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D676E2 mov eax, dword ptr fs:[00000030h]		4_2_04D676E2
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D816E0 mov ecx, dword ptr fs:[00000030h]		4_2_04D816E0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D82AE4 mov eax, dword ptr fs:[00000030h]		4_2_04D82AE4
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E20EA5 mov eax, dword ptr fs:[00000030h]		4_2_04E20EA5
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E20EA5 mov eax, dword ptr fs:[00000030h]		4_2_04E20EA5
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E20EA5 mov eax, dword ptr fs:[00000030h]		4_2_04E20EA5
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D8D294 mov eax, dword ptr fs:[00000030h]		4_2_04D8D294
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D8D294 mov eax, dword ptr fs:[00000030h]		4_2_04D8D294
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04DEFE87 mov eax, dword ptr fs:[00000030h]		4_2_04DEFE87
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D6AAB0 mov eax, dword ptr fs:[00000030h]		4_2_04D6AAB0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D6AAB0 mov eax, dword ptr fs:[00000030h]		4_2_04D6AAB0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D8FAB0 mov eax, dword ptr fs:[00000030h]		4_2_04D8FAB0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D552A5 mov eax, dword ptr fs:[00000030h]		4_2_04D552A5
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D552A5 mov eax, dword ptr fs:[00000030h]		4_2_04D552A5
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D552A5 mov eax, dword ptr fs:[00000030h]		4_2_04D552A5
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D552A5 mov eax, dword ptr fs:[00000030h]		4_2_04D552A5
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D552A5 mov eax, dword ptr fs:[00000030h]		4_2_04D552A5
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04DD46A7 mov eax, dword ptr fs:[00000030h]		4_2_04DD46A7
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E0B260 mov eax, dword ptr fs:[00000030h]		4_2_04E0B260
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E0B260 mov eax, dword ptr fs:[00000030h]		4_2_04E0B260
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E28A62 mov eax, dword ptr fs:[00000030h]		4_2_04E28A62
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04DE4257 mov eax, dword ptr fs:[00000030h]		4_2_04DE4257
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D59240 mov eax, dword ptr fs:[00000030h]		4_2_04D59240
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D59240 mov eax, dword ptr fs:[00000030h]		4_2_04D59240
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D59240 mov eax, dword ptr fs:[00000030h]		4_2_04D59240
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D59240 mov eax, dword ptr fs:[00000030h]		4_2_04D59240
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D67E41 mov eax, dword ptr fs:[00000030h]		4_2_04D67E41
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D67E41 mov eax, dword ptr fs:[00000030h]		4_2_04D67E41
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D67E41 mov eax, dword ptr fs:[00000030h]		4_2_04D67E41
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D67E41 mov eax, dword ptr fs:[00000030h]		4_2_04D67E41
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D67E41 mov eax, dword ptr fs:[00000030h]		4_2_04D67E41
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D67E41 mov eax, dword ptr fs:[00000030h]		4_2_04D67E41
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D9927A mov eax, dword ptr fs:[00000030h]		4_2_04D9927A
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D7AE73 mov eax, dword ptr fs:[00000030h]		4_2_04D7AE73
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D7AE73 mov eax, dword ptr fs:[00000030h]		4_2_04D7AE73
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D7AE73 mov eax, dword ptr fs:[00000030h]		4_2_04D7AE73
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D7AE73 mov eax, dword ptr fs:[00000030h]		4_2_04D7AE73
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D7AE73 mov eax, dword ptr fs:[00000030h]		4_2_04D7AE73
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E1AE44 mov eax, dword ptr fs:[00000030h]		4_2_04E1AE44
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E1AE44 mov eax, dword ptr fs:[00000030h]		4_2_04E1AE44
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E1EA55 mov eax, dword ptr fs:[00000030h]		4_2_04E1EA55
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D6766D mov eax, dword ptr fs:[00000030h]		4_2_04D6766D
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D5AA16 mov eax, dword ptr fs:[00000030h]		4_2_04D5AA16
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D5AA16 mov eax, dword ptr fs:[00000030h]		4_2_04D5AA16
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D8A61C mov eax, dword ptr fs:[00000030h]		4_2_04D8A61C
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D8A61C mov eax, dword ptr fs:[00000030h]		4_2_04D8A61C
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D55210 mov eax, dword ptr fs:[00000030h]		4_2_04D55210
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D55210 mov ecx, dword ptr fs:[00000030h]		4_2_04D55210
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D55210 mov eax, dword ptr fs:[00000030h]		4_2_04D55210
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D55210 mov eax, dword ptr fs:[00000030h]		4_2_04D55210
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D73A1C mov eax, dword ptr fs:[00000030h]		4_2_04D73A1C
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D5C600 mov eax, dword ptr fs:[00000030h]		4_2_04D5C600
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D5C600 mov eax, dword ptr fs:[00000030h]		4_2_04D5C600
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D5C600 mov eax, dword ptr fs:[00000030h]		4_2_04D5C600
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D88E00 mov eax, dword ptr fs:[00000030h]		4_2_04D88E00
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D68A0A mov eax, dword ptr fs:[00000030h]		4_2_04D68A0A
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E0FE3F mov eax, dword ptr fs:[00000030h]		4_2_04E0FE3F
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E11608 mov eax, dword ptr fs:[00000030h]		4_2_04E11608
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D5E620 mov eax, dword ptr fs:[00000030h]		4_2_04D5E620
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D94A2C mov eax, dword ptr fs:[00000030h]		4_2_04D94A2C
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D94A2C mov eax, dword ptr fs:[00000030h]		4_2_04D94A2C
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04DD53CA mov eax, dword ptr fs:[00000030h]		4_2_04DD53CA
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04DD53CA mov eax, dword ptr fs:[00000030h]		4_2_04DD53CA
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D937F5 mov eax, dword ptr fs:[00000030h]		4_2_04D937F5
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D803E2 mov eax, dword ptr fs:[00000030h]		4_2_04D803E2
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D803E2 mov eax, dword ptr fs:[00000030h]		4_2_04D803E2
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D803E2 mov eax, dword ptr fs:[00000030h]		4_2_04D803E2
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D803E2 mov eax, dword ptr fs:[00000030h]		4_2_04D803E2
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D803E2 mov eax, dword ptr fs:[00000030h]		4_2_04D803E2
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D803E2 mov eax, dword ptr fs:[00000030h]		4_2_04D803E2
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D7DBE9 mov eax, dword ptr fs:[00000030h]		4_2_04D7DBE9
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D68794 mov eax, dword ptr fs:[00000030h]		4_2_04D68794
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04E25BA5 mov eax, dword ptr fs:[00000030h]		4_2_04E25BA5
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04D8B390 mov eax, dword ptr fs:[00000030h]		4_2_04D8B390
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04DD7794 mov eax, dword ptr fs:[00000030h]		4_2_04DD7794

Enables debug privileges

Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Process token adjusted: Debug			Jump to behavior

Creates guard pages, often used to prevent reverse engineering and debugging

Source: C:\Users\user\Desktop\vOKMFxiCYt.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 3.138.72.189 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 198.49.23.141 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 162.0.232.118 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 34.102.136.180 80			Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\vOKMFxiCYt.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\vOKMFxiCYt.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A

Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Section loaded: unknown target: C:\Windows\SysWOW64\raserver.exe protection: execute and read and write			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Section loaded: unknown target: C:\Windows\SysWOW64\raserver.exe protection: execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write			Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write			Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread register set: target process: 3388			Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Thread register set: target process: 3388			Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Sample uses process hollowing technique

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Section unmapped: C:\Windows\SysWOW64\raserver.exe base address: 1170000

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000			Jump to behavior
Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 401000			Jump to behavior
Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: E6C008			Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe			Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'			Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: explorer.exe, 00000002.00000000.245822763.0000000001398000.00000004.00000020.sdmp	Binary or memory string: ProgmanamF
Source: explorer.exe, 00000002.00000002.505091353.0000000001980000.00000002.00000001.sdmp, raserver.exe, 00000004.00000002.504863704.00000000035E0000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000002.00000000.253425578.0000000006860000.00000004.00000001.sdmp, raserver.exe, 00000004.00000002.504863704.00000000035E0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000002.00000002.505091353.0000000001980000.00000002.00000001.sdmp, raserver.exe, 00000004.00000002.504863704.00000000035E0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000002.00000002.505091353.0000000001980000.00000002.00000001.sdmp, raserver.exe, 00000004.00000002.504863704.00000000035E0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Queries volume information: C:\Users\user\Desktop\vOKMFxiCYt.exe VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\vOKMFxiCYt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation			Jump to behavior

Queries the cryptographic machine GUID

Source: C:\Users\user\Desktop\vOKMFxiCYt.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected FormBook

Source: Yara match	File source: 00000001.00000002.272036979.00000000015B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.271729564.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.242174585.0000000003AC9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.504019492.0000000001140000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.272011723.0000000001580000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.503167127.0000000000E00000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.505106609.0000000004AF0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 1.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected FormBook

Source: Yara match	File source: 00000001.00000002.272036979.00000000015B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.271729564.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.242174585.0000000003AC9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.504019492.0000000001140000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.272011723.0000000001580000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.503167127.0000000000E00000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.505106609.0000000004AF0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 1.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE