Analysis Report invoice.exe

Overview

General Information

Sample Name: invoice.exe
Analysis ID: 383898
MD5: 492017e064cab97dd8ea27abd3e5cfca
SHA1: a3addbdea8245b2e16c6ef551755b9d0e66e8e2b
SHA256: 524306af2db603c7db95227603c3014b67c27cfb2f88d12de2a599ece24575e2
Tags: exe
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Malicious sample detected (through community Yara rule)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Yara detected AntiVM3
Yara detected FormBook
C2 URLs / IPs found in malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Antivirus or Machine Learning detection for unpacked file
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains strange resources
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection:

barindex
Found malware configuration
Source: 00000009.00000002.490575290.0000000002AE0000.00000004.00000001.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.sookepointcargo.com/e3rs/"], "decoy": ["mcni360clientapp.com", "dateyourlovelive.club", "amongugadu.com", "jarruslogistics.com", "jeejwbvf.icu", "amnil-wecu.xyz", "armaccountingbs.com", "revistadedisseny.com", "aqiyi.club", "cuchdblackboard.com", "hancement.info", "humanizantes.com", "slingshotct.com", "degen.fund", "onemindtransformed.com", "theunlearningjourney.com", "zmid.xyz", "profirma-nachfolge.com", "curiget.xyz", "officinadellapappa.com", "leverage.community", "improvetechprocess.com", "legacyadmin.support", "quantumwater.info", "gsinghproperties.com", "gigbager.com", "menpeeinthesink.com", "ultimate.icu", "hotelmaktub.com", "arizonagridiron.com", "rvsmiami.com", "allzodiac.com", "knoxvilleoutdoorkitchens.com", "gunungbatufrozen.com", "keystone-sd.com", "positiveagenda-consulting.com", "harshdeepfashion.com", "imetmymurdereronline.com", "thesnackculture.com", "carolinapropertiessolution.com", "prfectskin.com", "okaog.com", "highdeserthealthinsurance.com", "ovelgonne.com", "tgcmaine.com", "jinlan.online", "airportlimo4u.com", "serendipity-collective.com", "bibeiw.com", "unagelo.com", "pageonefourplay.info", "apmrfgpu.icu", "cognitiveautomationtool.com", "applelucycooking.com", "can-march.xyz", "modernmarvelrealtors.com", "panasianetwork.net", "flowhcf.com", "earwaxsux.com", "konakia.net", "bges301.com", "rosuba.com", "hedgetheory.com", "myyearwithoutjews.com"]}
Yara detected FormBook
Source: Yara match File source: 00000009.00000002.490575290.0000000002AE0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.287914993.0000000001AE0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.286861103.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.287952464.0000000001B10000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.490405309.00000000026A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.488897398.00000000021B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.246170025.0000000003EAC000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 3.2.invoice.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.invoice.exe.400000.0.raw.unpack, type: UNPACKEDPE
Machine Learning detection for sample
Source: invoice.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 3.2.invoice.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

barindex
Uses 32bit PE files
Source: invoice.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: invoice.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: wscript.pdbGCTL source: invoice.exe, 00000003.00000002.288057088.0000000001B70000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdbUGP source: invoice.exe, 00000003.00000002.287622749.00000000018CF000.00000040.00000001.sdmp, wscript.exe, 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: invoice.exe, 00000003.00000002.287622749.00000000018CF000.00000040.00000001.sdmp, wscript.exe
Source: Binary string: wscript.pdb source: invoice.exe, 00000003.00000002.288057088.0000000001B70000.00000040.00000001.sdmp

Software Vulnerabilities:

barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\invoice.exe Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h 0_2_02BF81C0
Source: C:\Users\user\Desktop\invoice.exe Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h 0_2_02BF81B0
Source: C:\Users\user\Desktop\invoice.exe Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h 0_2_02BF96E0
Source: C:\Users\user\Desktop\invoice.exe Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h 0_2_02BF96D0
Source: C:\Users\user\Desktop\invoice.exe Code function: 4x nop then pop esi 3_2_0041584F
Source: C:\Windows\SysWOW64\wscript.exe Code function: 4x nop then pop esi 9_2_021C584F

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49717 -> 184.168.131.241:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49717 -> 184.168.131.241:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49717 -> 184.168.131.241:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49725 -> 208.91.197.91:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49725 -> 208.91.197.91:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49725 -> 208.91.197.91:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49732 -> 177.55.108.130:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49732 -> 177.55.108.130:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49732 -> 177.55.108.130:80
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.sookepointcargo.com/e3rs/
Performs DNS queries to domains with low reputation
Source: C:\Windows\explorer.exe DNS query: www.zmid.xyz
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /e3rs/?uFQl=XP7HMT_8&w0G=7EcTScmBGLYmOphx6WmAanuMW8SmjCZcy1cTUFzuZxTbodjrouz1iofcKvfRvNdFU6cO HTTP/1.1Host: www.flowhcf.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /e3rs/?uFQl=XP7HMT_8&w0G=0ZKu2HAGzvZQR/qsYgBhCWXzZU+pty94akjoW6oXtCN964+Lsvy2TInFlM7SmRuoaV8X HTTP/1.1Host: www.jinlan.onlineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /e3rs/?w0G=UjY/ETYDec4qhoizf7RP+uVqhCLoGuhip7tAF9t9xQZdbBeLWBLuGPY37yNXVCM5GTyP&uFQl=XP7HMT_8 HTTP/1.1Host: www.armaccountingbs.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /e3rs/?w0G=3w4QHVrJOCimt90ZTeKXMe7ZrYb4bnkzv7QZzufjPqhFBPGQ1SrJ/wFsHy6lqdqQBlr0&uFQl=XP7HMT_8 HTTP/1.1Host: www.knoxvilleoutdoorkitchens.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /e3rs/?w0G=7ZSYqSAb20IhJodkc2ZZv2+VQiffweVGAnhTkqT9MP7KQ1W755ixlatoWnihL/C2wZs0&uFQl=XP7HMT_8 HTTP/1.1Host: www.highdeserthealthinsurance.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /e3rs/?uFQl=XP7HMT_8&w0G=Ok77fVcdVMfIiR4pMXON/NN29f2Jfu2AMoU186FmLUOu6U92Y3SpeQqKBhzvmDYI2dCa HTTP/1.1Host: www.hotelmaktub.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /e3rs/?w0G=0yUiwx1wLvxUfzb5kCZXOl2J+dvoSMZhdpoUDtYYFWxv9npQwlOrxt3zkZH4aLHtWZT3&uFQl=XP7HMT_8 HTTP/1.1Host: www.legacyadmin.supportConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 192.0.78.24 192.0.78.24
Source: Joe Sandbox View IP Address: 208.91.197.91 208.91.197.91
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: AUTOMATTICUS AUTOMATTICUS
Source: Joe Sandbox View ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View ASN Name: CONFLUENCE-NETWORK-INCVG CONFLUENCE-NETWORK-INCVG
Source: global traffic HTTP traffic detected: GET /e3rs/?uFQl=XP7HMT_8&w0G=7EcTScmBGLYmOphx6WmAanuMW8SmjCZcy1cTUFzuZxTbodjrouz1iofcKvfRvNdFU6cO HTTP/1.1Host: www.flowhcf.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /e3rs/?uFQl=XP7HMT_8&w0G=0ZKu2HAGzvZQR/qsYgBhCWXzZU+pty94akjoW6oXtCN964+Lsvy2TInFlM7SmRuoaV8X HTTP/1.1Host: www.jinlan.onlineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /e3rs/?w0G=UjY/ETYDec4qhoizf7RP+uVqhCLoGuhip7tAF9t9xQZdbBeLWBLuGPY37yNXVCM5GTyP&uFQl=XP7HMT_8 HTTP/1.1Host: www.armaccountingbs.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /e3rs/?w0G=3w4QHVrJOCimt90ZTeKXMe7ZrYb4bnkzv7QZzufjPqhFBPGQ1SrJ/wFsHy6lqdqQBlr0&uFQl=XP7HMT_8 HTTP/1.1Host: www.knoxvilleoutdoorkitchens.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /e3rs/?w0G=7ZSYqSAb20IhJodkc2ZZv2+VQiffweVGAnhTkqT9MP7KQ1W755ixlatoWnihL/C2wZs0&uFQl=XP7HMT_8 HTTP/1.1Host: www.highdeserthealthinsurance.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /e3rs/?uFQl=XP7HMT_8&w0G=Ok77fVcdVMfIiR4pMXON/NN29f2Jfu2AMoU186FmLUOu6U92Y3SpeQqKBhzvmDYI2dCa HTTP/1.1Host: www.hotelmaktub.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /e3rs/?w0G=0yUiwx1wLvxUfzb5kCZXOl2J+dvoSMZhdpoUDtYYFWxv9npQwlOrxt3zkZH4aLHtWZT3&uFQl=XP7HMT_8 HTTP/1.1Host: www.legacyadmin.supportConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: unknown DNS traffic detected: queries for: www.flowhcf.com
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.16.1Date: Thu, 08 Apr 2021 10:04:37 GMTContent-Type: text/htmlContent-Length: 153Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.16.1</center></body></html>
Source: invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: invoice.exe, 00000000.00000002.245256874.0000000002EBE000.00000004.00000001.sdmp, invoice.exe, 00000000.00000002.245138274.0000000002EA1000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: invoice.exe, 00000000.00000002.245256874.0000000002EBE000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name4
Source: invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: wscript.exe, 00000009.00000002.494442857.0000000004CF2000.00000004.00000001.sdmp String found in binary or memory: http://www.knoxvilleoutdoorkitchens.com/?fp=acjVxO24ruBE1bSnAJOOFeZ9d2%2Bill3hWebcMHeneryqde34aljK8g
Source: invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: invoice.exe, 00000000.00000002.251392987.0000000006E22000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.272462034.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: invoice.exe String found in binary or memory: https://dist.nuget.org/win-x86-commandline/latest/nuget.exe
Source: invoice.exe String found in binary or memory: https://github.com/Spegeli/Pokemon-Go-Rocket-API/archive/master.zip
Source: invoice.exe String found in binary or memory: https://github.com/d-haxton/HaxtonBot/archive/master.zip
Source: invoice.exe, 00000000.00000002.245201549.0000000002EB3000.00000004.00000001.sdmp String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
Source: wscript.exe, 00000009.00000002.494442857.0000000004CF2000.00000004.00000001.sdmp String found in binary or memory: https://www.legacyadmin.support/e3rs/?w0G=0yUiwx1wLvxUfzb5kCZXOl2J

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 00000009.00000002.490575290.0000000002AE0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.287914993.0000000001AE0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.286861103.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.287952464.0000000001B10000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.490405309.00000000026A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.488897398.00000000021B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.246170025.0000000003EAC000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 3.2.invoice.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.invoice.exe.400000.0.raw.unpack, type: UNPACKEDPE

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 00000009.00000002.490575290.0000000002AE0000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.490575290.0000000002AE0000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.287914993.0000000001AE0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.287914993.0000000001AE0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.286861103.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.286861103.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.287952464.0000000001B10000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.287952464.0000000001B10000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000002.490405309.00000000026A0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.490405309.00000000026A0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000002.488897398.00000000021B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.488897398.00000000021B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.246170025.0000000003EAC000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.246170025.0000000003EAC000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.2.invoice.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.invoice.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.2.invoice.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.invoice.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: invoice.exe
Contains functionality to call native functions
Source: C:\Users\user\Desktop\invoice.exe Code function: 3_2_004181D0 NtCreateFile, 3_2_004181D0
Source: C:\Users\user\Desktop\invoice.exe Code function: 3_2_00418280 NtReadFile, 3_2_00418280
Source: C:\Users\user\Desktop\invoice.exe Code function: 3_2_00418300 NtClose, 3_2_00418300
Source: C:\Users\user\Desktop\invoice.exe Code function: 3_2_004183B0 NtAllocateVirtualMemory, 3_2_004183B0
Source: C:\Users\user\Desktop\invoice.exe Code function: 3_2_0041827A NtReadFile, 3_2_0041827A
Source: C:\Users\user\Desktop\invoice.exe Code function: 3_2_004182FB NtReadFile, 3_2_004182FB
Source: C:\Users\user\Desktop\invoice.exe Code function: 3_2_004183AA NtAllocateVirtualMemory, 3_2_004183AA
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046A9540 NtReadFile,LdrInitializeThunk, 9_2_046A9540
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046A95D0 NtClose,LdrInitializeThunk, 9_2_046A95D0
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046A9660 NtAllocateVirtualMemory,LdrInitializeThunk, 9_2_046A9660
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046A9650 NtQueryValueKey,LdrInitializeThunk, 9_2_046A9650
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046A96E0 NtFreeVirtualMemory,LdrInitializeThunk, 9_2_046A96E0
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046A96D0 NtCreateKey,LdrInitializeThunk, 9_2_046A96D0
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046A9710 NtQueryInformationToken,LdrInitializeThunk, 9_2_046A9710
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046A9FE0 NtCreateMutant,LdrInitializeThunk, 9_2_046A9FE0
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046A9780 NtMapViewOfSection,LdrInitializeThunk, 9_2_046A9780
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046A9860 NtQuerySystemInformation,LdrInitializeThunk, 9_2_046A9860
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046A9840 NtDelayExecution,LdrInitializeThunk, 9_2_046A9840
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046A9910 NtAdjustPrivilegesToken,LdrInitializeThunk, 9_2_046A9910
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046A99A0 NtCreateSection,LdrInitializeThunk, 9_2_046A99A0
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046A9A50 NtCreateFile,LdrInitializeThunk, 9_2_046A9A50
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046A9560 NtWriteFile, 9_2_046A9560
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046A9520 NtWaitForSingleObject, 9_2_046A9520
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046AAD30 NtSetContextThread, 9_2_046AAD30
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046A95F0 NtQueryInformationFile, 9_2_046A95F0
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046A9670 NtQueryInformationProcess, 9_2_046A9670
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046A9610 NtEnumerateValueKey, 9_2_046A9610
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046A9760 NtOpenProcess, 9_2_046A9760
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046AA770 NtOpenThread, 9_2_046AA770
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046A9770 NtSetInformationFile, 9_2_046A9770
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046A9730 NtQueryVirtualMemory, 9_2_046A9730
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046AA710 NtOpenProcessToken, 9_2_046AA710
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046A97A0 NtUnmapViewOfSection, 9_2_046A97A0
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046AB040 NtSuspendThread, 9_2_046AB040
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046A9820 NtEnumerateKey, 9_2_046A9820
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046A98F0 NtReadVirtualMemory, 9_2_046A98F0
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046A98A0 NtWriteVirtualMemory, 9_2_046A98A0
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046A9950 NtQueueApcThread, 9_2_046A9950
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046A99D0 NtCreateProcessEx, 9_2_046A99D0
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046A9A20 NtResumeThread, 9_2_046A9A20
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046A9A00 NtProtectVirtualMemory, 9_2_046A9A00
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046A9A10 NtQuerySection, 9_2_046A9A10
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046A9A80 NtOpenDirectoryObject, 9_2_046A9A80
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046A9B00 NtSetValueKey, 9_2_046A9B00
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046AA3B0 NtGetContextThread, 9_2_046AA3B0
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_021C8280 NtReadFile, 9_2_021C8280
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_021C8300 NtClose, 9_2_021C8300
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_021C83B0 NtAllocateVirtualMemory, 9_2_021C83B0
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_021C81D0 NtCreateFile, 9_2_021C81D0
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_021C827A NtReadFile, 9_2_021C827A
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_021C82FB NtReadFile, 9_2_021C82FB
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_021C83AA NtAllocateVirtualMemory, 9_2_021C83AA
Detected potential crypto function
Source: C:\Users\user\Desktop\invoice.exe Code function: 0_2_00802050 0_2_00802050
Source: C:\Users\user\Desktop\invoice.exe Code function: 0_2_011794A8 0_2_011794A8
Source: C:\Users\user\Desktop\invoice.exe Code function: 0_2_0117DCF4 0_2_0117DCF4
Source: C:\Users\user\Desktop\invoice.exe Code function: 0_2_0117C148 0_2_0117C148
Source: C:\Users\user\Desktop\invoice.exe Code function: 0_2_0117E218 0_2_0117E218
Source: C:\Users\user\Desktop\invoice.exe Code function: 0_2_0117A748 0_2_0117A748
Source: C:\Users\user\Desktop\invoice.exe Code function: 0_2_0117DCE8 0_2_0117DCE8
Source: C:\Users\user\Desktop\invoice.exe Code function: 0_2_02BF0040 0_2_02BF0040
Source: C:\Users\user\Desktop\invoice.exe Code function: 0_2_02BF5930 0_2_02BF5930
Source: C:\Users\user\Desktop\invoice.exe Code function: 0_2_02BF1331 0_2_02BF1331
Source: C:\Users\user\Desktop\invoice.exe Code function: 0_2_02BF1340 0_2_02BF1340
Source: C:\Users\user\Desktop\invoice.exe Code function: 0_2_02BF0006 0_2_02BF0006
Source: C:\Users\user\Desktop\invoice.exe Code function: 0_2_02BF5558 0_2_02BF5558
Source: C:\Users\user\Desktop\invoice.exe Code function: 0_2_02BF5548 0_2_02BF5548
Source: C:\Users\user\Desktop\invoice.exe Code function: 0_2_02BF1A38 0_2_02BF1A38
Source: C:\Users\user\Desktop\invoice.exe Code function: 0_2_02BF1A27 0_2_02BF1A27
Source: C:\Users\user\Desktop\invoice.exe Code function: 0_2_02BF5B95 0_2_02BF5B95
Source: C:\Users\user\Desktop\invoice.exe Code function: 0_2_02BF5B3B 0_2_02BF5B3B
Source: C:\Users\user\Desktop\invoice.exe Code function: 0_2_02BF5B5A 0_2_02BF5B5A
Source: C:\Users\user\Desktop\invoice.exe Code function: 0_2_02BF28F7 0_2_02BF28F7
Source: C:\Users\user\Desktop\invoice.exe Code function: 3_2_0041C803 3_2_0041C803
Source: C:\Users\user\Desktop\invoice.exe Code function: 3_2_00401030 3_2_00401030
Source: C:\Users\user\Desktop\invoice.exe Code function: 3_2_00408C6B 3_2_00408C6B
Source: C:\Users\user\Desktop\invoice.exe Code function: 3_2_00408C70 3_2_00408C70
Source: C:\Users\user\Desktop\invoice.exe Code function: 3_2_00402D90 3_2_00402D90
Source: C:\Users\user\Desktop\invoice.exe Code function: 3_2_0041C598 3_2_0041C598
Source: C:\Users\user\Desktop\invoice.exe Code function: 3_2_00402FB0 3_2_00402FB0
Source: C:\Users\user\Desktop\invoice.exe Code function: 3_2_00D72050 3_2_00D72050
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0472D466 9_2_0472D466
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0467841F 9_2_0467841F
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04731D55 9_2_04731D55
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04660D20 9_2_04660D20
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04732D07 9_2_04732D07
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0467D5E0 9_2_0467D5E0
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_047325DD 9_2_047325DD
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04692581 9_2_04692581
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04686E30 9_2_04686E30
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0472D616 9_2_0472D616
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04732EF7 9_2_04732EF7
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04731FF1 9_2_04731FF1
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04721002 9_2_04721002
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_047328EC 9_2_047328EC
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046920A0 9_2_046920A0
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_047320A8 9_2_047320A8
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0467B090 9_2_0467B090
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04684120 9_2_04684120
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0466F900 9_2_0466F900
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_047322AE 9_2_047322AE
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04732B28 9_2_04732B28
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0472DBD2 9_2_0472DBD2
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0469EBB0 9_2_0469EBB0
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_021CC803 9_2_021CC803
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_021B2FB0 9_2_021B2FB0
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_021B8C70 9_2_021B8C70
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_021B8C6B 9_2_021B8C6B
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_021CC598 9_2_021CC598
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_021B2D90 9_2_021B2D90
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\wscript.exe Code function: String function: 0466B150 appears 35 times
PE file contains strange resources
Source: invoice.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Sample file is different than original file name gathered from version info
Source: invoice.exe Binary or memory string: OriginalFilename vs invoice.exe
Source: invoice.exe, 00000000.00000000.221487542.0000000000802000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameCharTypeInfo.exeD vs invoice.exe
Source: invoice.exe, 00000000.00000002.253920792.00000000074A0000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameDSASignature.dll" vs invoice.exe
Source: invoice.exe, 00000000.00000002.245256874.0000000002EBE000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameSimpleUI.dll2 vs invoice.exe
Source: invoice.exe Binary or memory string: OriginalFilename vs invoice.exe
Source: invoice.exe, 00000003.00000000.241463096.0000000000D72000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameCharTypeInfo.exeD vs invoice.exe
Source: invoice.exe, 00000003.00000002.288057088.0000000001B70000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamewscript.exe` vs invoice.exe
Source: invoice.exe, 00000003.00000002.287622749.00000000018CF000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs invoice.exe
Source: invoice.exe Binary or memory string: OriginalFilenameCharTypeInfo.exeD vs invoice.exe
Uses 32bit PE files
Source: invoice.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Yara signature match
Source: 00000009.00000002.490575290.0000000002AE0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.490575290.0000000002AE0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.287914993.0000000001AE0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.287914993.0000000001AE0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.286861103.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.286861103.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.287952464.0000000001B10000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.287952464.0000000001B10000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000002.490405309.00000000026A0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.490405309.00000000026A0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000002.488897398.00000000021B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.488897398.00000000021B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.246170025.0000000003EAC000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.246170025.0000000003EAC000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.2.invoice.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.invoice.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.2.invoice.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.invoice.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: invoice.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: classification engine Classification label: mal100.troj.evad.winEXE@7/1@15/8
Source: C:\Users\user\Desktop\invoice.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\invoice.exe.log Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6196:120:WilError_01
Source: invoice.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\invoice.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: invoice.exe, 00000000.00000002.245201549.0000000002EB3000.00000004.00000001.sdmp Binary or memory string: Select * from UnmanagedMemoryStreamWrapper WHERE modelo=@modelo;?
Source: invoice.exe, 00000000.00000002.245201549.0000000002EB3000.00000004.00000001.sdmp Binary or memory string: Select * from Clientes WHERE id=@id;;
Source: invoice.exe, 00000000.00000002.245201549.0000000002EB3000.00000004.00000001.sdmp Binary or memory string: Select * from Aluguel5Erro ao listar Banco sql-UnmanagedMemoryStreamWrapper.INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: invoice.exe, 00000000.00000002.245201549.0000000002EB3000.00000004.00000001.sdmp Binary or memory string: INSERT INTO UnmanagedMemoryStreamWrapper VALUES(@modelo, @fabricante, @ano, @cor);
Source: invoice.exe, 00000000.00000002.245201549.0000000002EB3000.00000004.00000001.sdmp Binary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
Source: invoice.exe, 00000000.00000002.245201549.0000000002EB3000.00000004.00000001.sdmp Binary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
Source: invoice.exe, 00000000.00000002.245201549.0000000002EB3000.00000004.00000001.sdmp Binary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: unknown Process created: C:\Users\user\Desktop\invoice.exe 'C:\Users\user\Desktop\invoice.exe'
Source: C:\Users\user\Desktop\invoice.exe Process created: C:\Users\user\Desktop\invoice.exe C:\Users\user\Desktop\invoice.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\wscript.exe
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\invoice.exe'
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\invoice.exe Process created: C:\Users\user\Desktop\invoice.exe C:\Users\user\Desktop\invoice.exe Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\invoice.exe' Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: invoice.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: invoice.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: wscript.pdbGCTL source: invoice.exe, 00000003.00000002.288057088.0000000001B70000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdbUGP source: invoice.exe, 00000003.00000002.287622749.00000000018CF000.00000040.00000001.sdmp, wscript.exe, 00000009.00000002.492637672.000000000475F000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: invoice.exe, 00000003.00000002.287622749.00000000018CF000.00000040.00000001.sdmp, wscript.exe
Source: Binary string: wscript.pdb source: invoice.exe, 00000003.00000002.288057088.0000000001B70000.00000040.00000001.sdmp

Data Obfuscation:

barindex
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\invoice.exe Code function: 0_2_0081855F push dword ptr [esi+3Fh]; iretd 0_2_00818571
Source: C:\Users\user\Desktop\invoice.exe Code function: 0_2_008192CB push FFFFFFD9h; iretd 0_2_008192E8
Source: C:\Users\user\Desktop\invoice.exe Code function: 0_2_02BF6A44 push A1FFFFFEh; ret 0_2_02BF6A49
Source: C:\Users\user\Desktop\invoice.exe Code function: 3_2_004161E2 push 00000062h; ret 3_2_004161E5
Source: C:\Users\user\Desktop\invoice.exe Code function: 3_2_0041B3C5 push eax; ret 3_2_0041B418
Source: C:\Users\user\Desktop\invoice.exe Code function: 3_2_0041B47C push eax; ret 3_2_0041B482
Source: C:\Users\user\Desktop\invoice.exe Code function: 3_2_0041B412 push eax; ret 3_2_0041B418
Source: C:\Users\user\Desktop\invoice.exe Code function: 3_2_0041B41B push eax; ret 3_2_0041B482
Source: C:\Users\user\Desktop\invoice.exe Code function: 3_2_004157E0 push esi; ret 3_2_00415809
Source: C:\Users\user\Desktop\invoice.exe Code function: 3_2_00D892CB push FFFFFFD9h; iretd 3_2_00D892E8
Source: C:\Users\user\Desktop\invoice.exe Code function: 3_2_00D8855F push dword ptr [esi+3Fh]; iretd 3_2_00D88571
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046BD0D1 push ecx; ret 9_2_046BD0E4
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_021CB3C5 push eax; ret 9_2_021CB418
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_021C61E2 push 00000062h; ret 9_2_021C61E5
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_021C57E0 push esi; ret 9_2_021C5809
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_021CB41B push eax; ret 9_2_021CB482
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_021CB412 push eax; ret 9_2_021CB418
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_021CB47C push eax; ret 9_2_021CB482
Source: initial sample Static PE information: section name: .text entropy: 7.55515603565
Source: C:\Users\user\Desktop\invoice.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Yara detected AntiVM3
Source: Yara match File source: 00000000.00000002.245201549.0000000002EB3000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: invoice.exe PID: 1972, type: MEMORY
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: invoice.exe, 00000000.00000002.245201549.0000000002EB3000.00000004.00000001.sdmp Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: invoice.exe, 00000000.00000002.245201549.0000000002EB3000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLL
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\invoice.exe RDTSC instruction interceptor: First address: 00000000004085F4 second address: 00000000004085FA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\invoice.exe RDTSC instruction interceptor: First address: 000000000040898E second address: 0000000000408994 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\wscript.exe RDTSC instruction interceptor: First address: 00000000021B85F4 second address: 00000000021B85FA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\wscript.exe RDTSC instruction interceptor: First address: 00000000021B898E second address: 00000000021B8994 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\invoice.exe Code function: 3_2_004088C0 rdtsc 3_2_004088C0
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\invoice.exe Thread delayed: delay time: 922337203685477 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\invoice.exe TID: 4228 Thread sleep time: -99765s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe TID: 2244 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 6412 Thread sleep time: -40000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe TID: 6336 Thread sleep time: -44000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\wscript.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\wscript.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\invoice.exe Thread delayed: delay time: 99765 Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: explorer.exe, 00000004.00000000.269061528.000000000891C000.00000004.00000001.sdmp Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 00000004.00000000.268510649.0000000008270000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000004.00000000.251045811.0000000003710000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: invoice.exe, 00000000.00000002.245201549.0000000002EB3000.00000004.00000001.sdmp Binary or memory string: vmware
Source: invoice.exe, 00000000.00000002.245201549.0000000002EB3000.00000004.00000001.sdmp Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: invoice.exe, 00000000.00000002.245201549.0000000002EB3000.00000004.00000001.sdmp Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: invoice.exe, 00000000.00000002.245201549.0000000002EB3000.00000004.00000001.sdmp Binary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
Source: invoice.exe, 00000000.00000002.245201549.0000000002EB3000.00000004.00000001.sdmp Binary or memory string: VMWARE
Source: explorer.exe, 00000004.00000000.246647210.00000000011B3000.00000004.00000020.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000tft\0
Source: invoice.exe, 00000000.00000002.245201549.0000000002EB3000.00000004.00000001.sdmp Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 00000004.00000000.269121644.00000000089B5000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000%
Source: explorer.exe, 00000004.00000000.260341050.00000000053C4000.00000004.00000001.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}>'R\"
Source: explorer.exe, 00000004.00000000.268510649.0000000008270000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000004.00000000.268510649.0000000008270000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 00000004.00000000.269121644.00000000089B5000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&0000002
Source: invoice.exe, 00000000.00000002.245201549.0000000002EB3000.00000004.00000001.sdmp Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: invoice.exe, 00000000.00000002.245201549.0000000002EB3000.00000004.00000001.sdmp Binary or memory string: VMware SVGA II
Source: invoice.exe, 00000000.00000002.245201549.0000000002EB3000.00000004.00000001.sdmp Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: explorer.exe, 00000004.00000000.268510649.0000000008270000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: C:\Users\user\Desktop\invoice.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\invoice.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\invoice.exe Code function: 3_2_004088C0 rdtsc 3_2_004088C0
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\invoice.exe Code function: 3_2_00409B30 LdrLoadDll, 3_2_00409B30
Contains functionality to read the PEB
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0468746D mov eax, dword ptr fs:[00000030h] 9_2_0468746D
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0469A44B mov eax, dword ptr fs:[00000030h] 9_2_0469A44B
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046FC450 mov eax, dword ptr fs:[00000030h] 9_2_046FC450
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046FC450 mov eax, dword ptr fs:[00000030h] 9_2_046FC450
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0469BC2C mov eax, dword ptr fs:[00000030h] 9_2_0469BC2C
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046E6C0A mov eax, dword ptr fs:[00000030h] 9_2_046E6C0A
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046E6C0A mov eax, dword ptr fs:[00000030h] 9_2_046E6C0A
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046E6C0A mov eax, dword ptr fs:[00000030h] 9_2_046E6C0A
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046E6C0A mov eax, dword ptr fs:[00000030h] 9_2_046E6C0A
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04721C06 mov eax, dword ptr fs:[00000030h] 9_2_04721C06
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04721C06 mov eax, dword ptr fs:[00000030h] 9_2_04721C06
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04721C06 mov eax, dword ptr fs:[00000030h] 9_2_04721C06
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04721C06 mov eax, dword ptr fs:[00000030h] 9_2_04721C06
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04721C06 mov eax, dword ptr fs:[00000030h] 9_2_04721C06
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04721C06 mov eax, dword ptr fs:[00000030h] 9_2_04721C06
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04721C06 mov eax, dword ptr fs:[00000030h] 9_2_04721C06
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04721C06 mov eax, dword ptr fs:[00000030h] 9_2_04721C06
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04721C06 mov eax, dword ptr fs:[00000030h] 9_2_04721C06
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04721C06 mov eax, dword ptr fs:[00000030h] 9_2_04721C06
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04721C06 mov eax, dword ptr fs:[00000030h] 9_2_04721C06
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04721C06 mov eax, dword ptr fs:[00000030h] 9_2_04721C06
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04721C06 mov eax, dword ptr fs:[00000030h] 9_2_04721C06
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04721C06 mov eax, dword ptr fs:[00000030h] 9_2_04721C06
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0473740D mov eax, dword ptr fs:[00000030h] 9_2_0473740D
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0473740D mov eax, dword ptr fs:[00000030h] 9_2_0473740D
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0473740D mov eax, dword ptr fs:[00000030h] 9_2_0473740D
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_047214FB mov eax, dword ptr fs:[00000030h] 9_2_047214FB
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046E6CF0 mov eax, dword ptr fs:[00000030h] 9_2_046E6CF0
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046E6CF0 mov eax, dword ptr fs:[00000030h] 9_2_046E6CF0
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046E6CF0 mov eax, dword ptr fs:[00000030h] 9_2_046E6CF0
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04738CD6 mov eax, dword ptr fs:[00000030h] 9_2_04738CD6
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0467849B mov eax, dword ptr fs:[00000030h] 9_2_0467849B
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0468C577 mov eax, dword ptr fs:[00000030h] 9_2_0468C577
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0468C577 mov eax, dword ptr fs:[00000030h] 9_2_0468C577
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046A3D43 mov eax, dword ptr fs:[00000030h] 9_2_046A3D43
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046E3540 mov eax, dword ptr fs:[00000030h] 9_2_046E3540
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04687D50 mov eax, dword ptr fs:[00000030h] 9_2_04687D50
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04738D34 mov eax, dword ptr fs:[00000030h] 9_2_04738D34
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0472E539 mov eax, dword ptr fs:[00000030h] 9_2_0472E539
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04694D3B mov eax, dword ptr fs:[00000030h] 9_2_04694D3B
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04694D3B mov eax, dword ptr fs:[00000030h] 9_2_04694D3B
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04694D3B mov eax, dword ptr fs:[00000030h] 9_2_04694D3B
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04673D34 mov eax, dword ptr fs:[00000030h] 9_2_04673D34
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04673D34 mov eax, dword ptr fs:[00000030h] 9_2_04673D34
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04673D34 mov eax, dword ptr fs:[00000030h] 9_2_04673D34
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04673D34 mov eax, dword ptr fs:[00000030h] 9_2_04673D34
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04673D34 mov eax, dword ptr fs:[00000030h] 9_2_04673D34
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04673D34 mov eax, dword ptr fs:[00000030h] 9_2_04673D34
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04673D34 mov eax, dword ptr fs:[00000030h] 9_2_04673D34
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04673D34 mov eax, dword ptr fs:[00000030h] 9_2_04673D34
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04673D34 mov eax, dword ptr fs:[00000030h] 9_2_04673D34
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04673D34 mov eax, dword ptr fs:[00000030h] 9_2_04673D34
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04673D34 mov eax, dword ptr fs:[00000030h] 9_2_04673D34
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04673D34 mov eax, dword ptr fs:[00000030h] 9_2_04673D34
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04673D34 mov eax, dword ptr fs:[00000030h] 9_2_04673D34
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0466AD30 mov eax, dword ptr fs:[00000030h] 9_2_0466AD30
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046EA537 mov eax, dword ptr fs:[00000030h] 9_2_046EA537
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04718DF1 mov eax, dword ptr fs:[00000030h] 9_2_04718DF1
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0467D5E0 mov eax, dword ptr fs:[00000030h] 9_2_0467D5E0
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0467D5E0 mov eax, dword ptr fs:[00000030h] 9_2_0467D5E0
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0472FDE2 mov eax, dword ptr fs:[00000030h] 9_2_0472FDE2
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0472FDE2 mov eax, dword ptr fs:[00000030h] 9_2_0472FDE2
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0472FDE2 mov eax, dword ptr fs:[00000030h] 9_2_0472FDE2
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0472FDE2 mov eax, dword ptr fs:[00000030h] 9_2_0472FDE2
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046E6DC9 mov eax, dword ptr fs:[00000030h] 9_2_046E6DC9
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046E6DC9 mov eax, dword ptr fs:[00000030h] 9_2_046E6DC9
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046E6DC9 mov eax, dword ptr fs:[00000030h] 9_2_046E6DC9
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046E6DC9 mov ecx, dword ptr fs:[00000030h] 9_2_046E6DC9
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046E6DC9 mov eax, dword ptr fs:[00000030h] 9_2_046E6DC9
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046E6DC9 mov eax, dword ptr fs:[00000030h] 9_2_046E6DC9
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046935A1 mov eax, dword ptr fs:[00000030h] 9_2_046935A1
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04691DB5 mov eax, dword ptr fs:[00000030h] 9_2_04691DB5
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04691DB5 mov eax, dword ptr fs:[00000030h] 9_2_04691DB5
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04691DB5 mov eax, dword ptr fs:[00000030h] 9_2_04691DB5
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_047305AC mov eax, dword ptr fs:[00000030h] 9_2_047305AC
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_047305AC mov eax, dword ptr fs:[00000030h] 9_2_047305AC
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04692581 mov eax, dword ptr fs:[00000030h] 9_2_04692581
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04692581 mov eax, dword ptr fs:[00000030h] 9_2_04692581
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04692581 mov eax, dword ptr fs:[00000030h] 9_2_04692581
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04692581 mov eax, dword ptr fs:[00000030h] 9_2_04692581
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04662D8A mov eax, dword ptr fs:[00000030h] 9_2_04662D8A
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04662D8A mov eax, dword ptr fs:[00000030h] 9_2_04662D8A
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04662D8A mov eax, dword ptr fs:[00000030h] 9_2_04662D8A
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04662D8A mov eax, dword ptr fs:[00000030h] 9_2_04662D8A
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04662D8A mov eax, dword ptr fs:[00000030h] 9_2_04662D8A
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0469FD9B mov eax, dword ptr fs:[00000030h] 9_2_0469FD9B
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0469FD9B mov eax, dword ptr fs:[00000030h] 9_2_0469FD9B
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0467766D mov eax, dword ptr fs:[00000030h] 9_2_0467766D
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0468AE73 mov eax, dword ptr fs:[00000030h] 9_2_0468AE73
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0468AE73 mov eax, dword ptr fs:[00000030h] 9_2_0468AE73
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0468AE73 mov eax, dword ptr fs:[00000030h] 9_2_0468AE73
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0468AE73 mov eax, dword ptr fs:[00000030h] 9_2_0468AE73
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0468AE73 mov eax, dword ptr fs:[00000030h] 9_2_0468AE73
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04677E41 mov eax, dword ptr fs:[00000030h] 9_2_04677E41
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04677E41 mov eax, dword ptr fs:[00000030h] 9_2_04677E41
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04677E41 mov eax, dword ptr fs:[00000030h] 9_2_04677E41
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04677E41 mov eax, dword ptr fs:[00000030h] 9_2_04677E41
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04677E41 mov eax, dword ptr fs:[00000030h] 9_2_04677E41
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04677E41 mov eax, dword ptr fs:[00000030h] 9_2_04677E41
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0472AE44 mov eax, dword ptr fs:[00000030h] 9_2_0472AE44
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0472AE44 mov eax, dword ptr fs:[00000030h] 9_2_0472AE44
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0466E620 mov eax, dword ptr fs:[00000030h] 9_2_0466E620
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0471FE3F mov eax, dword ptr fs:[00000030h] 9_2_0471FE3F
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0466C600 mov eax, dword ptr fs:[00000030h] 9_2_0466C600
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0466C600 mov eax, dword ptr fs:[00000030h] 9_2_0466C600
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0466C600 mov eax, dword ptr fs:[00000030h] 9_2_0466C600
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04698E00 mov eax, dword ptr fs:[00000030h] 9_2_04698E00
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0469A61C mov eax, dword ptr fs:[00000030h] 9_2_0469A61C
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0469A61C mov eax, dword ptr fs:[00000030h] 9_2_0469A61C
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04721608 mov eax, dword ptr fs:[00000030h] 9_2_04721608
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046776E2 mov eax, dword ptr fs:[00000030h] 9_2_046776E2
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046916E0 mov ecx, dword ptr fs:[00000030h] 9_2_046916E0
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04738ED6 mov eax, dword ptr fs:[00000030h] 9_2_04738ED6
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046936CC mov eax, dword ptr fs:[00000030h] 9_2_046936CC
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046A8EC7 mov eax, dword ptr fs:[00000030h] 9_2_046A8EC7
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0471FEC0 mov eax, dword ptr fs:[00000030h] 9_2_0471FEC0
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046E46A7 mov eax, dword ptr fs:[00000030h] 9_2_046E46A7
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04730EA5 mov eax, dword ptr fs:[00000030h] 9_2_04730EA5
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04730EA5 mov eax, dword ptr fs:[00000030h] 9_2_04730EA5
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04730EA5 mov eax, dword ptr fs:[00000030h] 9_2_04730EA5
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046FFE87 mov eax, dword ptr fs:[00000030h] 9_2_046FFE87
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0467FF60 mov eax, dword ptr fs:[00000030h] 9_2_0467FF60
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04738F6A mov eax, dword ptr fs:[00000030h] 9_2_04738F6A
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0467EF40 mov eax, dword ptr fs:[00000030h] 9_2_0467EF40
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04664F2E mov eax, dword ptr fs:[00000030h] 9_2_04664F2E
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04664F2E mov eax, dword ptr fs:[00000030h] 9_2_04664F2E
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0469E730 mov eax, dword ptr fs:[00000030h] 9_2_0469E730
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0469A70E mov eax, dword ptr fs:[00000030h] 9_2_0469A70E
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0469A70E mov eax, dword ptr fs:[00000030h] 9_2_0469A70E
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0473070D mov eax, dword ptr fs:[00000030h] 9_2_0473070D
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0473070D mov eax, dword ptr fs:[00000030h] 9_2_0473070D
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0468F716 mov eax, dword ptr fs:[00000030h] 9_2_0468F716
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046FFF10 mov eax, dword ptr fs:[00000030h] 9_2_046FFF10
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046FFF10 mov eax, dword ptr fs:[00000030h] 9_2_046FFF10
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046A37F5 mov eax, dword ptr fs:[00000030h] 9_2_046A37F5
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04678794 mov eax, dword ptr fs:[00000030h] 9_2_04678794
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046E7794 mov eax, dword ptr fs:[00000030h] 9_2_046E7794
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046E7794 mov eax, dword ptr fs:[00000030h] 9_2_046E7794
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046E7794 mov eax, dword ptr fs:[00000030h] 9_2_046E7794
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04722073 mov eax, dword ptr fs:[00000030h] 9_2_04722073
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04731074 mov eax, dword ptr fs:[00000030h] 9_2_04731074
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04680050 mov eax, dword ptr fs:[00000030h] 9_2_04680050
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04680050 mov eax, dword ptr fs:[00000030h] 9_2_04680050
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0469002D mov eax, dword ptr fs:[00000030h] 9_2_0469002D
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0469002D mov eax, dword ptr fs:[00000030h] 9_2_0469002D
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0469002D mov eax, dword ptr fs:[00000030h] 9_2_0469002D
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0469002D mov eax, dword ptr fs:[00000030h] 9_2_0469002D
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0469002D mov eax, dword ptr fs:[00000030h] 9_2_0469002D
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0467B02A mov eax, dword ptr fs:[00000030h] 9_2_0467B02A
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0467B02A mov eax, dword ptr fs:[00000030h] 9_2_0467B02A
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0467B02A mov eax, dword ptr fs:[00000030h] 9_2_0467B02A
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0467B02A mov eax, dword ptr fs:[00000030h] 9_2_0467B02A
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04734015 mov eax, dword ptr fs:[00000030h] 9_2_04734015
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04734015 mov eax, dword ptr fs:[00000030h] 9_2_04734015
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046E7016 mov eax, dword ptr fs:[00000030h] 9_2_046E7016
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046E7016 mov eax, dword ptr fs:[00000030h] 9_2_046E7016
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046E7016 mov eax, dword ptr fs:[00000030h] 9_2_046E7016
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046658EC mov eax, dword ptr fs:[00000030h] 9_2_046658EC
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046FB8D0 mov eax, dword ptr fs:[00000030h] 9_2_046FB8D0
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046FB8D0 mov ecx, dword ptr fs:[00000030h] 9_2_046FB8D0
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046FB8D0 mov eax, dword ptr fs:[00000030h] 9_2_046FB8D0
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046FB8D0 mov eax, dword ptr fs:[00000030h] 9_2_046FB8D0
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046FB8D0 mov eax, dword ptr fs:[00000030h] 9_2_046FB8D0
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046FB8D0 mov eax, dword ptr fs:[00000030h] 9_2_046FB8D0
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046A90AF mov eax, dword ptr fs:[00000030h] 9_2_046A90AF
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046920A0 mov eax, dword ptr fs:[00000030h] 9_2_046920A0
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046920A0 mov eax, dword ptr fs:[00000030h] 9_2_046920A0
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046920A0 mov eax, dword ptr fs:[00000030h] 9_2_046920A0
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046920A0 mov eax, dword ptr fs:[00000030h] 9_2_046920A0
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046920A0 mov eax, dword ptr fs:[00000030h] 9_2_046920A0
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046920A0 mov eax, dword ptr fs:[00000030h] 9_2_046920A0
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0469F0BF mov ecx, dword ptr fs:[00000030h] 9_2_0469F0BF
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0469F0BF mov eax, dword ptr fs:[00000030h] 9_2_0469F0BF
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0469F0BF mov eax, dword ptr fs:[00000030h] 9_2_0469F0BF
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04669080 mov eax, dword ptr fs:[00000030h] 9_2_04669080
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046E3884 mov eax, dword ptr fs:[00000030h] 9_2_046E3884
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046E3884 mov eax, dword ptr fs:[00000030h] 9_2_046E3884
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0466C962 mov eax, dword ptr fs:[00000030h] 9_2_0466C962
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0466B171 mov eax, dword ptr fs:[00000030h] 9_2_0466B171
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0466B171 mov eax, dword ptr fs:[00000030h] 9_2_0466B171
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0468B944 mov eax, dword ptr fs:[00000030h] 9_2_0468B944
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0468B944 mov eax, dword ptr fs:[00000030h] 9_2_0468B944
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04684120 mov eax, dword ptr fs:[00000030h] 9_2_04684120
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04684120 mov eax, dword ptr fs:[00000030h] 9_2_04684120
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04684120 mov eax, dword ptr fs:[00000030h] 9_2_04684120
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04684120 mov eax, dword ptr fs:[00000030h] 9_2_04684120
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04684120 mov ecx, dword ptr fs:[00000030h] 9_2_04684120
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0469513A mov eax, dword ptr fs:[00000030h] 9_2_0469513A
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0469513A mov eax, dword ptr fs:[00000030h] 9_2_0469513A
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04669100 mov eax, dword ptr fs:[00000030h] 9_2_04669100
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04669100 mov eax, dword ptr fs:[00000030h] 9_2_04669100
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04669100 mov eax, dword ptr fs:[00000030h] 9_2_04669100
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046F41E8 mov eax, dword ptr fs:[00000030h] 9_2_046F41E8
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0466B1E1 mov eax, dword ptr fs:[00000030h] 9_2_0466B1E1
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0466B1E1 mov eax, dword ptr fs:[00000030h] 9_2_0466B1E1
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0466B1E1 mov eax, dword ptr fs:[00000030h] 9_2_0466B1E1
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046E69A6 mov eax, dword ptr fs:[00000030h] 9_2_046E69A6
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046961A0 mov eax, dword ptr fs:[00000030h] 9_2_046961A0
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046961A0 mov eax, dword ptr fs:[00000030h] 9_2_046961A0
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046E51BE mov eax, dword ptr fs:[00000030h] 9_2_046E51BE
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046E51BE mov eax, dword ptr fs:[00000030h] 9_2_046E51BE
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046E51BE mov eax, dword ptr fs:[00000030h] 9_2_046E51BE
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046E51BE mov eax, dword ptr fs:[00000030h] 9_2_046E51BE
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0468C182 mov eax, dword ptr fs:[00000030h] 9_2_0468C182
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0469A185 mov eax, dword ptr fs:[00000030h] 9_2_0469A185
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04692990 mov eax, dword ptr fs:[00000030h] 9_2_04692990
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046A927A mov eax, dword ptr fs:[00000030h] 9_2_046A927A
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0471B260 mov eax, dword ptr fs:[00000030h] 9_2_0471B260
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0471B260 mov eax, dword ptr fs:[00000030h] 9_2_0471B260
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04738A62 mov eax, dword ptr fs:[00000030h] 9_2_04738A62
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04669240 mov eax, dword ptr fs:[00000030h] 9_2_04669240
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04669240 mov eax, dword ptr fs:[00000030h] 9_2_04669240
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04669240 mov eax, dword ptr fs:[00000030h] 9_2_04669240
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04669240 mov eax, dword ptr fs:[00000030h] 9_2_04669240
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0472EA55 mov eax, dword ptr fs:[00000030h] 9_2_0472EA55
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046F4257 mov eax, dword ptr fs:[00000030h] 9_2_046F4257
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046A4A2C mov eax, dword ptr fs:[00000030h] 9_2_046A4A2C
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046A4A2C mov eax, dword ptr fs:[00000030h] 9_2_046A4A2C
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04678A0A mov eax, dword ptr fs:[00000030h] 9_2_04678A0A
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0466AA16 mov eax, dword ptr fs:[00000030h] 9_2_0466AA16
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0466AA16 mov eax, dword ptr fs:[00000030h] 9_2_0466AA16
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04683A1C mov eax, dword ptr fs:[00000030h] 9_2_04683A1C
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04665210 mov eax, dword ptr fs:[00000030h] 9_2_04665210
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04665210 mov ecx, dword ptr fs:[00000030h] 9_2_04665210
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04665210 mov eax, dword ptr fs:[00000030h] 9_2_04665210
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04665210 mov eax, dword ptr fs:[00000030h] 9_2_04665210
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04692AE4 mov eax, dword ptr fs:[00000030h] 9_2_04692AE4
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04692ACB mov eax, dword ptr fs:[00000030h] 9_2_04692ACB
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046652A5 mov eax, dword ptr fs:[00000030h] 9_2_046652A5
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046652A5 mov eax, dword ptr fs:[00000030h] 9_2_046652A5
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046652A5 mov eax, dword ptr fs:[00000030h] 9_2_046652A5
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046652A5 mov eax, dword ptr fs:[00000030h] 9_2_046652A5
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046652A5 mov eax, dword ptr fs:[00000030h] 9_2_046652A5
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0467AAB0 mov eax, dword ptr fs:[00000030h] 9_2_0467AAB0
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0467AAB0 mov eax, dword ptr fs:[00000030h] 9_2_0467AAB0
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0469FAB0 mov eax, dword ptr fs:[00000030h] 9_2_0469FAB0
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0469D294 mov eax, dword ptr fs:[00000030h] 9_2_0469D294
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0469D294 mov eax, dword ptr fs:[00000030h] 9_2_0469D294
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0466DB60 mov ecx, dword ptr fs:[00000030h] 9_2_0466DB60
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04693B7A mov eax, dword ptr fs:[00000030h] 9_2_04693B7A
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04693B7A mov eax, dword ptr fs:[00000030h] 9_2_04693B7A
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0466DB40 mov eax, dword ptr fs:[00000030h] 9_2_0466DB40
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04738B58 mov eax, dword ptr fs:[00000030h] 9_2_04738B58
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0466F358 mov eax, dword ptr fs:[00000030h] 9_2_0466F358
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0472131B mov eax, dword ptr fs:[00000030h] 9_2_0472131B
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0468DBE9 mov eax, dword ptr fs:[00000030h] 9_2_0468DBE9
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046903E2 mov eax, dword ptr fs:[00000030h] 9_2_046903E2
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046903E2 mov eax, dword ptr fs:[00000030h] 9_2_046903E2
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046903E2 mov eax, dword ptr fs:[00000030h] 9_2_046903E2
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046903E2 mov eax, dword ptr fs:[00000030h] 9_2_046903E2
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046903E2 mov eax, dword ptr fs:[00000030h] 9_2_046903E2
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046903E2 mov eax, dword ptr fs:[00000030h] 9_2_046903E2
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046E53CA mov eax, dword ptr fs:[00000030h] 9_2_046E53CA
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_046E53CA mov eax, dword ptr fs:[00000030h] 9_2_046E53CA
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04694BAD mov eax, dword ptr fs:[00000030h] 9_2_04694BAD
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04694BAD mov eax, dword ptr fs:[00000030h] 9_2_04694BAD
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04694BAD mov eax, dword ptr fs:[00000030h] 9_2_04694BAD
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04735BA5 mov eax, dword ptr fs:[00000030h] 9_2_04735BA5
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04671B8F mov eax, dword ptr fs:[00000030h] 9_2_04671B8F
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04671B8F mov eax, dword ptr fs:[00000030h] 9_2_04671B8F
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0471D380 mov ecx, dword ptr fs:[00000030h] 9_2_0471D380
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0472138A mov eax, dword ptr fs:[00000030h] 9_2_0472138A
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_0469B390 mov eax, dword ptr fs:[00000030h] 9_2_0469B390
Source: C:\Windows\SysWOW64\wscript.exe Code function: 9_2_04692397 mov eax, dword ptr fs:[00000030h] 9_2_04692397
Enables debug privileges
Source: C:\Users\user\Desktop\invoice.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.highdeserthealthinsurance.com
Source: C:\Windows\explorer.exe Network Connect: 74.208.236.64 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.dateyourlovelive.club
Source: C:\Windows\explorer.exe Network Connect: 184.168.131.241 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.legacyadmin.support
Source: C:\Windows\explorer.exe Domain query: www.gunungbatufrozen.com
Source: C:\Windows\explorer.exe Domain query: www.hotelmaktub.com
Source: C:\Windows\explorer.exe Domain query: www.flowhcf.com
Source: C:\Windows\explorer.exe Network Connect: 192.0.78.24 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.sookepointcargo.com
Source: C:\Windows\explorer.exe Domain query: www.jinlan.online
Source: C:\Windows\explorer.exe Domain query: www.armaccountingbs.com
Source: C:\Windows\explorer.exe Network Connect: 35.156.117.131 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 208.91.197.91 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 2.57.90.16 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.zmid.xyz
Source: C:\Windows\explorer.exe Network Connect: 177.55.108.130 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.knoxvilleoutdoorkitchens.com
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\invoice.exe Memory written: C:\Users\user\Desktop\invoice.exe base: 400000 value starts with: 4D5A Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\invoice.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Section loaded: unknown target: C:\Windows\SysWOW64\wscript.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Section loaded: unknown target: C:\Windows\SysWOW64\wscript.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\Desktop\invoice.exe Thread register set: target process: 3472 Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Thread register set: target process: 3472 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\Desktop\invoice.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Sample uses process hollowing technique
Source: C:\Users\user\Desktop\invoice.exe Section unmapped: C:\Windows\SysWOW64\wscript.exe base address: E0000 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\invoice.exe Process created: C:\Users\user\Desktop\invoice.exe C:\Users\user\Desktop\invoice.exe Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\invoice.exe' Jump to behavior
Source: explorer.exe, 00000004.00000000.261500352.0000000005EA0000.00000004.00000001.sdmp, wscript.exe, 00000009.00000002.490705196.0000000002EE0000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000004.00000002.491483323.0000000001640000.00000002.00000001.sdmp, wscript.exe, 00000009.00000002.490705196.0000000002EE0000.00000002.00000001.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000004.00000002.491483323.0000000001640000.00000002.00000001.sdmp, wscript.exe, 00000009.00000002.490705196.0000000002EE0000.00000002.00000001.sdmp Binary or memory string: SProgram Managerl
Source: explorer.exe, 00000004.00000000.246523611.0000000001128000.00000004.00000020.sdmp Binary or memory string: ProgmanOMEa
Source: explorer.exe, 00000004.00000002.491483323.0000000001640000.00000002.00000001.sdmp, wscript.exe, 00000009.00000002.490705196.0000000002EE0000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd,
Source: explorer.exe, 00000004.00000002.491483323.0000000001640000.00000002.00000001.sdmp, wscript.exe, 00000009.00000002.490705196.0000000002EE0000.00000002.00000001.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Users\user\Desktop\invoice.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 00000009.00000002.490575290.0000000002AE0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.287914993.0000000001AE0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.286861103.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.287952464.0000000001B10000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.490405309.00000000026A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.488897398.00000000021B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.246170025.0000000003EAC000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 3.2.invoice.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.invoice.exe.400000.0.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 00000009.00000002.490575290.0000000002AE0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.287914993.0000000001AE0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.286861103.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.287952464.0000000001B10000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.490405309.00000000026A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.488897398.00000000021B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.246170025.0000000003EAC000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 3.2.invoice.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.invoice.exe.400000.0.raw.unpack, type: UNPACKEDPE
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 383898 Sample: invoice.exe Startdate: 08/04/2021 Architecture: WINDOWS Score: 100 31 www.harshdeepfashion.com 2->31 33 www.arizonagridiron.com 2->33 41 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->41 43 Found malware configuration 2->43 45 Malicious sample detected (through community Yara rule) 2->45 47 6 other signatures 2->47 11 invoice.exe 3 2->11         started        signatures3 process4 file5 29 C:\Users\user\AppData\...\invoice.exe.log, ASCII 11->29 dropped 59 Tries to detect virtualization through RDTSC time measurements 11->59 61 Injects a PE file into a foreign processes 11->61 15 invoice.exe 11->15         started        signatures6 process7 signatures8 63 Modifies the context of a thread in another process (thread injection) 15->63 65 Maps a DLL or memory area into another process 15->65 67 Sample uses process hollowing technique 15->67 69 Queues an APC in another process (thread injection) 15->69 18 explorer.exe 15->18 injected process9 dnsIp10 35 hotelmaktub.com 177.55.108.130, 49732, 80 RedeHostInternetLtdaBR Brazil 18->35 37 www.highdeserthealthinsurance.com 74.208.236.64, 49731, 80 ONEANDONE-ASBrauerstrasse48DE United States 18->37 39 15 other IPs or domains 18->39 49 System process connects to network (likely due to code injection or exploit) 18->49 51 Performs DNS queries to domains with low reputation 18->51 22 wscript.exe 18->22         started        signatures11 process12 signatures13 53 Modifies the context of a thread in another process (thread injection) 22->53 55 Maps a DLL or memory area into another process 22->55 57 Tries to detect virtualization through RDTSC time measurements 22->57 25 cmd.exe 1 22->25         started        process14 process15 27 conhost.exe 25->27         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
192.0.78.24
 legacyadmin.support United States
2635 AUTOMATTICUS true
35.156.117.131
 www.jinlan.online.s.strikinglydns.com United States
16509 AMAZON-02US true
208.91.197.91
 www.knoxvilleoutdoorkitchens.com Virgin Islands (BRITISH)
40034 CONFLUENCE-NETWORK-INCVG true
74.208.236.64
 www.highdeserthealthinsurance.com United States
8560 ONEANDONE-ASBrauerstrasse48DE true
184.168.131.241
 flowhcf.com United States
26496 AS-26496-GO-DADDY-COM-LLCUS true
2.57.90.16
 armaccountingbs.com Lithuania
47583 AS-HOSTINGERLT true
177.55.108.130
 hotelmaktub.com Brazil
53057 RedeHostInternetLtdaBR true

Private
IP
192.168.2.1

Contacted Domains

Name IP Active
www.highdeserthealthinsurance.com 74.208.236.64 true
armaccountingbs.com 2.57.90.16 true
legacyadmin.support 192.0.78.24 true
www.harshdeepfashion.com 216.239.34.21 true
www.jinlan.online.s.strikinglydns.com 35.156.117.131 true
hotelmaktub.com 177.55.108.130 true
www.arizonagridiron.com 23.27.42.72 true
flowhcf.com 184.168.131.241 true
www.knoxvilleoutdoorkitchens.com 208.91.197.91 true
www.dateyourlovelive.club unknown unknown
www.legacyadmin.support unknown unknown
www.gunungbatufrozen.com unknown unknown
www.hotelmaktub.com unknown unknown
www.flowhcf.com unknown unknown
www.sookepointcargo.com unknown unknown
www.jinlan.online unknown unknown
www.armaccountingbs.com unknown unknown
www.zmid.xyz unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
www.sookepointcargo.com/e3rs/ true
  • Avira URL Cloud: safe
 low