Windows Analysis Report Quote#56432.exe

Overview

General Information

Sample Name: Quote#56432.exe
Analysis ID: 483794
MD5: 3812ebc395330bef949cc2c7264d1632
SHA1: 4dc9fd68e73e0b14ab02670bb7c80372d0043bc4
SHA256: 97ea895e92f76192010e02f12aca8ec4ffa1b667e84c9958332d280ced624402
Tags: exeFormbook
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Yara detected AntiVM3
System process connects to network (likely due to code injection or exploit)
Multi AV Scanner detection for dropped file
Sample uses process hollowing technique
Maps a DLL or memory area into another process
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Writes to foreign memory regions
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Machine Learning detection for sample
Allocates memory in foreign processes
Modifies the prolog of user mode functions (user mode inline hooks)
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
Queues an APC in another process (thread injection)
.NET source code contains very large strings
Tries to detect virtualization through RDTSC time measurements
Machine Learning detection for dropped file
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Uses schtasks.exe or at.exe to add and modify task schedules
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to call native functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Contains functionality for execution timing, often used to detect debuggers
Contains long sleeps (>= 3 min)
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Sample file is different than original file name gathered from version info
Drops PE files
Contains functionality to read the PEB
Checks if the current process is being debugged
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection:

barindex
Found malware configuration
Source: 0000000F.00000002.925308127.0000000000360000.00000040.00020000.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.constructioncleanup.pro/vd9n/"], "decoy": ["theunwrappedcollective.com", "seckj-ic.com", "tyresandover.com", "thetrophyworld.com", "fonggrconstruction.com", "hopiproject.com", "sktitle.com", "charlotteobscurer.com", "qjuhe.com", "girlzglitter.com", "createmylawn.com", "hempcbgpill.com", "zzdfdzkj.com", "shreehariessential.com", "226sm.com", "getcupscall.com", "neuralviolin.com", "sanskaar.life", "xn--fhqrm54yyukopc.com", "togetherx4fantasy5star.today", "buyonlinesaree.com", "percyshandman.site", "hatchethangout.com", "rugpat.com", "zen-gizmo.com", "vipmomali.com", "lacerasavall.cat", "aqueouso.com", "mkolgems.com", "sevenhundredseventysix.fund", "fotografhannaneret.com", "mitravy.com", "bmtrans.net", "linterpreting.com", "izquay.com", "sawaturkey.com", "marche-maman.com", "eemygf.com", "animenovel.com", "travelssimply.com", "montecitobutterfly.com", "volebahis.com", "daniela.red", "ramseyedk12.com", "leyterealestate.info", "patriotstrong.net", "vkgcrew.com", "nadhiradeebaazkiya.online", "hotelcarre.com", "myfabulouscollection.com", "stellantis-luxury-rent.com", "hn2020.xyz", "emilyscopes.com", "lotosouq.com", "lovecord.date", "stconstant.online", "volkite-culverin.net", "allwaysautism.com", "sheisnatashasimone.com", "sepantaceram.com", "ishopgrady.com", "lifestorycard.com", "sexybbwavailable.website", "domainbaycapital.com"]}
Multi AV Scanner detection for submitted file
Source: Quote#56432.exe Virustotal: Detection: 29% Perma Link
Source: Quote#56432.exe Metadefender: Detection: 28% Perma Link
Source: Quote#56432.exe ReversingLabs: Detection: 78%
Yara detected FormBook
Source: Yara match File source: 7.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000F.00000002.925308127.0000000000360000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.781503558.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.690946204.0000000003C70000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000000.738249263.000000000E47D000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.925553519.0000000000B00000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.925610906.0000000000B30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.782221543.0000000001490000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.690791851.0000000003B59000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.782183245.0000000001460000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000000.720837328.000000000E47D000.00000040.00020000.sdmp, type: MEMORY
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\ySWmXEgh.exe Metadefender: Detection: 28% Perma Link
Source: C:\Users\user\AppData\Roaming\ySWmXEgh.exe ReversingLabs: Detection: 78%
Machine Learning detection for sample
Source: Quote#56432.exe Joe Sandbox ML: detected
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\ySWmXEgh.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 7.2.RegSvcs.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

barindex
Uses 32bit PE files
Source: Quote#56432.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: Quote#56432.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: systray.pdb source: RegSvcs.exe, 00000007.00000002.782499789.0000000001910000.00000040.00020000.sdmp
Source: Binary string: systray.pdbGCTL source: RegSvcs.exe, 00000007.00000002.782499789.0000000001910000.00000040.00020000.sdmp
Source: Binary string: RegSvcs.pdb, source: systray.exe, 0000000F.00000002.927302675.0000000004A8F000.00000004.00020000.sdmp
Source: Binary string: wntdll.pdbUGP source: RegSvcs.exe, 00000007.00000002.784083913.0000000001A3F000.00000040.00000001.sdmp, systray.exe, 0000000F.00000002.926821802.000000000467F000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: RegSvcs.exe, systray.exe
Source: Binary string: RegSvcs.pdb source: systray.exe, 0000000F.00000002.927302675.0000000004A8F000.00000004.00020000.sdmp

Software Vulnerabilities:

barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4x nop then pop edi 7_2_0040E44C
Source: C:\Windows\SysWOW64\systray.exe Code function: 4x nop then pop edi 15_2_0036E44C

Networking:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 44.227.76.166 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.lovecord.date
Source: C:\Windows\explorer.exe Domain query: www.neuralviolin.com
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.constructioncleanup.pro/vd9n/
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: AMAZON-02US AMAZON-02US
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /vd9n/?NfB=6+C1z2NTXQU5TtDgYCNVveFhDHAhXY7UdOammGZxKywecd1Rk4eK0uo6Q7X2XlF/f8Go&o87p=d640H6WhXv9 HTTP/1.1Host: www.lovecord.dateConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 44.227.76.166 44.227.76.166
Source: Quote#56432.exe, 00000000.00000002.693028363.0000000006BB2000.00000004.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: systray.exe, 0000000F.00000002.927431554.0000000004F7F000.00000004.00020000.sdmp String found in binary or memory: http://lovecord.date
Source: Quote#56432.exe, 00000000.00000002.690221413.0000000002B51000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Quote#56432.exe, 00000000.00000002.693028363.0000000006BB2000.00000004.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Quote#56432.exe, 00000000.00000003.665504791.00000000058CE000.00000004.00000001.sdmp, Quote#56432.exe, 00000000.00000003.665428445.00000000058CE000.00000004.00000001.sdmp String found in binary or memory: http://www.ascendercorp.com/typedesigners.html
Source: Quote#56432.exe, 00000000.00000003.664495208.00000000058CF000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.com
Source: Quote#56432.exe, 00000000.00000003.664495208.00000000058CF000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.com.123
Source: Quote#56432.exe, 00000000.00000003.664495208.00000000058CF000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.comC
Source: Quote#56432.exe, 00000000.00000002.693028363.0000000006BB2000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: Quote#56432.exe, 00000000.00000003.664613718.00000000058D0000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.comn-u
Source: Quote#56432.exe, 00000000.00000002.693028363.0000000006BB2000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com
Source: Quote#56432.exe, 00000000.00000002.693028363.0000000006BB2000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: Quote#56432.exe, 00000000.00000003.666494619.00000000058CE000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/3
Source: Quote#56432.exe, 00000000.00000002.693028363.0000000006BB2000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Quote#56432.exe, 00000000.00000003.667501678.00000000058D0000.00000004.00000001.sdmp, Quote#56432.exe, 00000000.00000003.667456774.00000000058D0000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.html
Source: Quote#56432.exe, 00000000.00000002.693028363.0000000006BB2000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Quote#56432.exe, 00000000.00000003.666549661.00000000058CE000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cz;a
Source: Quote#56432.exe, 00000000.00000003.667061903.00000000058CF000.00000004.00000001.sdmp, Quote#56432.exe, 00000000.00000002.693028363.0000000006BB2000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: Quote#56432.exe, 00000000.00000003.667061903.00000000058CF000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html3
Source: Quote#56432.exe, 00000000.00000002.693028363.0000000006BB2000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: Quote#56432.exe, 00000000.00000002.693028363.0000000006BB2000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: Quote#56432.exe, 00000000.00000002.693028363.0000000006BB2000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: Quote#56432.exe, 00000000.00000003.666850356.00000000058CF000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersR
Source: Quote#56432.exe, 00000000.00000003.666549661.00000000058CE000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersg
Source: Quote#56432.exe, 00000000.00000003.666754869.00000000058CF000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersi
Source: Quote#56432.exe, 00000000.00000003.673228256.00000000058D0000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersx
Source: Quote#56432.exe, 00000000.00000002.692495401.00000000058A0000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comF
Source: Quote#56432.exe, 00000000.00000002.692495401.00000000058A0000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.coma
Source: Quote#56432.exe, 00000000.00000002.692495401.00000000058A0000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comiono
Source: Quote#56432.exe, 00000000.00000002.693028363.0000000006BB2000.00000004.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: Quote#56432.exe, 00000000.00000002.693028363.0000000006BB2000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: Quote#56432.exe, 00000000.00000003.663958515.00000000058CE000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/
Source: Quote#56432.exe, 00000000.00000002.693028363.0000000006BB2000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Quote#56432.exe, 00000000.00000002.693028363.0000000006BB2000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Quote#56432.exe, 00000000.00000003.663958515.00000000058CE000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cnk
Source: Quote#56432.exe, 00000000.00000002.693028363.0000000006BB2000.00000004.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Quote#56432.exe, 00000000.00000003.669659423.00000000058D0000.00000004.00000001.sdmp, Quote#56432.exe, 00000000.00000002.693028363.0000000006BB2000.00000004.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Quote#56432.exe, 00000000.00000002.693028363.0000000006BB2000.00000004.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: Quote#56432.exe, 00000000.00000003.665374375.00000000058AB000.00000004.00000001.sdmp, Quote#56432.exe, 00000000.00000003.664849579.00000000058A4000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Quote#56432.exe, 00000000.00000003.664849579.00000000058A4000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/-t4
Source: Quote#56432.exe, 00000000.00000003.665374375.00000000058AB000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp//z
Source: Quote#56432.exe, 00000000.00000003.665374375.00000000058AB000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/4
Source: Quote#56432.exe, 00000000.00000003.665374375.00000000058AB000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/Norm
Source: Quote#56432.exe, 00000000.00000003.665005799.00000000058A5000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0-d
Source: Quote#56432.exe, 00000000.00000003.665374375.00000000058AB000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/adnl
Source: Quote#56432.exe, 00000000.00000003.665374375.00000000058AB000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/j
Source: Quote#56432.exe, 00000000.00000003.665374375.00000000058AB000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: Quote#56432.exe, 00000000.00000003.665374375.00000000058AB000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/n-us
Source: Quote#56432.exe, 00000000.00000003.672566366.00000000058D0000.00000004.00000001.sdmp String found in binary or memory: http://www.monotype.
Source: Quote#56432.exe, 00000000.00000002.693028363.0000000006BB2000.00000004.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: Quote#56432.exe, 00000000.00000003.665504791.00000000058CE000.00000004.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: Quote#56432.exe, 00000000.00000002.693028363.0000000006BB2000.00000004.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: Quote#56432.exe, 00000000.00000002.693028363.0000000006BB2000.00000004.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: Quote#56432.exe, 00000000.00000003.664716460.00000000058D0000.00000004.00000001.sdmp String found in binary or memory: http://www.tiro.comic
Source: Quote#56432.exe, 00000000.00000002.693028363.0000000006BB2000.00000004.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: Quote#56432.exe, 00000000.00000003.668210925.00000000058D0000.00000004.00000001.sdmp, Quote#56432.exe, 00000000.00000003.668015602.00000000058D0000.00000004.00000001.sdmp String found in binary or memory: http://www.urwpp.de
Source: Quote#56432.exe, 00000000.00000003.667982119.00000000058D0000.00000004.00000001.sdmp String found in binary or memory: http://www.urwpp.de%Y
Source: Quote#56432.exe, 00000000.00000002.693028363.0000000006BB2000.00000004.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: Quote#56432.exe, 00000000.00000003.668046451.00000000058D0000.00000004.00000001.sdmp String found in binary or memory: http://www.urwpp.deFT
Source: Quote#56432.exe, 00000000.00000003.666447003.00000000058CE000.00000004.00000001.sdmp String found in binary or memory: http://www.urwpp.deoc
Source: Quote#56432.exe, 00000000.00000002.693028363.0000000006BB2000.00000004.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: unknown DNS traffic detected: queries for: www.lovecord.date
Source: global traffic HTTP traffic detected: GET /vd9n/?NfB=6+C1z2NTXQU5TtDgYCNVveFhDHAhXY7UdOammGZxKywecd1Rk4eK0uo6Q7X2XlF/f8Go&o87p=d640H6WhXv9 HTTP/1.1Host: www.lovecord.dateConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 7.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000F.00000002.925308127.0000000000360000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.781503558.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.690946204.0000000003C70000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000000.738249263.000000000E47D000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.925553519.0000000000B00000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.925610906.0000000000B30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.782221543.0000000001490000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.690791851.0000000003B59000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.782183245.0000000001460000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000000.720837328.000000000E47D000.00000040.00020000.sdmp, type: MEMORY

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 7.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 7.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000F.00000002.925308127.0000000000360000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000F.00000002.925308127.0000000000360000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.781503558.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.781503558.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.690946204.0000000003C70000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.690946204.0000000003C70000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000000.738249263.000000000E47D000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000000.738249263.000000000E47D000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000F.00000002.925553519.0000000000B00000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000F.00000002.925553519.0000000000B00000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000F.00000002.925610906.0000000000B30000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000F.00000002.925610906.0000000000B30000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.782221543.0000000001490000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.782221543.0000000001490000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.690791851.0000000003B59000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.690791851.0000000003B59000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.782183245.0000000001460000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.782183245.0000000001460000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000000.720837328.000000000E47D000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000000.720837328.000000000E47D000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
.NET source code contains very large strings
Source: Quote#56432.exe, Cheeeeeeeeese/MainForm.cs Long String: Length: 38272
Source: ySWmXEgh.exe.0.dr, Cheeeeeeeeese/MainForm.cs Long String: Length: 38272
Source: 0.0.Quote#56432.exe.680000.0.unpack, Cheeeeeeeeese/MainForm.cs Long String: Length: 38272
Source: 0.2.Quote#56432.exe.680000.0.unpack, Cheeeeeeeeese/MainForm.cs Long String: Length: 38272
Uses 32bit PE files
Source: Quote#56432.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Yara signature match
Source: 7.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 7.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000F.00000002.925308127.0000000000360000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000F.00000002.925308127.0000000000360000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.781503558.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.781503558.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.690946204.0000000003C70000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.690946204.0000000003C70000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000000.738249263.000000000E47D000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000000.738249263.000000000E47D000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000F.00000002.925553519.0000000000B00000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000F.00000002.925553519.0000000000B00000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000F.00000002.925610906.0000000000B30000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000F.00000002.925610906.0000000000B30000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.782221543.0000000001490000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.782221543.0000000001490000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.690791851.0000000003B59000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.690791851.0000000003B59000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.782183245.0000000001460000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.782183245.0000000001460000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000000.720837328.000000000E47D000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000000.720837328.000000000E47D000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Detected potential crypto function
Source: C:\Users\user\Desktop\Quote#56432.exe Code function: 0_2_00687380 0_2_00687380
Source: C:\Users\user\Desktop\Quote#56432.exe Code function: 0_2_00684E85 0_2_00684E85
Source: C:\Users\user\Desktop\Quote#56432.exe Code function: 0_2_0295CC14 0_2_0295CC14
Source: C:\Users\user\Desktop\Quote#56432.exe Code function: 0_2_0295F218 0_2_0295F218
Source: C:\Users\user\Desktop\Quote#56432.exe Code function: 0_2_0295F208 0_2_0295F208
Source: C:\Users\user\Desktop\Quote#56432.exe Code function: 0_2_08B7D808 0_2_08B7D808
Source: C:\Users\user\Desktop\Quote#56432.exe Code function: 0_2_08B75D68 0_2_08B75D68
Source: C:\Users\user\Desktop\Quote#56432.exe Code function: 0_2_08B70F10 0_2_08B70F10
Source: C:\Users\user\Desktop\Quote#56432.exe Code function: 0_2_08B7AF08 0_2_08B7AF08
Source: C:\Users\user\Desktop\Quote#56432.exe Code function: 0_2_08B70040 0_2_08B70040
Source: C:\Users\user\Desktop\Quote#56432.exe Code function: 0_2_08B73668 0_2_08B73668
Source: C:\Users\user\Desktop\Quote#56432.exe Code function: 0_2_08B7A7A8 0_2_08B7A7A8
Source: C:\Users\user\Desktop\Quote#56432.exe Code function: 0_2_08B7B880 0_2_08B7B880
Source: C:\Users\user\Desktop\Quote#56432.exe Code function: 0_2_08B7B870 0_2_08B7B870
Source: C:\Users\user\Desktop\Quote#56432.exe Code function: 0_2_08B72938 0_2_08B72938
Source: C:\Users\user\Desktop\Quote#56432.exe Code function: 0_2_08B72948 0_2_08B72948
Source: C:\Users\user\Desktop\Quote#56432.exe Code function: 0_2_08B71BE0 0_2_08B71BE0
Source: C:\Users\user\Desktop\Quote#56432.exe Code function: 0_2_08B72C60 0_2_08B72C60
Source: C:\Users\user\Desktop\Quote#56432.exe Code function: 0_2_08B72C53 0_2_08B72C53
Source: C:\Users\user\Desktop\Quote#56432.exe Code function: 0_2_08B71DB8 0_2_08B71DB8
Source: C:\Users\user\Desktop\Quote#56432.exe Code function: 0_2_08B71DAB 0_2_08B71DAB
Source: C:\Users\user\Desktop\Quote#56432.exe Code function: 0_2_08B75D58 0_2_08B75D58
Source: C:\Users\user\Desktop\Quote#56432.exe Code function: 0_2_08B7BEB0 0_2_08B7BEB0
Source: C:\Users\user\Desktop\Quote#56432.exe Code function: 0_2_08B7BEA0 0_2_08B7BEA0
Source: C:\Users\user\Desktop\Quote#56432.exe Code function: 0_2_08B7AEF7 0_2_08B7AEF7
Source: C:\Users\user\Desktop\Quote#56432.exe Code function: 0_2_08B70E20 0_2_08B70E20
Source: C:\Users\user\Desktop\Quote#56432.exe Code function: 0_2_08B74E20 0_2_08B74E20
Source: C:\Users\user\Desktop\Quote#56432.exe Code function: 0_2_08B74E78 0_2_08B74E78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_00401030 7_2_00401030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0041E032 7_2_0041E032
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0041D121 7_2_0041D121
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0041DA37 7_2_0041DA37
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0041DB68 7_2_0041DB68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0041D3E6 7_2_0041D3E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_00402D90 7_2_00402D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_00409E40 7_2_00409E40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0041E62C 7_2_0041E62C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_00409E3C 7_2_00409E3C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0041D681 7_2_0041D681
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_00402FB0 7_2_00402FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0194F900 7_2_0194F900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01964120 7_2_01964120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0195B090 7_2_0195B090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019720A0 7_2_019720A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01A01002 7_2_01A01002
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0197EBB0 7_2_0197EBB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01972581 7_2_01972581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0195D5E0 7_2_0195D5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01940D20 7_2_01940D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01A11D55 7_2_01A11D55
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0195841F 7_2_0195841F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01966E30 7_2_01966E30
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0459841F 15_2_0459841F
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04641002 15_2_04641002
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0459B090 15_2_0459B090
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045B20A0 15_2_045B20A0
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04651D55 15_2_04651D55
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0458F900 15_2_0458F900
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04580D20 15_2_04580D20
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045A4120 15_2_045A4120
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0459D5E0 15_2_0459D5E0
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045B2581 15_2_045B2581
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045A6E30 15_2_045A6E30
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045BEBB0 15_2_045BEBB0
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0037E032 15_2_0037E032
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0037D121 15_2_0037D121
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_00362D90 15_2_00362D90
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_00369E3C 15_2_00369E3C
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_00369E40 15_2_00369E40
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_00362FB0 15_2_00362FB0
Found potential string decryption / allocating functions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: String function: 0194B150 appears 35 times
Source: C:\Windows\SysWOW64\systray.exe Code function: String function: 0458B150 appears 35 times
Contains functionality to call native functions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_00419D60 NtCreateFile, 7_2_00419D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_00419E10 NtReadFile, 7_2_00419E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_00419E90 NtClose, 7_2_00419E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_00419F40 NtAllocateVirtualMemory, 7_2_00419F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_00419D5A NtCreateFile, 7_2_00419D5A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_00419DBA NtCreateFile,NtReadFile, 7_2_00419DBA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_00419E8A NtClose, 7_2_00419E8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019899A0 NtCreateSection,LdrInitializeThunk, 7_2_019899A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01989910 NtAdjustPrivilegesToken,LdrInitializeThunk, 7_2_01989910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019898F0 NtReadVirtualMemory,LdrInitializeThunk, 7_2_019898F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01989840 NtDelayExecution,LdrInitializeThunk, 7_2_01989840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01989860 NtQuerySystemInformation,LdrInitializeThunk, 7_2_01989860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01989A00 NtProtectVirtualMemory,LdrInitializeThunk, 7_2_01989A00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01989A20 NtResumeThread,LdrInitializeThunk, 7_2_01989A20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01989A50 NtCreateFile,LdrInitializeThunk, 7_2_01989A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019895D0 NtClose,LdrInitializeThunk, 7_2_019895D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01989540 NtReadFile,LdrInitializeThunk, 7_2_01989540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01989780 NtMapViewOfSection,LdrInitializeThunk, 7_2_01989780
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019897A0 NtUnmapViewOfSection,LdrInitializeThunk, 7_2_019897A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01989710 NtQueryInformationToken,LdrInitializeThunk, 7_2_01989710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019896E0 NtFreeVirtualMemory,LdrInitializeThunk, 7_2_019896E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01989660 NtAllocateVirtualMemory,LdrInitializeThunk, 7_2_01989660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019899D0 NtCreateProcessEx, 7_2_019899D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01989950 NtQueueApcThread, 7_2_01989950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019898A0 NtWriteVirtualMemory, 7_2_019898A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01989820 NtEnumerateKey, 7_2_01989820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0198B040 NtSuspendThread, 7_2_0198B040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0198A3B0 NtGetContextThread, 7_2_0198A3B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01989B00 NtSetValueKey, 7_2_01989B00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01989A80 NtOpenDirectoryObject, 7_2_01989A80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01989A10 NtQuerySection, 7_2_01989A10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019895F0 NtQueryInformationFile, 7_2_019895F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0198AD30 NtSetContextThread, 7_2_0198AD30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01989520 NtWaitForSingleObject, 7_2_01989520
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01989560 NtWriteFile, 7_2_01989560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01989FE0 NtCreateMutant, 7_2_01989FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0198A710 NtOpenProcessToken, 7_2_0198A710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01989730 NtQueryVirtualMemory, 7_2_01989730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01989770 NtSetInformationFile, 7_2_01989770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0198A770 NtOpenThread, 7_2_0198A770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01989760 NtOpenProcess, 7_2_01989760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019896D0 NtCreateKey, 7_2_019896D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01989610 NtEnumerateValueKey, 7_2_01989610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01989650 NtQueryValueKey, 7_2_01989650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01989670 NtQueryInformationProcess, 7_2_01989670
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045C9840 NtDelayExecution,LdrInitializeThunk, 15_2_045C9840
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045C9860 NtQuerySystemInformation,LdrInitializeThunk, 15_2_045C9860
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045C9540 NtReadFile,LdrInitializeThunk, 15_2_045C9540
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045C9910 NtAdjustPrivilegesToken,LdrInitializeThunk, 15_2_045C9910
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045C95D0 NtClose,LdrInitializeThunk, 15_2_045C95D0
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045C99A0 NtCreateSection,LdrInitializeThunk, 15_2_045C99A0
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045C9650 NtQueryValueKey,LdrInitializeThunk, 15_2_045C9650
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045C9A50 NtCreateFile,LdrInitializeThunk, 15_2_045C9A50
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045C9660 NtAllocateVirtualMemory,LdrInitializeThunk, 15_2_045C9660
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045C96D0 NtCreateKey,LdrInitializeThunk, 15_2_045C96D0
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045C96E0 NtFreeVirtualMemory,LdrInitializeThunk, 15_2_045C96E0
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045C9710 NtQueryInformationToken,LdrInitializeThunk, 15_2_045C9710
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045C9FE0 NtCreateMutant,LdrInitializeThunk, 15_2_045C9FE0
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045C9780 NtMapViewOfSection,LdrInitializeThunk, 15_2_045C9780
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045CB040 NtSuspendThread, 15_2_045CB040
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045C9820 NtEnumerateKey, 15_2_045C9820
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045C98F0 NtReadVirtualMemory, 15_2_045C98F0
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045C98A0 NtWriteVirtualMemory, 15_2_045C98A0
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045C9950 NtQueueApcThread, 15_2_045C9950
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045C9560 NtWriteFile, 15_2_045C9560
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045CAD30 NtSetContextThread, 15_2_045CAD30
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045C9520 NtWaitForSingleObject, 15_2_045C9520
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045C99D0 NtCreateProcessEx, 15_2_045C99D0
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045C95F0 NtQueryInformationFile, 15_2_045C95F0
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045C9670 NtQueryInformationProcess, 15_2_045C9670
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045C9610 NtEnumerateValueKey, 15_2_045C9610
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045C9A10 NtQuerySection, 15_2_045C9A10
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045C9A00 NtProtectVirtualMemory, 15_2_045C9A00
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045C9A20 NtResumeThread, 15_2_045C9A20
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045C9A80 NtOpenDirectoryObject, 15_2_045C9A80
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045C9770 NtSetInformationFile, 15_2_045C9770
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045CA770 NtOpenThread, 15_2_045CA770
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045C9760 NtOpenProcess, 15_2_045C9760
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045CA710 NtOpenProcessToken, 15_2_045CA710
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045C9B00 NtSetValueKey, 15_2_045C9B00
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045C9730 NtQueryVirtualMemory, 15_2_045C9730
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045CA3B0 NtGetContextThread, 15_2_045CA3B0
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045C97A0 NtUnmapViewOfSection, 15_2_045C97A0
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_00379D60 NtCreateFile, 15_2_00379D60
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_00379E10 NtReadFile, 15_2_00379E10
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_00379E90 NtClose, 15_2_00379E90
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_00379F40 NtAllocateVirtualMemory, 15_2_00379F40
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_00379D5A NtCreateFile, 15_2_00379D5A
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_00379DBA NtCreateFile,NtReadFile, 15_2_00379DBA
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_00379E8A NtClose, 15_2_00379E8A
Sample file is different than original file name gathered from version info
Source: Quote#56432.exe Binary or memory string: OriginalFilename vs Quote#56432.exe
Source: Quote#56432.exe, 00000000.00000002.690946204.0000000003C70000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameCF_Secretaria.dll< vs Quote#56432.exe
Source: Quote#56432.exe, 00000000.00000002.690221413.0000000002B51000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameEnvoySinks.dll6 vs Quote#56432.exe
Source: Quote#56432.exe, 00000000.00000002.689196044.0000000000682000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameRangeWork.exe< vs Quote#56432.exe
Source: Quote#56432.exe Binary or memory string: OriginalFilenameRangeWork.exe< vs Quote#56432.exe
Source: Quote#56432.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: ySWmXEgh.exe.0.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: Quote#56432.exe Virustotal: Detection: 29%
Source: Quote#56432.exe Metadefender: Detection: 28%
Source: Quote#56432.exe ReversingLabs: Detection: 78%
Source: C:\Users\user\Desktop\Quote#56432.exe File read: C:\Users\user\Desktop\Quote#56432.exe Jump to behavior
Source: Quote#56432.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Quote#56432.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Quote#56432.exe 'C:\Users\user\Desktop\Quote#56432.exe'
Source: C:\Users\user\Desktop\Quote#56432.exe Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ySWmXEgh' /XML 'C:\Users\user\AppData\Local\Temp\tmp994F.tmp'
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Quote#56432.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process created: C:\Windows\SysWOW64\systray.exe C:\Windows\SysWOW64\systray.exe
Source: C:\Windows\SysWOW64\systray.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Quote#56432.exe Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ySWmXEgh' /XML 'C:\Users\user\AppData\Local\Temp\tmp994F.tmp' Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process created: C:\Windows\SysWOW64\systray.exe C:\Windows\SysWOW64\systray.exe Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe' Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe File created: C:\Users\user\AppData\Roaming\ySWmXEgh.exe Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe File created: C:\Users\user\AppData\Local\Temp\tmp994F.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winEXE@11/4@2/1
Source: C:\Users\user\Desktop\Quote#56432.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6472:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5908:120:WilError_01
Source: C:\Users\user\Desktop\Quote#56432.exe Mutant created: \Sessions\1\BaseNamedObjects\VnxmayLwfqlQkqDyHKdqh
Source: Quote#56432.exe, Cheeeeeeeeese/MainForm.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: ySWmXEgh.exe.0.dr, Cheeeeeeeeese/MainForm.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.0.Quote#56432.exe.680000.0.unpack, Cheeeeeeeeese/MainForm.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.Quote#56432.exe.680000.0.unpack, Cheeeeeeeeese/MainForm.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: Quote#56432.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: Quote#56432.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: systray.pdb source: RegSvcs.exe, 00000007.00000002.782499789.0000000001910000.00000040.00020000.sdmp
Source: Binary string: systray.pdbGCTL source: RegSvcs.exe, 00000007.00000002.782499789.0000000001910000.00000040.00020000.sdmp
Source: Binary string: RegSvcs.pdb, source: systray.exe, 0000000F.00000002.927302675.0000000004A8F000.00000004.00020000.sdmp
Source: Binary string: wntdll.pdbUGP source: RegSvcs.exe, 00000007.00000002.784083913.0000000001A3F000.00000040.00000001.sdmp, systray.exe, 0000000F.00000002.926821802.000000000467F000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: RegSvcs.exe, systray.exe
Source: Binary string: RegSvcs.pdb source: systray.exe, 0000000F.00000002.927302675.0000000004A8F000.00000004.00020000.sdmp

Data Obfuscation:

barindex
.NET source code contains potential unpacker
Source: Quote#56432.exe, Cheeeeeeeeese/MainForm.cs .Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: ySWmXEgh.exe.0.dr, Cheeeeeeeeese/MainForm.cs .Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.Quote#56432.exe.680000.0.unpack, Cheeeeeeeeese/MainForm.cs .Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.2.Quote#56432.exe.680000.0.unpack, Cheeeeeeeeese/MainForm.cs .Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Quote#56432.exe Code function: 0_2_00685F3D push ss; iretd 0_2_00685F3E
Source: C:\Users\user\Desktop\Quote#56432.exe Code function: 0_2_00687205 push cs; retf 0_2_006872DC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0040E3E2 pushfd ; iretd 7_2_0040E435
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0040F6D1 push es; iretd 7_2_0040F6D2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0041DE8F push edi; iretd 7_2_0041DE92
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0041CEB5 push eax; ret 7_2_0041CF08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0041CF6C push eax; ret 7_2_0041CF72
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0041CF02 push eax; ret 7_2_0041CF08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0041CF0B push eax; ret 7_2_0041CF72
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0199D0D1 push ecx; ret 7_2_0199D0E4
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045DD0D1 push ecx; ret 15_2_045DD0E4
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0036E3E2 pushfd ; iretd 15_2_0036E435
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0037CEB5 push eax; ret 15_2_0037CF08
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0037DE8F push edi; iretd 15_2_0037DE92
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0036F6D1 push es; iretd 15_2_0036F6D2
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0037CF02 push eax; ret 15_2_0037CF08
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0037CF0B push eax; ret 15_2_0037CF72
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0037CF6C push eax; ret 15_2_0037CF72
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0037D7CC push ecx; retf 15_2_0037D7D6
Source: initial sample Static PE information: section name: .text entropy: 7.67621668489
Source: initial sample Static PE information: section name: .text entropy: 7.67621668489

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Users\user\Desktop\Quote#56432.exe File created: C:\Users\user\AppData\Roaming\ySWmXEgh.exe Jump to dropped file

Boot Survival:

barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\Quote#56432.exe Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ySWmXEgh' /XML 'C:\Users\user\AppData\Local\Temp\tmp994F.tmp'

Hooking and other Techniques for Hiding and Protection:

barindex
Modifies the prolog of user mode functions (user mode inline hooks)
Source: explorer.exe User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x87 0x7E 0xEC
Source: C:\Users\user\Desktop\Quote#56432.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Yara detected AntiVM3
Source: Yara match File source: 0.2.Quote#56432.exe.2b93d5c.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.690221413.0000000002B51000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Quote#56432.exe PID: 6792, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: Quote#56432.exe, 00000000.00000002.690221413.0000000002B51000.00000004.00000001.sdmp Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: Quote#56432.exe, 00000000.00000002.690221413.0000000002B51000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLL
Tries to detect virtualization through RDTSC time measurements
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe RDTSC instruction interceptor: First address: 00000000004098E4 second address: 00000000004098EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe RDTSC instruction interceptor: First address: 0000000000409B5E second address: 0000000000409B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\systray.exe RDTSC instruction interceptor: First address: 00000000003698E4 second address: 00000000003698EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\systray.exe RDTSC instruction interceptor: First address: 0000000000369B5E second address: 0000000000369B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\Quote#56432.exe TID: 6800 Thread sleep time: -34187s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe TID: 6828 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe TID: 5936 Thread sleep time: -30000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\explorer.exe Last function: Thread delayed
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_00409A90 rdtsc 7_2_00409A90
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\Quote#56432.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Thread delayed: delay time: 34187 Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: explorer.exe, 00000008.00000000.700693239.000000000A60E000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: Quote#56432.exe, 00000000.00000002.690221413.0000000002B51000.00000004.00000001.sdmp Binary or memory string: vmware
Source: explorer.exe, 00000008.00000000.701478438.000000000A897000.00000004.00000001.sdmp Binary or memory string: 6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}efb8b}
Source: Quote#56432.exe, 00000000.00000002.690221413.0000000002B51000.00000004.00000001.sdmp Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Quote#56432.exe, 00000000.00000002.690221413.0000000002B51000.00000004.00000001.sdmp Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: explorer.exe, 00000008.00000000.732673290.0000000006650000.00000004.00000001.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000008.00000000.700693239.000000000A60E000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000008.00000000.738939266.000000000FD12000.00000004.00000001.sdmp Binary or memory string: 6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATAd
Source: Quote#56432.exe, 00000000.00000002.690221413.0000000002B51000.00000004.00000001.sdmp Binary or memory string: VMWARE
Source: Quote#56432.exe, 00000000.00000002.690221413.0000000002B51000.00000004.00000001.sdmp Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 00000008.00000000.710195629.0000000004710000.00000004.00000001.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000[Wm
Source: explorer.exe, 00000008.00000000.717907917.000000000A716000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000/
Source: Quote#56432.exe, 00000000.00000002.690221413.0000000002B51000.00000004.00000001.sdmp Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: Quote#56432.exe, 00000000.00000002.690221413.0000000002B51000.00000004.00000001.sdmp Binary or memory string: VMware SVGA II
Source: explorer.exe, 00000008.00000000.717907917.000000000A716000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000@
Source: Quote#56432.exe, 00000000.00000002.690221413.0000000002B51000.00000004.00000001.sdmp Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000

Anti Debugging:

barindex
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_00409A90 rdtsc 7_2_00409A90
Enables debug privileges
Source: C:\Users\user\Desktop\Quote#56432.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe Process token adjusted: Debug Jump to behavior
Contains functionality to read the PEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01972990 mov eax, dword ptr fs:[00000030h] 7_2_01972990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0197A185 mov eax, dword ptr fs:[00000030h] 7_2_0197A185
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0196C182 mov eax, dword ptr fs:[00000030h] 7_2_0196C182
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019C51BE mov eax, dword ptr fs:[00000030h] 7_2_019C51BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019C51BE mov eax, dword ptr fs:[00000030h] 7_2_019C51BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019C51BE mov eax, dword ptr fs:[00000030h] 7_2_019C51BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019C51BE mov eax, dword ptr fs:[00000030h] 7_2_019C51BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019761A0 mov eax, dword ptr fs:[00000030h] 7_2_019761A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019761A0 mov eax, dword ptr fs:[00000030h] 7_2_019761A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019C69A6 mov eax, dword ptr fs:[00000030h] 7_2_019C69A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0194B1E1 mov eax, dword ptr fs:[00000030h] 7_2_0194B1E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0194B1E1 mov eax, dword ptr fs:[00000030h] 7_2_0194B1E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0194B1E1 mov eax, dword ptr fs:[00000030h] 7_2_0194B1E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019D41E8 mov eax, dword ptr fs:[00000030h] 7_2_019D41E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01949100 mov eax, dword ptr fs:[00000030h] 7_2_01949100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01949100 mov eax, dword ptr fs:[00000030h] 7_2_01949100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01949100 mov eax, dword ptr fs:[00000030h] 7_2_01949100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0197513A mov eax, dword ptr fs:[00000030h] 7_2_0197513A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0197513A mov eax, dword ptr fs:[00000030h] 7_2_0197513A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01964120 mov eax, dword ptr fs:[00000030h] 7_2_01964120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01964120 mov eax, dword ptr fs:[00000030h] 7_2_01964120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01964120 mov eax, dword ptr fs:[00000030h] 7_2_01964120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01964120 mov eax, dword ptr fs:[00000030h] 7_2_01964120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01964120 mov ecx, dword ptr fs:[00000030h] 7_2_01964120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0196B944 mov eax, dword ptr fs:[00000030h] 7_2_0196B944
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0196B944 mov eax, dword ptr fs:[00000030h] 7_2_0196B944
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0194B171 mov eax, dword ptr fs:[00000030h] 7_2_0194B171
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0194B171 mov eax, dword ptr fs:[00000030h] 7_2_0194B171
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0194C962 mov eax, dword ptr fs:[00000030h] 7_2_0194C962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01949080 mov eax, dword ptr fs:[00000030h] 7_2_01949080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019C3884 mov eax, dword ptr fs:[00000030h] 7_2_019C3884
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019C3884 mov eax, dword ptr fs:[00000030h] 7_2_019C3884
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0197F0BF mov ecx, dword ptr fs:[00000030h] 7_2_0197F0BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0197F0BF mov eax, dword ptr fs:[00000030h] 7_2_0197F0BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0197F0BF mov eax, dword ptr fs:[00000030h] 7_2_0197F0BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019890AF mov eax, dword ptr fs:[00000030h] 7_2_019890AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019720A0 mov eax, dword ptr fs:[00000030h] 7_2_019720A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019720A0 mov eax, dword ptr fs:[00000030h] 7_2_019720A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019720A0 mov eax, dword ptr fs:[00000030h] 7_2_019720A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019720A0 mov eax, dword ptr fs:[00000030h] 7_2_019720A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019720A0 mov eax, dword ptr fs:[00000030h] 7_2_019720A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019720A0 mov eax, dword ptr fs:[00000030h] 7_2_019720A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019DB8D0 mov eax, dword ptr fs:[00000030h] 7_2_019DB8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019DB8D0 mov ecx, dword ptr fs:[00000030h] 7_2_019DB8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019DB8D0 mov eax, dword ptr fs:[00000030h] 7_2_019DB8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019DB8D0 mov eax, dword ptr fs:[00000030h] 7_2_019DB8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019DB8D0 mov eax, dword ptr fs:[00000030h] 7_2_019DB8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019DB8D0 mov eax, dword ptr fs:[00000030h] 7_2_019DB8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019458EC mov eax, dword ptr fs:[00000030h] 7_2_019458EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019C7016 mov eax, dword ptr fs:[00000030h] 7_2_019C7016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019C7016 mov eax, dword ptr fs:[00000030h] 7_2_019C7016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019C7016 mov eax, dword ptr fs:[00000030h] 7_2_019C7016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01A14015 mov eax, dword ptr fs:[00000030h] 7_2_01A14015
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01A14015 mov eax, dword ptr fs:[00000030h] 7_2_01A14015
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0197002D mov eax, dword ptr fs:[00000030h] 7_2_0197002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0197002D mov eax, dword ptr fs:[00000030h] 7_2_0197002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0197002D mov eax, dword ptr fs:[00000030h] 7_2_0197002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0197002D mov eax, dword ptr fs:[00000030h] 7_2_0197002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0197002D mov eax, dword ptr fs:[00000030h] 7_2_0197002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0195B02A mov eax, dword ptr fs:[00000030h] 7_2_0195B02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0195B02A mov eax, dword ptr fs:[00000030h] 7_2_0195B02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0195B02A mov eax, dword ptr fs:[00000030h] 7_2_0195B02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0195B02A mov eax, dword ptr fs:[00000030h] 7_2_0195B02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01960050 mov eax, dword ptr fs:[00000030h] 7_2_01960050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01960050 mov eax, dword ptr fs:[00000030h] 7_2_01960050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01A02073 mov eax, dword ptr fs:[00000030h] 7_2_01A02073
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01A11074 mov eax, dword ptr fs:[00000030h] 7_2_01A11074
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01972397 mov eax, dword ptr fs:[00000030h] 7_2_01972397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01A15BA5 mov eax, dword ptr fs:[00000030h] 7_2_01A15BA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0197B390 mov eax, dword ptr fs:[00000030h] 7_2_0197B390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01951B8F mov eax, dword ptr fs:[00000030h] 7_2_01951B8F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01951B8F mov eax, dword ptr fs:[00000030h] 7_2_01951B8F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019FD380 mov ecx, dword ptr fs:[00000030h] 7_2_019FD380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01A0138A mov eax, dword ptr fs:[00000030h] 7_2_01A0138A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01974BAD mov eax, dword ptr fs:[00000030h] 7_2_01974BAD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01974BAD mov eax, dword ptr fs:[00000030h] 7_2_01974BAD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01974BAD mov eax, dword ptr fs:[00000030h] 7_2_01974BAD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019C53CA mov eax, dword ptr fs:[00000030h] 7_2_019C53CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019C53CA mov eax, dword ptr fs:[00000030h] 7_2_019C53CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019703E2 mov eax, dword ptr fs:[00000030h] 7_2_019703E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019703E2 mov eax, dword ptr fs:[00000030h] 7_2_019703E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019703E2 mov eax, dword ptr fs:[00000030h] 7_2_019703E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019703E2 mov eax, dword ptr fs:[00000030h] 7_2_019703E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019703E2 mov eax, dword ptr fs:[00000030h] 7_2_019703E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019703E2 mov eax, dword ptr fs:[00000030h] 7_2_019703E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0196DBE9 mov eax, dword ptr fs:[00000030h] 7_2_0196DBE9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01A0131B mov eax, dword ptr fs:[00000030h] 7_2_01A0131B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0194F358 mov eax, dword ptr fs:[00000030h] 7_2_0194F358
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0194DB40 mov eax, dword ptr fs:[00000030h] 7_2_0194DB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01973B7A mov eax, dword ptr fs:[00000030h] 7_2_01973B7A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01973B7A mov eax, dword ptr fs:[00000030h] 7_2_01973B7A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0194DB60 mov ecx, dword ptr fs:[00000030h] 7_2_0194DB60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01A18B58 mov eax, dword ptr fs:[00000030h] 7_2_01A18B58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0197D294 mov eax, dword ptr fs:[00000030h] 7_2_0197D294
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0197D294 mov eax, dword ptr fs:[00000030h] 7_2_0197D294
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0195AAB0 mov eax, dword ptr fs:[00000030h] 7_2_0195AAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0195AAB0 mov eax, dword ptr fs:[00000030h] 7_2_0195AAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0197FAB0 mov eax, dword ptr fs:[00000030h] 7_2_0197FAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019452A5 mov eax, dword ptr fs:[00000030h] 7_2_019452A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019452A5 mov eax, dword ptr fs:[00000030h] 7_2_019452A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019452A5 mov eax, dword ptr fs:[00000030h] 7_2_019452A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019452A5 mov eax, dword ptr fs:[00000030h] 7_2_019452A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019452A5 mov eax, dword ptr fs:[00000030h] 7_2_019452A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01972ACB mov eax, dword ptr fs:[00000030h] 7_2_01972ACB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01972AE4 mov eax, dword ptr fs:[00000030h] 7_2_01972AE4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0194AA16 mov eax, dword ptr fs:[00000030h] 7_2_0194AA16
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0194AA16 mov eax, dword ptr fs:[00000030h] 7_2_0194AA16
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01945210 mov eax, dword ptr fs:[00000030h] 7_2_01945210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01945210 mov ecx, dword ptr fs:[00000030h] 7_2_01945210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01945210 mov eax, dword ptr fs:[00000030h] 7_2_01945210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01945210 mov eax, dword ptr fs:[00000030h] 7_2_01945210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01963A1C mov eax, dword ptr fs:[00000030h] 7_2_01963A1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01958A0A mov eax, dword ptr fs:[00000030h] 7_2_01958A0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01984A2C mov eax, dword ptr fs:[00000030h] 7_2_01984A2C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01984A2C mov eax, dword ptr fs:[00000030h] 7_2_01984A2C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01A18A62 mov eax, dword ptr fs:[00000030h] 7_2_01A18A62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019D4257 mov eax, dword ptr fs:[00000030h] 7_2_019D4257
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01949240 mov eax, dword ptr fs:[00000030h] 7_2_01949240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01949240 mov eax, dword ptr fs:[00000030h] 7_2_01949240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01949240 mov eax, dword ptr fs:[00000030h] 7_2_01949240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01949240 mov eax, dword ptr fs:[00000030h] 7_2_01949240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0198927A mov eax, dword ptr fs:[00000030h] 7_2_0198927A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019FB260 mov eax, dword ptr fs:[00000030h] 7_2_019FB260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019FB260 mov eax, dword ptr fs:[00000030h] 7_2_019FB260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0197FD9B mov eax, dword ptr fs:[00000030h] 7_2_0197FD9B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0197FD9B mov eax, dword ptr fs:[00000030h] 7_2_0197FD9B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01972581 mov eax, dword ptr fs:[00000030h] 7_2_01972581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01972581 mov eax, dword ptr fs:[00000030h] 7_2_01972581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01972581 mov eax, dword ptr fs:[00000030h] 7_2_01972581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01972581 mov eax, dword ptr fs:[00000030h] 7_2_01972581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01942D8A mov eax, dword ptr fs:[00000030h] 7_2_01942D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01942D8A mov eax, dword ptr fs:[00000030h] 7_2_01942D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01942D8A mov eax, dword ptr fs:[00000030h] 7_2_01942D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01942D8A mov eax, dword ptr fs:[00000030h] 7_2_01942D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01942D8A mov eax, dword ptr fs:[00000030h] 7_2_01942D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01971DB5 mov eax, dword ptr fs:[00000030h] 7_2_01971DB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01971DB5 mov eax, dword ptr fs:[00000030h] 7_2_01971DB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01971DB5 mov eax, dword ptr fs:[00000030h] 7_2_01971DB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019735A1 mov eax, dword ptr fs:[00000030h] 7_2_019735A1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019C6DC9 mov eax, dword ptr fs:[00000030h] 7_2_019C6DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019C6DC9 mov eax, dword ptr fs:[00000030h] 7_2_019C6DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019C6DC9 mov eax, dword ptr fs:[00000030h] 7_2_019C6DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019C6DC9 mov ecx, dword ptr fs:[00000030h] 7_2_019C6DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019C6DC9 mov eax, dword ptr fs:[00000030h] 7_2_019C6DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019C6DC9 mov eax, dword ptr fs:[00000030h] 7_2_019C6DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019F8DF1 mov eax, dword ptr fs:[00000030h] 7_2_019F8DF1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0195D5E0 mov eax, dword ptr fs:[00000030h] 7_2_0195D5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0195D5E0 mov eax, dword ptr fs:[00000030h] 7_2_0195D5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01A18D34 mov eax, dword ptr fs:[00000030h] 7_2_01A18D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01953D34 mov eax, dword ptr fs:[00000030h] 7_2_01953D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01953D34 mov eax, dword ptr fs:[00000030h] 7_2_01953D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01953D34 mov eax, dword ptr fs:[00000030h] 7_2_01953D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01953D34 mov eax, dword ptr fs:[00000030h] 7_2_01953D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01953D34 mov eax, dword ptr fs:[00000030h] 7_2_01953D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01953D34 mov eax, dword ptr fs:[00000030h] 7_2_01953D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01953D34 mov eax, dword ptr fs:[00000030h] 7_2_01953D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01953D34 mov eax, dword ptr fs:[00000030h] 7_2_01953D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01953D34 mov eax, dword ptr fs:[00000030h] 7_2_01953D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01953D34 mov eax, dword ptr fs:[00000030h] 7_2_01953D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01953D34 mov eax, dword ptr fs:[00000030h] 7_2_01953D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01953D34 mov eax, dword ptr fs:[00000030h] 7_2_01953D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01953D34 mov eax, dword ptr fs:[00000030h] 7_2_01953D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0194AD30 mov eax, dword ptr fs:[00000030h] 7_2_0194AD30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019CA537 mov eax, dword ptr fs:[00000030h] 7_2_019CA537
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01974D3B mov eax, dword ptr fs:[00000030h] 7_2_01974D3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01974D3B mov eax, dword ptr fs:[00000030h] 7_2_01974D3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01974D3B mov eax, dword ptr fs:[00000030h] 7_2_01974D3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01967D50 mov eax, dword ptr fs:[00000030h] 7_2_01967D50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01983D43 mov eax, dword ptr fs:[00000030h] 7_2_01983D43
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019C3540 mov eax, dword ptr fs:[00000030h] 7_2_019C3540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0196C577 mov eax, dword ptr fs:[00000030h] 7_2_0196C577
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0196C577 mov eax, dword ptr fs:[00000030h] 7_2_0196C577
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0195849B mov eax, dword ptr fs:[00000030h] 7_2_0195849B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01A014FB mov eax, dword ptr fs:[00000030h] 7_2_01A014FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019C6CF0 mov eax, dword ptr fs:[00000030h] 7_2_019C6CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019C6CF0 mov eax, dword ptr fs:[00000030h] 7_2_019C6CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019C6CF0 mov eax, dword ptr fs:[00000030h] 7_2_019C6CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01A18CD6 mov eax, dword ptr fs:[00000030h] 7_2_01A18CD6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019C6C0A mov eax, dword ptr fs:[00000030h] 7_2_019C6C0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019C6C0A mov eax, dword ptr fs:[00000030h] 7_2_019C6C0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019C6C0A mov eax, dword ptr fs:[00000030h] 7_2_019C6C0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019C6C0A mov eax, dword ptr fs:[00000030h] 7_2_019C6C0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01A01C06 mov eax, dword ptr fs:[00000030h] 7_2_01A01C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01A01C06 mov eax, dword ptr fs:[00000030h] 7_2_01A01C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01A01C06 mov eax, dword ptr fs:[00000030h] 7_2_01A01C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01A01C06 mov eax, dword ptr fs:[00000030h] 7_2_01A01C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01A01C06 mov eax, dword ptr fs:[00000030h] 7_2_01A01C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01A01C06 mov eax, dword ptr fs:[00000030h] 7_2_01A01C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01A01C06 mov eax, dword ptr fs:[00000030h] 7_2_01A01C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01A01C06 mov eax, dword ptr fs:[00000030h] 7_2_01A01C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01A01C06 mov eax, dword ptr fs:[00000030h] 7_2_01A01C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01A01C06 mov eax, dword ptr fs:[00000030h] 7_2_01A01C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01A01C06 mov eax, dword ptr fs:[00000030h] 7_2_01A01C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01A01C06 mov eax, dword ptr fs:[00000030h] 7_2_01A01C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01A01C06 mov eax, dword ptr fs:[00000030h] 7_2_01A01C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01A01C06 mov eax, dword ptr fs:[00000030h] 7_2_01A01C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01A1740D mov eax, dword ptr fs:[00000030h] 7_2_01A1740D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01A1740D mov eax, dword ptr fs:[00000030h] 7_2_01A1740D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01A1740D mov eax, dword ptr fs:[00000030h] 7_2_01A1740D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0197BC2C mov eax, dword ptr fs:[00000030h] 7_2_0197BC2C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019DC450 mov eax, dword ptr fs:[00000030h] 7_2_019DC450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019DC450 mov eax, dword ptr fs:[00000030h] 7_2_019DC450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0197A44B mov eax, dword ptr fs:[00000030h] 7_2_0197A44B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0196746D mov eax, dword ptr fs:[00000030h] 7_2_0196746D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01958794 mov eax, dword ptr fs:[00000030h] 7_2_01958794
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019C7794 mov eax, dword ptr fs:[00000030h] 7_2_019C7794
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019C7794 mov eax, dword ptr fs:[00000030h] 7_2_019C7794
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019C7794 mov eax, dword ptr fs:[00000030h] 7_2_019C7794
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019837F5 mov eax, dword ptr fs:[00000030h] 7_2_019837F5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0196F716 mov eax, dword ptr fs:[00000030h] 7_2_0196F716
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019DFF10 mov eax, dword ptr fs:[00000030h] 7_2_019DFF10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019DFF10 mov eax, dword ptr fs:[00000030h] 7_2_019DFF10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0197A70E mov eax, dword ptr fs:[00000030h] 7_2_0197A70E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0197A70E mov eax, dword ptr fs:[00000030h] 7_2_0197A70E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0197E730 mov eax, dword ptr fs:[00000030h] 7_2_0197E730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01A1070D mov eax, dword ptr fs:[00000030h] 7_2_01A1070D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01A1070D mov eax, dword ptr fs:[00000030h] 7_2_01A1070D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01944F2E mov eax, dword ptr fs:[00000030h] 7_2_01944F2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01944F2E mov eax, dword ptr fs:[00000030h] 7_2_01944F2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01A18F6A mov eax, dword ptr fs:[00000030h] 7_2_01A18F6A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0195EF40 mov eax, dword ptr fs:[00000030h] 7_2_0195EF40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0195FF60 mov eax, dword ptr fs:[00000030h] 7_2_0195FF60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01A10EA5 mov eax, dword ptr fs:[00000030h] 7_2_01A10EA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01A10EA5 mov eax, dword ptr fs:[00000030h] 7_2_01A10EA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01A10EA5 mov eax, dword ptr fs:[00000030h] 7_2_01A10EA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019DFE87 mov eax, dword ptr fs:[00000030h] 7_2_019DFE87
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019C46A7 mov eax, dword ptr fs:[00000030h] 7_2_019C46A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019736CC mov eax, dword ptr fs:[00000030h] 7_2_019736CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019FFEC0 mov eax, dword ptr fs:[00000030h] 7_2_019FFEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01988EC7 mov eax, dword ptr fs:[00000030h] 7_2_01988EC7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019716E0 mov ecx, dword ptr fs:[00000030h] 7_2_019716E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01A18ED6 mov eax, dword ptr fs:[00000030h] 7_2_01A18ED6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019576E2 mov eax, dword ptr fs:[00000030h] 7_2_019576E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0197A61C mov eax, dword ptr fs:[00000030h] 7_2_0197A61C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0197A61C mov eax, dword ptr fs:[00000030h] 7_2_0197A61C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0194C600 mov eax, dword ptr fs:[00000030h] 7_2_0194C600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0194C600 mov eax, dword ptr fs:[00000030h] 7_2_0194C600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0194C600 mov eax, dword ptr fs:[00000030h] 7_2_0194C600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01978E00 mov eax, dword ptr fs:[00000030h] 7_2_01978E00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_019FFE3F mov eax, dword ptr fs:[00000030h] 7_2_019FFE3F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0194E620 mov eax, dword ptr fs:[00000030h] 7_2_0194E620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01957E41 mov eax, dword ptr fs:[00000030h] 7_2_01957E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01957E41 mov eax, dword ptr fs:[00000030h] 7_2_01957E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01957E41 mov eax, dword ptr fs:[00000030h] 7_2_01957E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01957E41 mov eax, dword ptr fs:[00000030h] 7_2_01957E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01957E41 mov eax, dword ptr fs:[00000030h] 7_2_01957E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_01957E41 mov eax, dword ptr fs:[00000030h] 7_2_01957E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0196AE73 mov eax, dword ptr fs:[00000030h] 7_2_0196AE73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0196AE73 mov eax, dword ptr fs:[00000030h] 7_2_0196AE73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0196AE73 mov eax, dword ptr fs:[00000030h] 7_2_0196AE73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0196AE73 mov eax, dword ptr fs:[00000030h] 7_2_0196AE73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0196AE73 mov eax, dword ptr fs:[00000030h] 7_2_0196AE73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0195766D mov eax, dword ptr fs:[00000030h] 7_2_0195766D
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045A0050 mov eax, dword ptr fs:[00000030h] 15_2_045A0050
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045A0050 mov eax, dword ptr fs:[00000030h] 15_2_045A0050
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045BA44B mov eax, dword ptr fs:[00000030h] 15_2_045BA44B
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04651074 mov eax, dword ptr fs:[00000030h] 15_2_04651074
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04642073 mov eax, dword ptr fs:[00000030h] 15_2_04642073
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0461C450 mov eax, dword ptr fs:[00000030h] 15_2_0461C450
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0461C450 mov eax, dword ptr fs:[00000030h] 15_2_0461C450
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045A746D mov eax, dword ptr fs:[00000030h] 15_2_045A746D
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04641C06 mov eax, dword ptr fs:[00000030h] 15_2_04641C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04641C06 mov eax, dword ptr fs:[00000030h] 15_2_04641C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04641C06 mov eax, dword ptr fs:[00000030h] 15_2_04641C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04641C06 mov eax, dword ptr fs:[00000030h] 15_2_04641C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04641C06 mov eax, dword ptr fs:[00000030h] 15_2_04641C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04641C06 mov eax, dword ptr fs:[00000030h] 15_2_04641C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04641C06 mov eax, dword ptr fs:[00000030h] 15_2_04641C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04641C06 mov eax, dword ptr fs:[00000030h] 15_2_04641C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04641C06 mov eax, dword ptr fs:[00000030h] 15_2_04641C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04641C06 mov eax, dword ptr fs:[00000030h] 15_2_04641C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04641C06 mov eax, dword ptr fs:[00000030h] 15_2_04641C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04641C06 mov eax, dword ptr fs:[00000030h] 15_2_04641C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04641C06 mov eax, dword ptr fs:[00000030h] 15_2_04641C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04641C06 mov eax, dword ptr fs:[00000030h] 15_2_04641C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0465740D mov eax, dword ptr fs:[00000030h] 15_2_0465740D
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0465740D mov eax, dword ptr fs:[00000030h] 15_2_0465740D
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0465740D mov eax, dword ptr fs:[00000030h] 15_2_0465740D
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04606C0A mov eax, dword ptr fs:[00000030h] 15_2_04606C0A
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04606C0A mov eax, dword ptr fs:[00000030h] 15_2_04606C0A
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04606C0A mov eax, dword ptr fs:[00000030h] 15_2_04606C0A
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04606C0A mov eax, dword ptr fs:[00000030h] 15_2_04606C0A
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04654015 mov eax, dword ptr fs:[00000030h] 15_2_04654015
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04654015 mov eax, dword ptr fs:[00000030h] 15_2_04654015
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0459B02A mov eax, dword ptr fs:[00000030h] 15_2_0459B02A
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0459B02A mov eax, dword ptr fs:[00000030h] 15_2_0459B02A
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0459B02A mov eax, dword ptr fs:[00000030h] 15_2_0459B02A
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0459B02A mov eax, dword ptr fs:[00000030h] 15_2_0459B02A
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04607016 mov eax, dword ptr fs:[00000030h] 15_2_04607016
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04607016 mov eax, dword ptr fs:[00000030h] 15_2_04607016
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04607016 mov eax, dword ptr fs:[00000030h] 15_2_04607016
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045B002D mov eax, dword ptr fs:[00000030h] 15_2_045B002D
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045B002D mov eax, dword ptr fs:[00000030h] 15_2_045B002D
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045B002D mov eax, dword ptr fs:[00000030h] 15_2_045B002D
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045B002D mov eax, dword ptr fs:[00000030h] 15_2_045B002D
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045B002D mov eax, dword ptr fs:[00000030h] 15_2_045B002D
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045BBC2C mov eax, dword ptr fs:[00000030h] 15_2_045BBC2C
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04606CF0 mov eax, dword ptr fs:[00000030h] 15_2_04606CF0
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04606CF0 mov eax, dword ptr fs:[00000030h] 15_2_04606CF0
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04606CF0 mov eax, dword ptr fs:[00000030h] 15_2_04606CF0
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_046414FB mov eax, dword ptr fs:[00000030h] 15_2_046414FB
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0461B8D0 mov eax, dword ptr fs:[00000030h] 15_2_0461B8D0
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0461B8D0 mov ecx, dword ptr fs:[00000030h] 15_2_0461B8D0
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0461B8D0 mov eax, dword ptr fs:[00000030h] 15_2_0461B8D0
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0461B8D0 mov eax, dword ptr fs:[00000030h] 15_2_0461B8D0
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0461B8D0 mov eax, dword ptr fs:[00000030h] 15_2_0461B8D0
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0461B8D0 mov eax, dword ptr fs:[00000030h] 15_2_0461B8D0
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04658CD6 mov eax, dword ptr fs:[00000030h] 15_2_04658CD6
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045858EC mov eax, dword ptr fs:[00000030h] 15_2_045858EC
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0459849B mov eax, dword ptr fs:[00000030h] 15_2_0459849B
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04589080 mov eax, dword ptr fs:[00000030h] 15_2_04589080
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045BF0BF mov ecx, dword ptr fs:[00000030h] 15_2_045BF0BF
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045BF0BF mov eax, dword ptr fs:[00000030h] 15_2_045BF0BF
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045BF0BF mov eax, dword ptr fs:[00000030h] 15_2_045BF0BF
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04603884 mov eax, dword ptr fs:[00000030h] 15_2_04603884
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04603884 mov eax, dword ptr fs:[00000030h] 15_2_04603884
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045C90AF mov eax, dword ptr fs:[00000030h] 15_2_045C90AF
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045B20A0 mov eax, dword ptr fs:[00000030h] 15_2_045B20A0
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045B20A0 mov eax, dword ptr fs:[00000030h] 15_2_045B20A0
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045B20A0 mov eax, dword ptr fs:[00000030h] 15_2_045B20A0
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045B20A0 mov eax, dword ptr fs:[00000030h] 15_2_045B20A0
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045B20A0 mov eax, dword ptr fs:[00000030h] 15_2_045B20A0
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045B20A0 mov eax, dword ptr fs:[00000030h] 15_2_045B20A0
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045A7D50 mov eax, dword ptr fs:[00000030h] 15_2_045A7D50
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045AB944 mov eax, dword ptr fs:[00000030h] 15_2_045AB944
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045AB944 mov eax, dword ptr fs:[00000030h] 15_2_045AB944
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045C3D43 mov eax, dword ptr fs:[00000030h] 15_2_045C3D43
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04603540 mov eax, dword ptr fs:[00000030h] 15_2_04603540
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0458B171 mov eax, dword ptr fs:[00000030h] 15_2_0458B171
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0458B171 mov eax, dword ptr fs:[00000030h] 15_2_0458B171
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045AC577 mov eax, dword ptr fs:[00000030h] 15_2_045AC577
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045AC577 mov eax, dword ptr fs:[00000030h] 15_2_045AC577
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0458C962 mov eax, dword ptr fs:[00000030h] 15_2_0458C962
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04658D34 mov eax, dword ptr fs:[00000030h] 15_2_04658D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0460A537 mov eax, dword ptr fs:[00000030h] 15_2_0460A537
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04589100 mov eax, dword ptr fs:[00000030h] 15_2_04589100
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04589100 mov eax, dword ptr fs:[00000030h] 15_2_04589100
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04589100 mov eax, dword ptr fs:[00000030h] 15_2_04589100
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045B4D3B mov eax, dword ptr fs:[00000030h] 15_2_045B4D3B
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045B4D3B mov eax, dword ptr fs:[00000030h] 15_2_045B4D3B
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045B4D3B mov eax, dword ptr fs:[00000030h] 15_2_045B4D3B
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045B513A mov eax, dword ptr fs:[00000030h] 15_2_045B513A
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045B513A mov eax, dword ptr fs:[00000030h] 15_2_045B513A
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0458AD30 mov eax, dword ptr fs:[00000030h] 15_2_0458AD30
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04593D34 mov eax, dword ptr fs:[00000030h] 15_2_04593D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04593D34 mov eax, dword ptr fs:[00000030h] 15_2_04593D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04593D34 mov eax, dword ptr fs:[00000030h] 15_2_04593D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04593D34 mov eax, dword ptr fs:[00000030h] 15_2_04593D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04593D34 mov eax, dword ptr fs:[00000030h] 15_2_04593D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04593D34 mov eax, dword ptr fs:[00000030h] 15_2_04593D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04593D34 mov eax, dword ptr fs:[00000030h] 15_2_04593D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04593D34 mov eax, dword ptr fs:[00000030h] 15_2_04593D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04593D34 mov eax, dword ptr fs:[00000030h] 15_2_04593D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04593D34 mov eax, dword ptr fs:[00000030h] 15_2_04593D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04593D34 mov eax, dword ptr fs:[00000030h] 15_2_04593D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04593D34 mov eax, dword ptr fs:[00000030h] 15_2_04593D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04593D34 mov eax, dword ptr fs:[00000030h] 15_2_04593D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045A4120 mov eax, dword ptr fs:[00000030h] 15_2_045A4120
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045A4120 mov eax, dword ptr fs:[00000030h] 15_2_045A4120
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045A4120 mov eax, dword ptr fs:[00000030h] 15_2_045A4120
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045A4120 mov eax, dword ptr fs:[00000030h] 15_2_045A4120
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045A4120 mov ecx, dword ptr fs:[00000030h] 15_2_045A4120
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_046141E8 mov eax, dword ptr fs:[00000030h] 15_2_046141E8
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04638DF1 mov eax, dword ptr fs:[00000030h] 15_2_04638DF1
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04606DC9 mov eax, dword ptr fs:[00000030h] 15_2_04606DC9
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04606DC9 mov eax, dword ptr fs:[00000030h] 15_2_04606DC9
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04606DC9 mov eax, dword ptr fs:[00000030h] 15_2_04606DC9
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04606DC9 mov ecx, dword ptr fs:[00000030h] 15_2_04606DC9
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04606DC9 mov eax, dword ptr fs:[00000030h] 15_2_04606DC9
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04606DC9 mov eax, dword ptr fs:[00000030h] 15_2_04606DC9
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0458B1E1 mov eax, dword ptr fs:[00000030h] 15_2_0458B1E1
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0458B1E1 mov eax, dword ptr fs:[00000030h] 15_2_0458B1E1
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0458B1E1 mov eax, dword ptr fs:[00000030h] 15_2_0458B1E1
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0459D5E0 mov eax, dword ptr fs:[00000030h] 15_2_0459D5E0
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0459D5E0 mov eax, dword ptr fs:[00000030h] 15_2_0459D5E0
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045BFD9B mov eax, dword ptr fs:[00000030h] 15_2_045BFD9B
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045BFD9B mov eax, dword ptr fs:[00000030h] 15_2_045BFD9B
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_046069A6 mov eax, dword ptr fs:[00000030h] 15_2_046069A6
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_046505AC mov eax, dword ptr fs:[00000030h] 15_2_046505AC
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_046505AC mov eax, dword ptr fs:[00000030h] 15_2_046505AC
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045B2990 mov eax, dword ptr fs:[00000030h] 15_2_045B2990
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04582D8A mov eax, dword ptr fs:[00000030h] 15_2_04582D8A
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04582D8A mov eax, dword ptr fs:[00000030h] 15_2_04582D8A
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04582D8A mov eax, dword ptr fs:[00000030h] 15_2_04582D8A
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04582D8A mov eax, dword ptr fs:[00000030h] 15_2_04582D8A
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04582D8A mov eax, dword ptr fs:[00000030h] 15_2_04582D8A
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045AC182 mov eax, dword ptr fs:[00000030h] 15_2_045AC182
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045B2581 mov eax, dword ptr fs:[00000030h] 15_2_045B2581
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045B2581 mov eax, dword ptr fs:[00000030h] 15_2_045B2581
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045B2581 mov eax, dword ptr fs:[00000030h] 15_2_045B2581
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045B2581 mov eax, dword ptr fs:[00000030h] 15_2_045B2581
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045BA185 mov eax, dword ptr fs:[00000030h] 15_2_045BA185
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_046051BE mov eax, dword ptr fs:[00000030h] 15_2_046051BE
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_046051BE mov eax, dword ptr fs:[00000030h] 15_2_046051BE
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_046051BE mov eax, dword ptr fs:[00000030h] 15_2_046051BE
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_046051BE mov eax, dword ptr fs:[00000030h] 15_2_046051BE
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045B1DB5 mov eax, dword ptr fs:[00000030h] 15_2_045B1DB5
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045B1DB5 mov eax, dword ptr fs:[00000030h] 15_2_045B1DB5
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045B1DB5 mov eax, dword ptr fs:[00000030h] 15_2_045B1DB5
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045B35A1 mov eax, dword ptr fs:[00000030h] 15_2_045B35A1
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045B61A0 mov eax, dword ptr fs:[00000030h] 15_2_045B61A0
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045B61A0 mov eax, dword ptr fs:[00000030h] 15_2_045B61A0
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0463B260 mov eax, dword ptr fs:[00000030h] 15_2_0463B260
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0463B260 mov eax, dword ptr fs:[00000030h] 15_2_0463B260
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04658A62 mov eax, dword ptr fs:[00000030h] 15_2_04658A62
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04589240 mov eax, dword ptr fs:[00000030h] 15_2_04589240
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04589240 mov eax, dword ptr fs:[00000030h] 15_2_04589240
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04589240 mov eax, dword ptr fs:[00000030h] 15_2_04589240
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04589240 mov eax, dword ptr fs:[00000030h] 15_2_04589240
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04597E41 mov eax, dword ptr fs:[00000030h] 15_2_04597E41
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04597E41 mov eax, dword ptr fs:[00000030h] 15_2_04597E41
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04597E41 mov eax, dword ptr fs:[00000030h] 15_2_04597E41
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04597E41 mov eax, dword ptr fs:[00000030h] 15_2_04597E41
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04597E41 mov eax, dword ptr fs:[00000030h] 15_2_04597E41
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04597E41 mov eax, dword ptr fs:[00000030h] 15_2_04597E41
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045C927A mov eax, dword ptr fs:[00000030h] 15_2_045C927A
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045AAE73 mov eax, dword ptr fs:[00000030h] 15_2_045AAE73
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045AAE73 mov eax, dword ptr fs:[00000030h] 15_2_045AAE73
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045AAE73 mov eax, dword ptr fs:[00000030h] 15_2_045AAE73
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045AAE73 mov eax, dword ptr fs:[00000030h] 15_2_045AAE73
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045AAE73 mov eax, dword ptr fs:[00000030h] 15_2_045AAE73
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0459766D mov eax, dword ptr fs:[00000030h] 15_2_0459766D
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04614257 mov eax, dword ptr fs:[00000030h] 15_2_04614257
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045A3A1C mov eax, dword ptr fs:[00000030h] 15_2_045A3A1C
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045BA61C mov eax, dword ptr fs:[00000030h] 15_2_045BA61C
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045BA61C mov eax, dword ptr fs:[00000030h] 15_2_045BA61C
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04585210 mov eax, dword ptr fs:[00000030h] 15_2_04585210
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04585210 mov ecx, dword ptr fs:[00000030h] 15_2_04585210
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04585210 mov eax, dword ptr fs:[00000030h] 15_2_04585210
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04585210 mov eax, dword ptr fs:[00000030h] 15_2_04585210
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0458AA16 mov eax, dword ptr fs:[00000030h] 15_2_0458AA16
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0458AA16 mov eax, dword ptr fs:[00000030h] 15_2_0458AA16
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04598A0A mov eax, dword ptr fs:[00000030h] 15_2_04598A0A
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0458C600 mov eax, dword ptr fs:[00000030h] 15_2_0458C600
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0458C600 mov eax, dword ptr fs:[00000030h] 15_2_0458C600
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0458C600 mov eax, dword ptr fs:[00000030h] 15_2_0458C600
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045B8E00 mov eax, dword ptr fs:[00000030h] 15_2_045B8E00
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0463FE3F mov eax, dword ptr fs:[00000030h] 15_2_0463FE3F
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04641608 mov eax, dword ptr fs:[00000030h] 15_2_04641608
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045C4A2C mov eax, dword ptr fs:[00000030h] 15_2_045C4A2C
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045C4A2C mov eax, dword ptr fs:[00000030h] 15_2_045C4A2C
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0458E620 mov eax, dword ptr fs:[00000030h] 15_2_0458E620
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045B2ACB mov eax, dword ptr fs:[00000030h] 15_2_045B2ACB
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045B36CC mov eax, dword ptr fs:[00000030h] 15_2_045B36CC
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045C8EC7 mov eax, dword ptr fs:[00000030h] 15_2_045C8EC7
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0463FEC0 mov eax, dword ptr fs:[00000030h] 15_2_0463FEC0
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04658ED6 mov eax, dword ptr fs:[00000030h] 15_2_04658ED6
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045B16E0 mov ecx, dword ptr fs:[00000030h] 15_2_045B16E0
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045976E2 mov eax, dword ptr fs:[00000030h] 15_2_045976E2
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045B2AE4 mov eax, dword ptr fs:[00000030h] 15_2_045B2AE4
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04650EA5 mov eax, dword ptr fs:[00000030h] 15_2_04650EA5
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04650EA5 mov eax, dword ptr fs:[00000030h] 15_2_04650EA5
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04650EA5 mov eax, dword ptr fs:[00000030h] 15_2_04650EA5
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_046046A7 mov eax, dword ptr fs:[00000030h] 15_2_046046A7
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045BD294 mov eax, dword ptr fs:[00000030h] 15_2_045BD294
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045BD294 mov eax, dword ptr fs:[00000030h] 15_2_045BD294
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0461FE87 mov eax, dword ptr fs:[00000030h] 15_2_0461FE87
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0459AAB0 mov eax, dword ptr fs:[00000030h] 15_2_0459AAB0
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0459AAB0 mov eax, dword ptr fs:[00000030h] 15_2_0459AAB0
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045BFAB0 mov eax, dword ptr fs:[00000030h] 15_2_045BFAB0
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045852A5 mov eax, dword ptr fs:[00000030h] 15_2_045852A5
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045852A5 mov eax, dword ptr fs:[00000030h] 15_2_045852A5
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045852A5 mov eax, dword ptr fs:[00000030h] 15_2_045852A5
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045852A5 mov eax, dword ptr fs:[00000030h] 15_2_045852A5
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045852A5 mov eax, dword ptr fs:[00000030h] 15_2_045852A5
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0458F358 mov eax, dword ptr fs:[00000030h] 15_2_0458F358
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04658F6A mov eax, dword ptr fs:[00000030h] 15_2_04658F6A
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0458DB40 mov eax, dword ptr fs:[00000030h] 15_2_0458DB40
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0459EF40 mov eax, dword ptr fs:[00000030h] 15_2_0459EF40
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045B3B7A mov eax, dword ptr fs:[00000030h] 15_2_045B3B7A
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045B3B7A mov eax, dword ptr fs:[00000030h] 15_2_045B3B7A
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0458DB60 mov ecx, dword ptr fs:[00000030h] 15_2_0458DB60
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0459FF60 mov eax, dword ptr fs:[00000030h] 15_2_0459FF60
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04658B58 mov eax, dword ptr fs:[00000030h] 15_2_04658B58
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045AF716 mov eax, dword ptr fs:[00000030h] 15_2_045AF716
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045BA70E mov eax, dword ptr fs:[00000030h] 15_2_045BA70E
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045BA70E mov eax, dword ptr fs:[00000030h] 15_2_045BA70E
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0465070D mov eax, dword ptr fs:[00000030h] 15_2_0465070D
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0465070D mov eax, dword ptr fs:[00000030h] 15_2_0465070D
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045BE730 mov eax, dword ptr fs:[00000030h] 15_2_045BE730
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0461FF10 mov eax, dword ptr fs:[00000030h] 15_2_0461FF10
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0461FF10 mov eax, dword ptr fs:[00000030h] 15_2_0461FF10
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04584F2E mov eax, dword ptr fs:[00000030h] 15_2_04584F2E
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04584F2E mov eax, dword ptr fs:[00000030h] 15_2_04584F2E
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_0464131B mov eax, dword ptr fs:[00000030h] 15_2_0464131B
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045C37F5 mov eax, dword ptr fs:[00000030h] 15_2_045C37F5
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_046053CA mov eax, dword ptr fs:[00000030h] 15_2_046053CA
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_046053CA mov eax, dword ptr fs:[00000030h] 15_2_046053CA
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045ADBE9 mov eax, dword ptr fs:[00000030h] 15_2_045ADBE9
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045B03E2 mov eax, dword ptr fs:[00000030h] 15_2_045B03E2
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045B03E2 mov eax, dword ptr fs:[00000030h] 15_2_045B03E2
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045B03E2 mov eax, dword ptr fs:[00000030h] 15_2_045B03E2
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045B03E2 mov eax, dword ptr fs:[00000030h] 15_2_045B03E2
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045B03E2 mov eax, dword ptr fs:[00000030h] 15_2_045B03E2
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045B03E2 mov eax, dword ptr fs:[00000030h] 15_2_045B03E2
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04655BA5 mov eax, dword ptr fs:[00000030h] 15_2_04655BA5
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045BB390 mov eax, dword ptr fs:[00000030h] 15_2_045BB390
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_045B2397 mov eax, dword ptr fs:[00000030h] 15_2_045B2397
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04598794 mov eax, dword ptr fs:[00000030h] 15_2_04598794
Source: C:\Windows\SysWOW64\systray.exe Code function: 15_2_04591B8F mov eax, dword ptr fs:[00000030h] 15_2_04591B8F
Checks if the current process is being debugged
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 7_2_0040ACD0 LdrLoadDll, 7_2_0040ACD0
Source: C:\Users\user\Desktop\Quote#56432.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 44.227.76.166 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.lovecord.date
Source: C:\Windows\explorer.exe Domain query: www.neuralviolin.com
Sample uses process hollowing technique
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Section unmapped: C:\Windows\SysWOW64\systray.exe base address: C70000 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Section loaded: unknown target: C:\Windows\SysWOW64\systray.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Section loaded: unknown target: C:\Windows\SysWOW64\systray.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\Desktop\Quote#56432.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 401000 Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 119C008 Jump to behavior
Allocates memory in foreign processes
Source: C:\Users\user\Desktop\Quote#56432.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 protect: page execute and read and write Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\Quote#56432.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread register set: target process: 3424 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread register set: target process: 3424 Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe Thread register set: target process: 3424 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Quote#56432.exe Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ySWmXEgh' /XML 'C:\Users\user\AppData\Local\Temp\tmp994F.tmp' Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process created: C:\Windows\SysWOW64\systray.exe C:\Windows\SysWOW64\systray.exe Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe' Jump to behavior
Source: explorer.exe, 00000008.00000000.692962525.0000000000AD8000.00000004.00000020.sdmp Binary or memory string: ProgmanMD6
Source: explorer.exe, 00000008.00000000.727726063.0000000001080000.00000002.00020000.sdmp, systray.exe, 0000000F.00000002.926284343.0000000002E10000.00000002.00020000.sdmp Binary or memory string: Program Manager
Source: explorer.exe, 00000008.00000000.727726063.0000000001080000.00000002.00020000.sdmp, systray.exe, 0000000F.00000002.926284343.0000000002E10000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000008.00000000.727726063.0000000001080000.00000002.00020000.sdmp, systray.exe, 0000000F.00000002.926284343.0000000002E10000.00000002.00020000.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000008.00000000.727726063.0000000001080000.00000002.00020000.sdmp, systray.exe, 0000000F.00000002.926284343.0000000002E10000.00000002.00020000.sdmp Binary or memory string: Progmanlock
Source: explorer.exe, 00000008.00000000.717907917.000000000A716000.00000004.00000001.sdmp Binary or memory string: Shell_TrayWnd5D

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Users\user\Desktop\Quote#56432.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quote#56432.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 7.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000F.00000002.925308127.0000000000360000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.781503558.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.690946204.0000000003C70000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000000.738249263.000000000E47D000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.925553519.0000000000B00000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.925610906.0000000000B30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.782221543.0000000001490000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.690791851.0000000003B59000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.782183245.0000000001460000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000000.720837328.000000000E47D000.00000040.00020000.sdmp, type: MEMORY

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 7.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000F.00000002.925308127.0000000000360000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.781503558.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.690946204.0000000003C70000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000000.738249263.000000000E47D000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.925553519.0000000000B00000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.925610906.0000000000B30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.782221543.0000000001490000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.690791851.0000000003B59000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.782183245.0000000001460000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000000.720837328.000000000E47D000.00000040.00020000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 483794 Sample: Quote#56432.exe Startdate: 15/09/2021 Architecture: WINDOWS Score: 100 42 Found malware configuration 2->42 44 Malicious sample detected (through community Yara rule) 2->44 46 Multi AV Scanner detection for dropped file 2->46 48 11 other signatures 2->48 9 Quote#56432.exe 7 2->9         started        process3 file4 30 C:\Users\user\AppData\Roaming\ySWmXEgh.exe, PE32 9->30 dropped 32 C:\Users\...\ySWmXEgh.exe:Zone.Identifier, ASCII 9->32 dropped 34 C:\Users\user\AppData\Local\...\tmp994F.tmp, XML 9->34 dropped 36 C:\Users\user\AppData\...\Quote#56432.exe.log, ASCII 9->36 dropped 58 Uses schtasks.exe or at.exe to add and modify task schedules 9->58 60 Writes to foreign memory regions 9->60 62 Allocates memory in foreign processes 9->62 64 Injects a PE file into a foreign processes 9->64 13 RegSvcs.exe 9->13         started        16 schtasks.exe 1 9->16         started        signatures5 process6 signatures7 66 Modifies the context of a thread in another process (thread injection) 13->66 68 Maps a DLL or memory area into another process 13->68 70 Sample uses process hollowing technique 13->70 72 2 other signatures 13->72 18 systray.exe 13->18         started        21 explorer.exe 13->21 injected 24 conhost.exe 16->24         started        process8 dnsIp9 50 Modifies the context of a thread in another process (thread injection) 18->50 52 Maps a DLL or memory area into another process 18->52 54 Tries to detect virtualization through RDTSC time measurements 18->54 26 cmd.exe 1 18->26         started        38 www.lovecord.date 44.227.76.166, 49841, 80 AMAZON-02US United States 21->38 40 www.neuralviolin.com 21->40 56 System process connects to network (likely due to code injection or exploit) 21->56 signatures10 process11 process12 28 conhost.exe 26->28         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
44.227.76.166
 www.lovecord.date United States
16509 AMAZON-02US true

Contacted Domains

Name IP Active
www.lovecord.date 44.227.76.166 true
www.neuralviolin.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
www.constructioncleanup.pro/vd9n/ true
  • Avira URL Cloud: safe
 low
http://www.lovecord.date/vd9n/?NfB=6+C1z2NTXQU5TtDgYCNVveFhDHAhXY7UdOammGZxKywecd1Rk4eK0uo6Q7X2XlF/f8Go&o87p=d640H6WhXv9 true
  • Avira URL Cloud: safe
 unknown