Windows Analysis Report Factura de proforma.exe

Overview

General Information

Sample Name: Factura de proforma.exe
Analysis ID: 502357
MD5: 16f7045eebb451234ca8078222c5994c
SHA1: 99e8f263f9e34ad13cb8cd6af1bb816deffb5bde
SHA256: ff344e635b268090aafdb8fa830e76c41f34d7cf9a9bf03ed4ede2705008bfef
Tags: ESPexegeo
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Yara detected AntiVM3
System process connects to network (likely due to code injection or exploit)
Sample uses process hollowing technique
Maps a DLL or memory area into another process
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Performs DNS queries to domains with low reputation
Modifies the prolog of user mode functions (user mode inline hooks)
.NET source code contains potential unpacker
Queues an APC in another process (thread injection)
Tries to detect virtualization through RDTSC time measurements
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Uses schtasks.exe or at.exe to add and modify task schedules
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to call native functions
HTTP GET or POST without a user agent
Contains functionality for execution timing, often used to detect debuggers
Contains long sleeps (>= 3 min)
Found inlined nop instructions (likely shell or obfuscated code)
Sample file is different than original file name gathered from version info
PE file contains strange resources
Drops PE files
Contains functionality to read the PEB
Checks if the current process is being debugged
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection:

barindex
Found malware configuration
Source: 00000000.00000002.322614171.0000000003B89000.00000004.00000001.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.thefanlounge.com/cb3b/"], "decoy": ["listenlocker.com", "jumpstartnotarybiz.com", "new-post-vehicle-site.xyz", "summon-entertainment.com", "johnandtracy-adopt.com", "bferety.info", "palmonlae.space", "yx1889.com", "janetnaufranck.com", "banditanalytics.com", "agenciahologram.com", "artemojo.com", "goldensuninn.com", "aminobalm.com", "customersme.com", "techcareerschool.com", "angelahuckeby.com", "smoothcontract.com", "kartsorgumerkezi.com", "houstonhemorrhoidclinic.com", "istanbuloz.com", "buyrealestatewithcarlos.com", "onlinelivehds.xyz", "outstandingearth.com", "cyclingsunglassestop.com", "haras-dors.com", "zhuanyekf.com", "pps-squad.com", "highlovely.com", "hudsonvalleymomandpopshop.com", "graytielaw.com", "orang-gilakali.com", "sajaasboutique.com", "nwomakrom.com", "mobilne-kucice.com", "instant-geek.com", "brewinginthenameof.com", "shopstel.net", "alumaber.com", "fernoost.info", "expandablepocketdeals.com", "ritelard.net", "elderyochanan.com", "gofante.online", "americansforbrazil.com", "condosofcolor.com", "the2gaku.com", "mesegeka.com", "democratsforesteban.com", "vinoporfavor.com", "xwaxxc1.com", "jinhongtextile.com", "festival-du-chanvre.com", "abrasivburada.com", "pinhoti.net", "nestd.online", "fendlercart.com", "unanox.com", "boyscout-site.com", "wlctrade.com", "gudesigns.net", "jandmisia.com", "funnyp0sts.com", "laveudelamare.com"]}
Yara detected FormBook
Source: Yara match File source: 6.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Factura de proforma.exe.3cc0560.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Factura de proforma.exe.3d0ff80.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000002.402637395.0000000001500000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000000.357102552.0000000010B69000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.322614171.0000000003B89000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.570999919.0000000000540000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.401884612.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.402727602.0000000001530000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.571846259.0000000002990000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.571574263.00000000025D0000.00000040.00020000.sdmp, type: MEMORY
Antivirus or Machine Learning detection for unpacked file
Source: 6.2.RegSvcs.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

barindex
Uses 32bit PE files
Source: Factura de proforma.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: Factura de proforma.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: cscript.pdbUGP source: RegSvcs.exe, 00000006.00000002.406155784.00000000036A0000.00000040.00020000.sdmp
Source: Binary string: RegSvcs.pdb, source: cscript.exe, 0000000A.00000002.573045416.0000000004CEF000.00000004.00020000.sdmp
Source: Binary string: wntdll.pdbUGP source: RegSvcs.exe, 00000006.00000002.402914826.00000000015C0000.00000040.00000001.sdmp, cscript.exe, 0000000A.00000002.572701700.00000000048DF000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: RegSvcs.exe, cscript.exe
Source: Binary string: RegSvcs.pdb source: cscript.exe, 0000000A.00000002.573045416.0000000004CEF000.00000004.00020000.sdmp
Source: Binary string: cscript.pdb source: RegSvcs.exe, 00000006.00000002.406155784.00000000036A0000.00000040.00020000.sdmp

Software Vulnerabilities:

barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4x nop then pop edi 6_2_00416CEC

Networking:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.aminobalm.com
Source: C:\Windows\explorer.exe Domain query: www.palmonlae.space
Source: C:\Windows\explorer.exe Network Connect: 13.209.99.177 80 Jump to behavior
Performs DNS queries to domains with low reputation
Source: DNS query: www.new-post-vehicle-site.xyz
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.thefanlounge.com/cb3b/
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: AMAZON-02US AMAZON-02US
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /cb3b/?c6=kr386M7znJup/B2j4KhdpwCgkxfUSLFq19BV4h8BDsMel0JC//DVwypubzBUvp11Q9BD&A0DXb=eZk4rh9h HTTP/1.1Host: www.aminobalm.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: Factura de proforma.exe, 00000000.00000003.299841120.0000000000D0D000.00000004.00000001.sdmp String found in binary or memory: http://en.w
Source: Factura de proforma.exe, 00000000.00000003.301130424.0000000005AEB000.00000004.00000001.sdmp, Factura de proforma.exe, 00000000.00000002.323967791.0000000006CE2000.00000004.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: Factura de proforma.exe, 00000000.00000002.322371267.0000000002B81000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Factura de proforma.exe, 00000000.00000002.323967791.0000000006CE2000.00000004.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Factura de proforma.exe, 00000000.00000002.323967791.0000000006CE2000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: Factura de proforma.exe, 00000000.00000002.322371267.0000000002B81000.00000004.00000001.sdmp String found in binary or memory: http://www.collada.org/2005/11/COLLADASchema9Done
Source: Factura de proforma.exe, 00000000.00000002.323967791.0000000006CE2000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com
Source: Factura de proforma.exe, 00000000.00000002.323967791.0000000006CE2000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: Factura de proforma.exe, 00000000.00000002.323967791.0000000006CE2000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Factura de proforma.exe, 00000000.00000002.323967791.0000000006CE2000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Factura de proforma.exe, 00000000.00000002.323967791.0000000006CE2000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: Factura de proforma.exe, 00000000.00000003.307837879.0000000005ADD000.00000004.00000001.sdmp, Factura de proforma.exe, 00000000.00000002.323967791.0000000006CE2000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: Factura de proforma.exe, 00000000.00000002.323967791.0000000006CE2000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: Factura de proforma.exe, 00000000.00000002.323967791.0000000006CE2000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: Factura de proforma.exe, 00000000.00000003.307837879.0000000005ADD000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designerskSHU
Source: Factura de proforma.exe, 00000000.00000003.300605422.0000000005AEB000.00000004.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: Factura de proforma.exe, 00000000.00000003.300605422.0000000005AEB000.00000004.00000001.sdmp String found in binary or memory: http://www.fonts.com-uT
Source: Factura de proforma.exe, 00000000.00000003.300605422.0000000005AEB000.00000004.00000001.sdmp String found in binary or memory: http://www.fonts.comc
Source: Factura de proforma.exe, 00000000.00000003.300605422.0000000005AEB000.00000004.00000001.sdmp String found in binary or memory: http://www.fonts.comn
Source: Factura de proforma.exe, 00000000.00000003.304081072.0000000005AD4000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: Factura de proforma.exe, 00000000.00000003.304064871.0000000005B0D000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn.U
Source: Factura de proforma.exe, 00000000.00000002.323967791.0000000006CE2000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Factura de proforma.exe, 00000000.00000002.323967791.0000000006CE2000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Factura de proforma.exe, 00000000.00000003.304064871.0000000005B0D000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn2U%
Source: Factura de proforma.exe, 00000000.00000002.323967791.0000000006CE2000.00000004.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Factura de proforma.exe, 00000000.00000002.323967791.0000000006CE2000.00000004.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Factura de proforma.exe, 00000000.00000002.323967791.0000000006CE2000.00000004.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: Factura de proforma.exe, 00000000.00000002.323967791.0000000006CE2000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Factura de proforma.exe, 00000000.00000003.305305956.0000000005AD4000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/7D
Source: Factura de proforma.exe, 00000000.00000003.305305956.0000000005AD4000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/JD
Source: Factura de proforma.exe, 00000000.00000003.305305956.0000000005AD4000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/XDiUa
Source: Factura de proforma.exe, 00000000.00000003.305305956.0000000005AD4000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/a-eoDFU$
Source: Factura de proforma.exe, 00000000.00000003.305305956.0000000005AD4000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: Factura de proforma.exe, 00000000.00000003.305305956.0000000005AD4000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/ko
Source: Factura de proforma.exe, 00000000.00000003.305305956.0000000005AD4000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/t
Source: Factura de proforma.exe, 00000000.00000003.305305956.0000000005AD4000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/tDMU
Source: Factura de proforma.exe, 00000000.00000003.300417307.0000000005AEB000.00000004.00000001.sdmp, Factura de proforma.exe, 00000000.00000002.323967791.0000000006CE2000.00000004.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: Factura de proforma.exe, 00000000.00000002.323967791.0000000006CE2000.00000004.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: Factura de proforma.exe, 00000000.00000002.323967791.0000000006CE2000.00000004.00000001.sdmp, Factura de proforma.exe, 00000000.00000003.303541923.0000000005AD9000.00000004.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: Factura de proforma.exe, 00000000.00000003.303541923.0000000005AD9000.00000004.00000001.sdmp String found in binary or memory: http://www.sandoll.co.krN.TTFs
Source: Factura de proforma.exe, 00000000.00000002.323967791.0000000006CE2000.00000004.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: Factura de proforma.exe, 00000000.00000003.301130424.0000000005AEB000.00000004.00000001.sdmp String found in binary or memory: http://www.tiro.comF
Source: Factura de proforma.exe, 00000000.00000002.323967791.0000000006CE2000.00000004.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: Factura de proforma.exe, 00000000.00000002.323967791.0000000006CE2000.00000004.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: Factura de proforma.exe, 00000000.00000002.323967791.0000000006CE2000.00000004.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: cscript.exe, 0000000A.00000002.573092724.00000000051DF000.00000004.00020000.sdmp String found in binary or memory: https://www.dotname.co.kr/customer/event/2019/20190604_landing_dotname?c6=kr386M7znJup/B2j4KhdpwCgkx
Source: unknown DNS traffic detected: queries for: www.palmonlae.space
Source: global traffic HTTP traffic detected: GET /cb3b/?c6=kr386M7znJup/B2j4KhdpwCgkxfUSLFq19BV4h8BDsMel0JC//DVwypubzBUvp11Q9BD&A0DXb=eZk4rh9h HTTP/1.1Host: www.aminobalm.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 6.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Factura de proforma.exe.3cc0560.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Factura de proforma.exe.3d0ff80.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000002.402637395.0000000001500000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000000.357102552.0000000010B69000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.322614171.0000000003B89000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.570999919.0000000000540000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.401884612.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.402727602.0000000001530000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.571846259.0000000002990000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.571574263.00000000025D0000.00000040.00020000.sdmp, type: MEMORY

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 6.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.Factura de proforma.exe.3cc0560.3.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.Factura de proforma.exe.3cc0560.3.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 6.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.Factura de proforma.exe.3d0ff80.2.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.Factura de proforma.exe.3d0ff80.2.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.402637395.0000000001500000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.402637395.0000000001500000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000000.357102552.0000000010B69000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000000.357102552.0000000010B69000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.322614171.0000000003B89000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.322614171.0000000003B89000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000002.570999919.0000000000540000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.570999919.0000000000540000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.401884612.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.401884612.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.402727602.0000000001530000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.402727602.0000000001530000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000002.571846259.0000000002990000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.571846259.0000000002990000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000002.571574263.00000000025D0000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.571574263.00000000025D0000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Uses 32bit PE files
Source: Factura de proforma.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Yara signature match
Source: 6.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.Factura de proforma.exe.3cc0560.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.Factura de proforma.exe.3cc0560.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 6.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.Factura de proforma.exe.3d0ff80.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.Factura de proforma.exe.3d0ff80.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.402637395.0000000001500000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.402637395.0000000001500000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000000.357102552.0000000010B69000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000000.357102552.0000000010B69000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.322614171.0000000003B89000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.322614171.0000000003B89000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000002.570999919.0000000000540000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.570999919.0000000000540000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.401884612.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.401884612.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.402727602.0000000001530000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.402727602.0000000001530000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000002.571846259.0000000002990000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.571846259.0000000002990000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000002.571574263.00000000025D0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.571574263.00000000025D0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Detected potential crypto function
Source: C:\Users\user\Desktop\Factura de proforma.exe Code function: 0_2_0296F298 0_2_0296F298
Source: C:\Users\user\Desktop\Factura de proforma.exe Code function: 0_2_0296F288 0_2_0296F288
Source: C:\Users\user\Desktop\Factura de proforma.exe Code function: 0_2_0296D064 0_2_0296D064
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0041F04E 6_2_0041F04E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0041E872 6_2_0041E872
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_00401030 6_2_00401030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0041D97A 6_2_0041D97A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0041EBDA 6_2_0041EBDA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0041E3A3 6_2_0041E3A3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0041E437 6_2_0041E437
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_00402D90 6_2_00402D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_00409E60 6_2_00409E60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_00409E1A 6_2_00409E1A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0041D72A 6_2_0041D72A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0041EF37 6_2_0041EF37
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_00402FB0 6_2_00402FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01604120 6_2_01604120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015EF900 6_2_015EF900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016A1002 6_2_016A1002
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016120A0 6_2_016120A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016B20A8 6_2_016B20A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015FB090 6_2_015FB090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016B2B28 6_2_016B2B28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0161EBB0 6_2_0161EBB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016B22AE 6_2_016B22AE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016B1D55 6_2_016B1D55
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016B2D07 6_2_016B2D07
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015E0D20 6_2_015E0D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015FD5E0 6_2_015FD5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01612581 6_2_01612581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015F841F 6_2_015F841F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016B1FF1 6_2_016B1FF1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01606E30 6_2_01606E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016B2EF7 6_2_016B2EF7
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047F841F 10_2_047F841F
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048A1002 10_2_048A1002
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047FB090 10_2_047FB090
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047E0D20 10_2_047E0D20
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047EF900 10_2_047EF900
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047FD5E0 10_2_047FD5E0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04804120 10_2_04804120
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048B1D55 10_2_048B1D55
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04806E30 10_2_04806E30
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0481EBB0 10_2_0481EBB0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_029AE872 10_2_029AE872
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_02999E1A 10_2_02999E1A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_02999E60 10_2_02999E60
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_02992FB0 10_2_02992FB0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_029AD72A 10_2_029AD72A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_02992D90 10_2_02992D90
Found potential string decryption / allocating functions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: String function: 015EB150 appears 35 times
Source: C:\Windows\SysWOW64\cscript.exe Code function: String function: 047EB150 appears 32 times
Contains functionality to call native functions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0041A360 NtCreateFile, 6_2_0041A360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0041A410 NtReadFile, 6_2_0041A410
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0041A490 NtClose, 6_2_0041A490
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0041A540 NtAllocateVirtualMemory, 6_2_0041A540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0041A35A NtCreateFile, 6_2_0041A35A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0041A53A NtAllocateVirtualMemory, 6_2_0041A53A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01629910 NtAdjustPrivilegesToken,LdrInitializeThunk, 6_2_01629910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016299A0 NtCreateSection,LdrInitializeThunk, 6_2_016299A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01629860 NtQuerySystemInformation,LdrInitializeThunk, 6_2_01629860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01629840 NtDelayExecution,LdrInitializeThunk, 6_2_01629840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016298F0 NtReadVirtualMemory,LdrInitializeThunk, 6_2_016298F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01629A50 NtCreateFile,LdrInitializeThunk, 6_2_01629A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01629A20 NtResumeThread,LdrInitializeThunk, 6_2_01629A20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01629A00 NtProtectVirtualMemory,LdrInitializeThunk, 6_2_01629A00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01629540 NtReadFile,LdrInitializeThunk, 6_2_01629540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016295D0 NtClose,LdrInitializeThunk, 6_2_016295D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01629710 NtQueryInformationToken,LdrInitializeThunk, 6_2_01629710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016297A0 NtUnmapViewOfSection,LdrInitializeThunk, 6_2_016297A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01629780 NtMapViewOfSection,LdrInitializeThunk, 6_2_01629780
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01629660 NtAllocateVirtualMemory,LdrInitializeThunk, 6_2_01629660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016296E0 NtFreeVirtualMemory,LdrInitializeThunk, 6_2_016296E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01629950 NtQueueApcThread, 6_2_01629950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016299D0 NtCreateProcessEx, 6_2_016299D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0162B040 NtSuspendThread, 6_2_0162B040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01629820 NtEnumerateKey, 6_2_01629820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016298A0 NtWriteVirtualMemory, 6_2_016298A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01629B00 NtSetValueKey, 6_2_01629B00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0162A3B0 NtGetContextThread, 6_2_0162A3B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01629A10 NtQuerySection, 6_2_01629A10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01629A80 NtOpenDirectoryObject, 6_2_01629A80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01629560 NtWriteFile, 6_2_01629560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01629520 NtWaitForSingleObject, 6_2_01629520
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0162AD30 NtSetContextThread, 6_2_0162AD30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016295F0 NtQueryInformationFile, 6_2_016295F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01629760 NtOpenProcess, 6_2_01629760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01629770 NtSetInformationFile, 6_2_01629770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0162A770 NtOpenThread, 6_2_0162A770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01629730 NtQueryVirtualMemory, 6_2_01629730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0162A710 NtOpenProcessToken, 6_2_0162A710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01629FE0 NtCreateMutant, 6_2_01629FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01629670 NtQueryInformationProcess, 6_2_01629670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01629650 NtQueryValueKey, 6_2_01629650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01629610 NtEnumerateValueKey, 6_2_01629610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016296D0 NtCreateKey, 6_2_016296D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04829840 NtDelayExecution,LdrInitializeThunk, 10_2_04829840
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04829860 NtQuerySystemInformation,LdrInitializeThunk, 10_2_04829860
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048299A0 NtCreateSection,LdrInitializeThunk, 10_2_048299A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048295D0 NtClose,LdrInitializeThunk, 10_2_048295D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04829910 NtAdjustPrivilegesToken,LdrInitializeThunk, 10_2_04829910
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04829540 NtReadFile,LdrInitializeThunk, 10_2_04829540
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048296D0 NtCreateKey,LdrInitializeThunk, 10_2_048296D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048296E0 NtFreeVirtualMemory,LdrInitializeThunk, 10_2_048296E0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04829650 NtQueryValueKey,LdrInitializeThunk, 10_2_04829650
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04829A50 NtCreateFile,LdrInitializeThunk, 10_2_04829A50
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04829660 NtAllocateVirtualMemory,LdrInitializeThunk, 10_2_04829660
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04829780 NtMapViewOfSection,LdrInitializeThunk, 10_2_04829780
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04829FE0 NtCreateMutant,LdrInitializeThunk, 10_2_04829FE0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04829710 NtQueryInformationToken,LdrInitializeThunk, 10_2_04829710
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048298A0 NtWriteVirtualMemory, 10_2_048298A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048298F0 NtReadVirtualMemory, 10_2_048298F0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04829820 NtEnumerateKey, 10_2_04829820
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0482B040 NtSuspendThread, 10_2_0482B040
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048299D0 NtCreateProcessEx, 10_2_048299D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048295F0 NtQueryInformationFile, 10_2_048295F0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04829520 NtWaitForSingleObject, 10_2_04829520
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0482AD30 NtSetContextThread, 10_2_0482AD30
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04829950 NtQueueApcThread, 10_2_04829950
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04829560 NtWriteFile, 10_2_04829560
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04829A80 NtOpenDirectoryObject, 10_2_04829A80
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04829A00 NtProtectVirtualMemory, 10_2_04829A00
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04829610 NtEnumerateValueKey, 10_2_04829610
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04829A10 NtQuerySection, 10_2_04829A10
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04829A20 NtResumeThread, 10_2_04829A20
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04829670 NtQueryInformationProcess, 10_2_04829670
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048297A0 NtUnmapViewOfSection, 10_2_048297A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0482A3B0 NtGetContextThread, 10_2_0482A3B0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04829B00 NtSetValueKey, 10_2_04829B00
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0482A710 NtOpenProcessToken, 10_2_0482A710
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04829730 NtQueryVirtualMemory, 10_2_04829730
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04829760 NtOpenProcess, 10_2_04829760
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04829770 NtSetInformationFile, 10_2_04829770
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0482A770 NtOpenThread, 10_2_0482A770
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_029AA360 NtCreateFile, 10_2_029AA360
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_029AA490 NtClose, 10_2_029AA490
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_029AA410 NtReadFile, 10_2_029AA410
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_029AA540 NtAllocateVirtualMemory, 10_2_029AA540
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_029AA35A NtCreateFile, 10_2_029AA35A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_029AA53A NtAllocateVirtualMemory, 10_2_029AA53A
Sample file is different than original file name gathered from version info
Source: Factura de proforma.exe Binary or memory string: OriginalFilename vs Factura de proforma.exe
Source: Factura de proforma.exe, 00000000.00000002.327421631.0000000007900000.00000004.00020000.sdmp Binary or memory string: OriginalFilenameUI.dll< vs Factura de proforma.exe
Source: Factura de proforma.exe, 00000000.00000000.296727350.00000000007A2000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameCachedDa.exe6 vs Factura de proforma.exe
Source: Factura de proforma.exe, 00000000.00000002.322371267.0000000002B81000.00000004.00000001.sdmp Binary or memory string: i,\\StringFileInfo\\000004B0\\OriginalFilename vs Factura de proforma.exe
Source: Factura de proforma.exe Binary or memory string: OriginalFilenameCachedDa.exe6 vs Factura de proforma.exe
PE file contains strange resources
Source: Factura de proforma.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: tskpCbAwtxoaw.exe.0.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Factura de proforma.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: tskpCbAwtxoaw.exe.0.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Factura de proforma.exe File read: C:\Users\user\Desktop\Factura de proforma.exe Jump to behavior
Source: Factura de proforma.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Factura de proforma.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Factura de proforma.exe 'C:\Users\user\Desktop\Factura de proforma.exe'
Source: C:\Users\user\Desktop\Factura de proforma.exe Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\tskpCbAwtxoaw' /XML 'C:\Users\user\AppData\Local\Temp\tmpD689.tmp'
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Factura de proforma.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\cscript.exe C:\Windows\SysWOW64\cscript.exe
Source: C:\Windows\SysWOW64\cscript.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Factura de proforma.exe Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\tskpCbAwtxoaw' /XML 'C:\Users\user\AppData\Local\Temp\tmpD689.tmp' Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe' Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe File created: C:\Users\user\AppData\Local\Gottschalks Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe File created: C:\Users\user\AppData\Local\Temp\tmpD689.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winEXE@10/4@4/1
Source: C:\Users\user\Desktop\Factura de proforma.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6824:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6960:120:WilError_01
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: Factura de proforma.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: Factura de proforma.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: cscript.pdbUGP source: RegSvcs.exe, 00000006.00000002.406155784.00000000036A0000.00000040.00020000.sdmp
Source: Binary string: RegSvcs.pdb, source: cscript.exe, 0000000A.00000002.573045416.0000000004CEF000.00000004.00020000.sdmp
Source: Binary string: wntdll.pdbUGP source: RegSvcs.exe, 00000006.00000002.402914826.00000000015C0000.00000040.00000001.sdmp, cscript.exe, 0000000A.00000002.572701700.00000000048DF000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: RegSvcs.exe, cscript.exe
Source: Binary string: RegSvcs.pdb source: cscript.exe, 0000000A.00000002.573045416.0000000004CEF000.00000004.00020000.sdmp
Source: Binary string: cscript.pdb source: RegSvcs.exe, 00000006.00000002.406155784.00000000036A0000.00000040.00020000.sdmp

Data Obfuscation:

barindex
.NET source code contains potential unpacker
Source: Factura de proforma.exe, MapEditor1/CreateMapDialog.cs .Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: tskpCbAwtxoaw.exe.0.dr, MapEditor1/CreateMapDialog.cs .Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 0.0.Factura de proforma.exe.7a0000.0.unpack, MapEditor1/CreateMapDialog.cs .Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 0.2.Factura de proforma.exe.7a0000.0.unpack, MapEditor1/CreateMapDialog.cs .Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Factura de proforma.exe Code function: 0_2_070C4BBD push FFFFFF8Bh; iretd 0_2_070C4BBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0041D4B5 push eax; ret 6_2_0041D508
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0041D56C push eax; ret 6_2_0041D572
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0041D502 push eax; ret 6_2_0041D508
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0041D50B push eax; ret 6_2_0041D572
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_00419F75 push ebx; iretd 6_2_00419F7D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0163D0D1 push ecx; ret 6_2_0163D0E4
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0483D0D1 push ecx; ret 10_2_0483D0E4
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_029A9F75 push ebx; iretd 10_2_029A9F7D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_029AD4B5 push eax; ret 10_2_029AD508
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_029AD50B push eax; ret 10_2_029AD572
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_029AD502 push eax; ret 10_2_029AD508
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_029AD56C push eax; ret 10_2_029AD572
Source: initial sample Static PE information: section name: .text entropy: 7.7904887088
Source: initial sample Static PE information: section name: .text entropy: 7.7904887088

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Users\user\Desktop\Factura de proforma.exe File created: C:\Users\user\AppData\Roaming\tskpCbAwtxoaw.exe Jump to dropped file

Boot Survival:

barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\Factura de proforma.exe Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\tskpCbAwtxoaw' /XML 'C:\Users\user\AppData\Local\Temp\tmpD689.tmp'

Hooking and other Techniques for Hiding and Protection:

barindex
Modifies the prolog of user mode functions (user mode inline hooks)
Source: explorer.exe User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x8D 0xDE 0xE0
Source: C:\Users\user\Desktop\Factura de proforma.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Yara detected AntiVM3
Source: Yara match File source: 0.2.Factura de proforma.exe.2bd16b0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.322371267.0000000002B81000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Factura de proforma.exe PID: 6952, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: Factura de proforma.exe, 00000000.00000002.322371267.0000000002B81000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLL
Source: Factura de proforma.exe, 00000000.00000002.322371267.0000000002B81000.00000004.00000001.sdmp Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
Tries to detect virtualization through RDTSC time measurements
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe RDTSC instruction interceptor: First address: 0000000000409904 second address: 000000000040990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe RDTSC instruction interceptor: First address: 0000000000409B7E second address: 0000000000409B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\cscript.exe RDTSC instruction interceptor: First address: 0000000002999904 second address: 000000000299990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\cscript.exe RDTSC instruction interceptor: First address: 0000000002999B7E second address: 0000000002999B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\Factura de proforma.exe TID: 6384 Thread sleep time: -45175s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe TID: 4852 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 7112 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe TID: 6368 Thread sleep time: -32000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\cscript.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_00409AB0 rdtsc 6_2_00409AB0
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\Factura de proforma.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Thread delayed: delay time: 45175 Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: Factura de proforma.exe, 00000000.00000002.322371267.0000000002B81000.00000004.00000001.sdmp Binary or memory string: VMware SVGA IIBAdd-MpPreference -ExclusionPath "
Source: explorer.exe, 00000007.00000000.362850284.0000000000B7D000.00000004.00000020.sdmp Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Factura de proforma.exe, 00000000.00000002.322371267.0000000002B81000.00000004.00000001.sdmp Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 00000007.00000000.352399767.00000000086C9000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: Factura de proforma.exe, 00000000.00000002.322371267.0000000002B81000.00000004.00000001.sdmp Binary or memory string: vmware
Source: explorer.exe, 00000007.00000000.354893243.000000000EE50000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}B
Source: explorer.exe, 00000007.00000000.375277413.0000000008778000.00000004.00000001.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000}
Source: explorer.exe, 00000007.00000000.333973345.00000000067C2000.00000004.00000001.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000007.00000000.352399767.00000000086C9000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}&
Source: explorer.exe, 00000007.00000000.333973345.00000000067C2000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000m32)
Source: explorer.exe, 00000007.00000000.337688862.00000000087C2000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}oft.Mic
Source: explorer.exe, 00000007.00000000.352399767.00000000086C9000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: Factura de proforma.exe, 00000000.00000002.322371267.0000000002B81000.00000004.00000001.sdmp Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Anti Debugging:

barindex
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_00409AB0 rdtsc 6_2_00409AB0
Contains functionality to read the PEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0160B944 mov eax, dword ptr fs:[00000030h] 6_2_0160B944
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0160B944 mov eax, dword ptr fs:[00000030h] 6_2_0160B944
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015EB171 mov eax, dword ptr fs:[00000030h] 6_2_015EB171
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015EB171 mov eax, dword ptr fs:[00000030h] 6_2_015EB171
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015EC962 mov eax, dword ptr fs:[00000030h] 6_2_015EC962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01604120 mov eax, dword ptr fs:[00000030h] 6_2_01604120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01604120 mov eax, dword ptr fs:[00000030h] 6_2_01604120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01604120 mov eax, dword ptr fs:[00000030h] 6_2_01604120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01604120 mov eax, dword ptr fs:[00000030h] 6_2_01604120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01604120 mov ecx, dword ptr fs:[00000030h] 6_2_01604120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0161513A mov eax, dword ptr fs:[00000030h] 6_2_0161513A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0161513A mov eax, dword ptr fs:[00000030h] 6_2_0161513A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015E9100 mov eax, dword ptr fs:[00000030h] 6_2_015E9100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015E9100 mov eax, dword ptr fs:[00000030h] 6_2_015E9100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015E9100 mov eax, dword ptr fs:[00000030h] 6_2_015E9100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016741E8 mov eax, dword ptr fs:[00000030h] 6_2_016741E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015EB1E1 mov eax, dword ptr fs:[00000030h] 6_2_015EB1E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015EB1E1 mov eax, dword ptr fs:[00000030h] 6_2_015EB1E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015EB1E1 mov eax, dword ptr fs:[00000030h] 6_2_015EB1E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016669A6 mov eax, dword ptr fs:[00000030h] 6_2_016669A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016161A0 mov eax, dword ptr fs:[00000030h] 6_2_016161A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016161A0 mov eax, dword ptr fs:[00000030h] 6_2_016161A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016651BE mov eax, dword ptr fs:[00000030h] 6_2_016651BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016651BE mov eax, dword ptr fs:[00000030h] 6_2_016651BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016651BE mov eax, dword ptr fs:[00000030h] 6_2_016651BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016651BE mov eax, dword ptr fs:[00000030h] 6_2_016651BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0160C182 mov eax, dword ptr fs:[00000030h] 6_2_0160C182
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0161A185 mov eax, dword ptr fs:[00000030h] 6_2_0161A185
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01612990 mov eax, dword ptr fs:[00000030h] 6_2_01612990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016A2073 mov eax, dword ptr fs:[00000030h] 6_2_016A2073
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016B1074 mov eax, dword ptr fs:[00000030h] 6_2_016B1074
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01600050 mov eax, dword ptr fs:[00000030h] 6_2_01600050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01600050 mov eax, dword ptr fs:[00000030h] 6_2_01600050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0161002D mov eax, dword ptr fs:[00000030h] 6_2_0161002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0161002D mov eax, dword ptr fs:[00000030h] 6_2_0161002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0161002D mov eax, dword ptr fs:[00000030h] 6_2_0161002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0161002D mov eax, dword ptr fs:[00000030h] 6_2_0161002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0161002D mov eax, dword ptr fs:[00000030h] 6_2_0161002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01667016 mov eax, dword ptr fs:[00000030h] 6_2_01667016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01667016 mov eax, dword ptr fs:[00000030h] 6_2_01667016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01667016 mov eax, dword ptr fs:[00000030h] 6_2_01667016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015FB02A mov eax, dword ptr fs:[00000030h] 6_2_015FB02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015FB02A mov eax, dword ptr fs:[00000030h] 6_2_015FB02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015FB02A mov eax, dword ptr fs:[00000030h] 6_2_015FB02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015FB02A mov eax, dword ptr fs:[00000030h] 6_2_015FB02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016B4015 mov eax, dword ptr fs:[00000030h] 6_2_016B4015
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016B4015 mov eax, dword ptr fs:[00000030h] 6_2_016B4015
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015E58EC mov eax, dword ptr fs:[00000030h] 6_2_015E58EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0167B8D0 mov eax, dword ptr fs:[00000030h] 6_2_0167B8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0167B8D0 mov ecx, dword ptr fs:[00000030h] 6_2_0167B8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0167B8D0 mov eax, dword ptr fs:[00000030h] 6_2_0167B8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0167B8D0 mov eax, dword ptr fs:[00000030h] 6_2_0167B8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0167B8D0 mov eax, dword ptr fs:[00000030h] 6_2_0167B8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0167B8D0 mov eax, dword ptr fs:[00000030h] 6_2_0167B8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016120A0 mov eax, dword ptr fs:[00000030h] 6_2_016120A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016120A0 mov eax, dword ptr fs:[00000030h] 6_2_016120A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016120A0 mov eax, dword ptr fs:[00000030h] 6_2_016120A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016120A0 mov eax, dword ptr fs:[00000030h] 6_2_016120A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016120A0 mov eax, dword ptr fs:[00000030h] 6_2_016120A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016120A0 mov eax, dword ptr fs:[00000030h] 6_2_016120A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016290AF mov eax, dword ptr fs:[00000030h] 6_2_016290AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015E9080 mov eax, dword ptr fs:[00000030h] 6_2_015E9080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0161F0BF mov ecx, dword ptr fs:[00000030h] 6_2_0161F0BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0161F0BF mov eax, dword ptr fs:[00000030h] 6_2_0161F0BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0161F0BF mov eax, dword ptr fs:[00000030h] 6_2_0161F0BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01663884 mov eax, dword ptr fs:[00000030h] 6_2_01663884
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01663884 mov eax, dword ptr fs:[00000030h] 6_2_01663884
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015EF358 mov eax, dword ptr fs:[00000030h] 6_2_015EF358
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01613B7A mov eax, dword ptr fs:[00000030h] 6_2_01613B7A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01613B7A mov eax, dword ptr fs:[00000030h] 6_2_01613B7A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015EDB40 mov eax, dword ptr fs:[00000030h] 6_2_015EDB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016B8B58 mov eax, dword ptr fs:[00000030h] 6_2_016B8B58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015EDB60 mov ecx, dword ptr fs:[00000030h] 6_2_015EDB60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016A131B mov eax, dword ptr fs:[00000030h] 6_2_016A131B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016103E2 mov eax, dword ptr fs:[00000030h] 6_2_016103E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016103E2 mov eax, dword ptr fs:[00000030h] 6_2_016103E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016103E2 mov eax, dword ptr fs:[00000030h] 6_2_016103E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016103E2 mov eax, dword ptr fs:[00000030h] 6_2_016103E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016103E2 mov eax, dword ptr fs:[00000030h] 6_2_016103E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016103E2 mov eax, dword ptr fs:[00000030h] 6_2_016103E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0160DBE9 mov eax, dword ptr fs:[00000030h] 6_2_0160DBE9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016653CA mov eax, dword ptr fs:[00000030h] 6_2_016653CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016653CA mov eax, dword ptr fs:[00000030h] 6_2_016653CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01614BAD mov eax, dword ptr fs:[00000030h] 6_2_01614BAD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01614BAD mov eax, dword ptr fs:[00000030h] 6_2_01614BAD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01614BAD mov eax, dword ptr fs:[00000030h] 6_2_01614BAD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016B5BA5 mov eax, dword ptr fs:[00000030h] 6_2_016B5BA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015F1B8F mov eax, dword ptr fs:[00000030h] 6_2_015F1B8F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015F1B8F mov eax, dword ptr fs:[00000030h] 6_2_015F1B8F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016A138A mov eax, dword ptr fs:[00000030h] 6_2_016A138A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0169D380 mov ecx, dword ptr fs:[00000030h] 6_2_0169D380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0161B390 mov eax, dword ptr fs:[00000030h] 6_2_0161B390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01612397 mov eax, dword ptr fs:[00000030h] 6_2_01612397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0169B260 mov eax, dword ptr fs:[00000030h] 6_2_0169B260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0169B260 mov eax, dword ptr fs:[00000030h] 6_2_0169B260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016B8A62 mov eax, dword ptr fs:[00000030h] 6_2_016B8A62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0162927A mov eax, dword ptr fs:[00000030h] 6_2_0162927A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015E9240 mov eax, dword ptr fs:[00000030h] 6_2_015E9240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015E9240 mov eax, dword ptr fs:[00000030h] 6_2_015E9240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015E9240 mov eax, dword ptr fs:[00000030h] 6_2_015E9240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015E9240 mov eax, dword ptr fs:[00000030h] 6_2_015E9240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01674257 mov eax, dword ptr fs:[00000030h] 6_2_01674257
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015EAA16 mov eax, dword ptr fs:[00000030h] 6_2_015EAA16
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015EAA16 mov eax, dword ptr fs:[00000030h] 6_2_015EAA16
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01624A2C mov eax, dword ptr fs:[00000030h] 6_2_01624A2C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01624A2C mov eax, dword ptr fs:[00000030h] 6_2_01624A2C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015E5210 mov eax, dword ptr fs:[00000030h] 6_2_015E5210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015E5210 mov ecx, dword ptr fs:[00000030h] 6_2_015E5210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015E5210 mov eax, dword ptr fs:[00000030h] 6_2_015E5210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015E5210 mov eax, dword ptr fs:[00000030h] 6_2_015E5210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015F8A0A mov eax, dword ptr fs:[00000030h] 6_2_015F8A0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01603A1C mov eax, dword ptr fs:[00000030h] 6_2_01603A1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01612AE4 mov eax, dword ptr fs:[00000030h] 6_2_01612AE4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01612ACB mov eax, dword ptr fs:[00000030h] 6_2_01612ACB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0161FAB0 mov eax, dword ptr fs:[00000030h] 6_2_0161FAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015FAAB0 mov eax, dword ptr fs:[00000030h] 6_2_015FAAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015FAAB0 mov eax, dword ptr fs:[00000030h] 6_2_015FAAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0161D294 mov eax, dword ptr fs:[00000030h] 6_2_0161D294
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0161D294 mov eax, dword ptr fs:[00000030h] 6_2_0161D294
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015E52A5 mov eax, dword ptr fs:[00000030h] 6_2_015E52A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015E52A5 mov eax, dword ptr fs:[00000030h] 6_2_015E52A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015E52A5 mov eax, dword ptr fs:[00000030h] 6_2_015E52A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015E52A5 mov eax, dword ptr fs:[00000030h] 6_2_015E52A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015E52A5 mov eax, dword ptr fs:[00000030h] 6_2_015E52A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0160C577 mov eax, dword ptr fs:[00000030h] 6_2_0160C577
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0160C577 mov eax, dword ptr fs:[00000030h] 6_2_0160C577
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01623D43 mov eax, dword ptr fs:[00000030h] 6_2_01623D43
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01663540 mov eax, dword ptr fs:[00000030h] 6_2_01663540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01607D50 mov eax, dword ptr fs:[00000030h] 6_2_01607D50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0166A537 mov eax, dword ptr fs:[00000030h] 6_2_0166A537
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01614D3B mov eax, dword ptr fs:[00000030h] 6_2_01614D3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01614D3B mov eax, dword ptr fs:[00000030h] 6_2_01614D3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01614D3B mov eax, dword ptr fs:[00000030h] 6_2_01614D3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016B8D34 mov eax, dword ptr fs:[00000030h] 6_2_016B8D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015F3D34 mov eax, dword ptr fs:[00000030h] 6_2_015F3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015F3D34 mov eax, dword ptr fs:[00000030h] 6_2_015F3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015F3D34 mov eax, dword ptr fs:[00000030h] 6_2_015F3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015F3D34 mov eax, dword ptr fs:[00000030h] 6_2_015F3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015F3D34 mov eax, dword ptr fs:[00000030h] 6_2_015F3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015F3D34 mov eax, dword ptr fs:[00000030h] 6_2_015F3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015F3D34 mov eax, dword ptr fs:[00000030h] 6_2_015F3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015F3D34 mov eax, dword ptr fs:[00000030h] 6_2_015F3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015F3D34 mov eax, dword ptr fs:[00000030h] 6_2_015F3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015F3D34 mov eax, dword ptr fs:[00000030h] 6_2_015F3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015F3D34 mov eax, dword ptr fs:[00000030h] 6_2_015F3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015F3D34 mov eax, dword ptr fs:[00000030h] 6_2_015F3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015F3D34 mov eax, dword ptr fs:[00000030h] 6_2_015F3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015EAD30 mov eax, dword ptr fs:[00000030h] 6_2_015EAD30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01698DF1 mov eax, dword ptr fs:[00000030h] 6_2_01698DF1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01666DC9 mov eax, dword ptr fs:[00000030h] 6_2_01666DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01666DC9 mov eax, dword ptr fs:[00000030h] 6_2_01666DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01666DC9 mov eax, dword ptr fs:[00000030h] 6_2_01666DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01666DC9 mov ecx, dword ptr fs:[00000030h] 6_2_01666DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01666DC9 mov eax, dword ptr fs:[00000030h] 6_2_01666DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01666DC9 mov eax, dword ptr fs:[00000030h] 6_2_01666DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015FD5E0 mov eax, dword ptr fs:[00000030h] 6_2_015FD5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015FD5E0 mov eax, dword ptr fs:[00000030h] 6_2_015FD5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016135A1 mov eax, dword ptr fs:[00000030h] 6_2_016135A1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016B05AC mov eax, dword ptr fs:[00000030h] 6_2_016B05AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016B05AC mov eax, dword ptr fs:[00000030h] 6_2_016B05AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015E2D8A mov eax, dword ptr fs:[00000030h] 6_2_015E2D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015E2D8A mov eax, dword ptr fs:[00000030h] 6_2_015E2D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015E2D8A mov eax, dword ptr fs:[00000030h] 6_2_015E2D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015E2D8A mov eax, dword ptr fs:[00000030h] 6_2_015E2D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015E2D8A mov eax, dword ptr fs:[00000030h] 6_2_015E2D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01611DB5 mov eax, dword ptr fs:[00000030h] 6_2_01611DB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01611DB5 mov eax, dword ptr fs:[00000030h] 6_2_01611DB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01611DB5 mov eax, dword ptr fs:[00000030h] 6_2_01611DB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01612581 mov eax, dword ptr fs:[00000030h] 6_2_01612581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01612581 mov eax, dword ptr fs:[00000030h] 6_2_01612581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01612581 mov eax, dword ptr fs:[00000030h] 6_2_01612581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01612581 mov eax, dword ptr fs:[00000030h] 6_2_01612581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0161FD9B mov eax, dword ptr fs:[00000030h] 6_2_0161FD9B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0161FD9B mov eax, dword ptr fs:[00000030h] 6_2_0161FD9B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0160746D mov eax, dword ptr fs:[00000030h] 6_2_0160746D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0161A44B mov eax, dword ptr fs:[00000030h] 6_2_0161A44B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0167C450 mov eax, dword ptr fs:[00000030h] 6_2_0167C450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0167C450 mov eax, dword ptr fs:[00000030h] 6_2_0167C450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0161BC2C mov eax, dword ptr fs:[00000030h] 6_2_0161BC2C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016B740D mov eax, dword ptr fs:[00000030h] 6_2_016B740D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016B740D mov eax, dword ptr fs:[00000030h] 6_2_016B740D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016B740D mov eax, dword ptr fs:[00000030h] 6_2_016B740D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016A1C06 mov eax, dword ptr fs:[00000030h] 6_2_016A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016A1C06 mov eax, dword ptr fs:[00000030h] 6_2_016A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016A1C06 mov eax, dword ptr fs:[00000030h] 6_2_016A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016A1C06 mov eax, dword ptr fs:[00000030h] 6_2_016A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016A1C06 mov eax, dword ptr fs:[00000030h] 6_2_016A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016A1C06 mov eax, dword ptr fs:[00000030h] 6_2_016A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016A1C06 mov eax, dword ptr fs:[00000030h] 6_2_016A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016A1C06 mov eax, dword ptr fs:[00000030h] 6_2_016A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016A1C06 mov eax, dword ptr fs:[00000030h] 6_2_016A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016A1C06 mov eax, dword ptr fs:[00000030h] 6_2_016A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016A1C06 mov eax, dword ptr fs:[00000030h] 6_2_016A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016A1C06 mov eax, dword ptr fs:[00000030h] 6_2_016A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016A1C06 mov eax, dword ptr fs:[00000030h] 6_2_016A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016A1C06 mov eax, dword ptr fs:[00000030h] 6_2_016A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01666C0A mov eax, dword ptr fs:[00000030h] 6_2_01666C0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01666C0A mov eax, dword ptr fs:[00000030h] 6_2_01666C0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01666C0A mov eax, dword ptr fs:[00000030h] 6_2_01666C0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01666C0A mov eax, dword ptr fs:[00000030h] 6_2_01666C0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016A14FB mov eax, dword ptr fs:[00000030h] 6_2_016A14FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01666CF0 mov eax, dword ptr fs:[00000030h] 6_2_01666CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01666CF0 mov eax, dword ptr fs:[00000030h] 6_2_01666CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01666CF0 mov eax, dword ptr fs:[00000030h] 6_2_01666CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016B8CD6 mov eax, dword ptr fs:[00000030h] 6_2_016B8CD6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015F849B mov eax, dword ptr fs:[00000030h] 6_2_015F849B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016B8F6A mov eax, dword ptr fs:[00000030h] 6_2_016B8F6A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015FEF40 mov eax, dword ptr fs:[00000030h] 6_2_015FEF40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015FFF60 mov eax, dword ptr fs:[00000030h] 6_2_015FFF60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0161E730 mov eax, dword ptr fs:[00000030h] 6_2_0161E730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016B070D mov eax, dword ptr fs:[00000030h] 6_2_016B070D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016B070D mov eax, dword ptr fs:[00000030h] 6_2_016B070D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0161A70E mov eax, dword ptr fs:[00000030h] 6_2_0161A70E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0161A70E mov eax, dword ptr fs:[00000030h] 6_2_0161A70E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015E4F2E mov eax, dword ptr fs:[00000030h] 6_2_015E4F2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015E4F2E mov eax, dword ptr fs:[00000030h] 6_2_015E4F2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0160F716 mov eax, dword ptr fs:[00000030h] 6_2_0160F716
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0167FF10 mov eax, dword ptr fs:[00000030h] 6_2_0167FF10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0167FF10 mov eax, dword ptr fs:[00000030h] 6_2_0167FF10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016237F5 mov eax, dword ptr fs:[00000030h] 6_2_016237F5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015F8794 mov eax, dword ptr fs:[00000030h] 6_2_015F8794
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01667794 mov eax, dword ptr fs:[00000030h] 6_2_01667794
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01667794 mov eax, dword ptr fs:[00000030h] 6_2_01667794
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01667794 mov eax, dword ptr fs:[00000030h] 6_2_01667794
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0160AE73 mov eax, dword ptr fs:[00000030h] 6_2_0160AE73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0160AE73 mov eax, dword ptr fs:[00000030h] 6_2_0160AE73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0160AE73 mov eax, dword ptr fs:[00000030h] 6_2_0160AE73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0160AE73 mov eax, dword ptr fs:[00000030h] 6_2_0160AE73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0160AE73 mov eax, dword ptr fs:[00000030h] 6_2_0160AE73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015F7E41 mov eax, dword ptr fs:[00000030h] 6_2_015F7E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015F7E41 mov eax, dword ptr fs:[00000030h] 6_2_015F7E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015F7E41 mov eax, dword ptr fs:[00000030h] 6_2_015F7E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015F7E41 mov eax, dword ptr fs:[00000030h] 6_2_015F7E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015F7E41 mov eax, dword ptr fs:[00000030h] 6_2_015F7E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015F7E41 mov eax, dword ptr fs:[00000030h] 6_2_015F7E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015F766D mov eax, dword ptr fs:[00000030h] 6_2_015F766D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0169FE3F mov eax, dword ptr fs:[00000030h] 6_2_0169FE3F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015EC600 mov eax, dword ptr fs:[00000030h] 6_2_015EC600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015EC600 mov eax, dword ptr fs:[00000030h] 6_2_015EC600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015EC600 mov eax, dword ptr fs:[00000030h] 6_2_015EC600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01618E00 mov eax, dword ptr fs:[00000030h] 6_2_01618E00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016A1608 mov eax, dword ptr fs:[00000030h] 6_2_016A1608
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0161A61C mov eax, dword ptr fs:[00000030h] 6_2_0161A61C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0161A61C mov eax, dword ptr fs:[00000030h] 6_2_0161A61C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015EE620 mov eax, dword ptr fs:[00000030h] 6_2_015EE620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016116E0 mov ecx, dword ptr fs:[00000030h] 6_2_016116E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_01628EC7 mov eax, dword ptr fs:[00000030h] 6_2_01628EC7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0169FEC0 mov eax, dword ptr fs:[00000030h] 6_2_0169FEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016136CC mov eax, dword ptr fs:[00000030h] 6_2_016136CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016B8ED6 mov eax, dword ptr fs:[00000030h] 6_2_016B8ED6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_015F76E2 mov eax, dword ptr fs:[00000030h] 6_2_015F76E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016646A7 mov eax, dword ptr fs:[00000030h] 6_2_016646A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016B0EA5 mov eax, dword ptr fs:[00000030h] 6_2_016B0EA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016B0EA5 mov eax, dword ptr fs:[00000030h] 6_2_016B0EA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_016B0EA5 mov eax, dword ptr fs:[00000030h] 6_2_016B0EA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0167FE87 mov eax, dword ptr fs:[00000030h] 6_2_0167FE87
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04863884 mov eax, dword ptr fs:[00000030h] 10_2_04863884
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04863884 mov eax, dword ptr fs:[00000030h] 10_2_04863884
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048290AF mov eax, dword ptr fs:[00000030h] 10_2_048290AF
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0481F0BF mov ecx, dword ptr fs:[00000030h] 10_2_0481F0BF
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0481F0BF mov eax, dword ptr fs:[00000030h] 10_2_0481F0BF
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0481F0BF mov eax, dword ptr fs:[00000030h] 10_2_0481F0BF
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047FB02A mov eax, dword ptr fs:[00000030h] 10_2_047FB02A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047FB02A mov eax, dword ptr fs:[00000030h] 10_2_047FB02A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047FB02A mov eax, dword ptr fs:[00000030h] 10_2_047FB02A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047FB02A mov eax, dword ptr fs:[00000030h] 10_2_047FB02A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0487B8D0 mov eax, dword ptr fs:[00000030h] 10_2_0487B8D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0487B8D0 mov ecx, dword ptr fs:[00000030h] 10_2_0487B8D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0487B8D0 mov eax, dword ptr fs:[00000030h] 10_2_0487B8D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0487B8D0 mov eax, dword ptr fs:[00000030h] 10_2_0487B8D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0487B8D0 mov eax, dword ptr fs:[00000030h] 10_2_0487B8D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0487B8D0 mov eax, dword ptr fs:[00000030h] 10_2_0487B8D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048B8CD6 mov eax, dword ptr fs:[00000030h] 10_2_048B8CD6
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048A14FB mov eax, dword ptr fs:[00000030h] 10_2_048A14FB
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04866CF0 mov eax, dword ptr fs:[00000030h] 10_2_04866CF0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04866CF0 mov eax, dword ptr fs:[00000030h] 10_2_04866CF0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04866CF0 mov eax, dword ptr fs:[00000030h] 10_2_04866CF0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048B740D mov eax, dword ptr fs:[00000030h] 10_2_048B740D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048B740D mov eax, dword ptr fs:[00000030h] 10_2_048B740D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048B740D mov eax, dword ptr fs:[00000030h] 10_2_048B740D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048A1C06 mov eax, dword ptr fs:[00000030h] 10_2_048A1C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048A1C06 mov eax, dword ptr fs:[00000030h] 10_2_048A1C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048A1C06 mov eax, dword ptr fs:[00000030h] 10_2_048A1C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048A1C06 mov eax, dword ptr fs:[00000030h] 10_2_048A1C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048A1C06 mov eax, dword ptr fs:[00000030h] 10_2_048A1C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048A1C06 mov eax, dword ptr fs:[00000030h] 10_2_048A1C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048A1C06 mov eax, dword ptr fs:[00000030h] 10_2_048A1C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048A1C06 mov eax, dword ptr fs:[00000030h] 10_2_048A1C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048A1C06 mov eax, dword ptr fs:[00000030h] 10_2_048A1C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048A1C06 mov eax, dword ptr fs:[00000030h] 10_2_048A1C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048A1C06 mov eax, dword ptr fs:[00000030h] 10_2_048A1C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048A1C06 mov eax, dword ptr fs:[00000030h] 10_2_048A1C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048A1C06 mov eax, dword ptr fs:[00000030h] 10_2_048A1C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048A1C06 mov eax, dword ptr fs:[00000030h] 10_2_048A1C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04866C0A mov eax, dword ptr fs:[00000030h] 10_2_04866C0A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04866C0A mov eax, dword ptr fs:[00000030h] 10_2_04866C0A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04866C0A mov eax, dword ptr fs:[00000030h] 10_2_04866C0A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04866C0A mov eax, dword ptr fs:[00000030h] 10_2_04866C0A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04867016 mov eax, dword ptr fs:[00000030h] 10_2_04867016
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04867016 mov eax, dword ptr fs:[00000030h] 10_2_04867016
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04867016 mov eax, dword ptr fs:[00000030h] 10_2_04867016
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048B4015 mov eax, dword ptr fs:[00000030h] 10_2_048B4015
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048B4015 mov eax, dword ptr fs:[00000030h] 10_2_048B4015
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0481BC2C mov eax, dword ptr fs:[00000030h] 10_2_0481BC2C
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0481A44B mov eax, dword ptr fs:[00000030h] 10_2_0481A44B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04800050 mov eax, dword ptr fs:[00000030h] 10_2_04800050
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04800050 mov eax, dword ptr fs:[00000030h] 10_2_04800050
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0487C450 mov eax, dword ptr fs:[00000030h] 10_2_0487C450
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0487C450 mov eax, dword ptr fs:[00000030h] 10_2_0487C450
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047F849B mov eax, dword ptr fs:[00000030h] 10_2_047F849B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0480746D mov eax, dword ptr fs:[00000030h] 10_2_0480746D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048A2073 mov eax, dword ptr fs:[00000030h] 10_2_048A2073
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047E9080 mov eax, dword ptr fs:[00000030h] 10_2_047E9080
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048B1074 mov eax, dword ptr fs:[00000030h] 10_2_048B1074
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0480C182 mov eax, dword ptr fs:[00000030h] 10_2_0480C182
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0481A185 mov eax, dword ptr fs:[00000030h] 10_2_0481A185
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047EB171 mov eax, dword ptr fs:[00000030h] 10_2_047EB171
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047EB171 mov eax, dword ptr fs:[00000030h] 10_2_047EB171
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0481FD9B mov eax, dword ptr fs:[00000030h] 10_2_0481FD9B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0481FD9B mov eax, dword ptr fs:[00000030h] 10_2_0481FD9B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047EC962 mov eax, dword ptr fs:[00000030h] 10_2_047EC962
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048135A1 mov eax, dword ptr fs:[00000030h] 10_2_048135A1
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048161A0 mov eax, dword ptr fs:[00000030h] 10_2_048161A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048161A0 mov eax, dword ptr fs:[00000030h] 10_2_048161A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04811DB5 mov eax, dword ptr fs:[00000030h] 10_2_04811DB5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04811DB5 mov eax, dword ptr fs:[00000030h] 10_2_04811DB5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04811DB5 mov eax, dword ptr fs:[00000030h] 10_2_04811DB5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047F3D34 mov eax, dword ptr fs:[00000030h] 10_2_047F3D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047F3D34 mov eax, dword ptr fs:[00000030h] 10_2_047F3D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047F3D34 mov eax, dword ptr fs:[00000030h] 10_2_047F3D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047F3D34 mov eax, dword ptr fs:[00000030h] 10_2_047F3D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047F3D34 mov eax, dword ptr fs:[00000030h] 10_2_047F3D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047F3D34 mov eax, dword ptr fs:[00000030h] 10_2_047F3D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047F3D34 mov eax, dword ptr fs:[00000030h] 10_2_047F3D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047F3D34 mov eax, dword ptr fs:[00000030h] 10_2_047F3D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047F3D34 mov eax, dword ptr fs:[00000030h] 10_2_047F3D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047F3D34 mov eax, dword ptr fs:[00000030h] 10_2_047F3D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047F3D34 mov eax, dword ptr fs:[00000030h] 10_2_047F3D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047F3D34 mov eax, dword ptr fs:[00000030h] 10_2_047F3D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047F3D34 mov eax, dword ptr fs:[00000030h] 10_2_047F3D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047EAD30 mov eax, dword ptr fs:[00000030h] 10_2_047EAD30
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048741E8 mov eax, dword ptr fs:[00000030h] 10_2_048741E8
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04898DF1 mov eax, dword ptr fs:[00000030h] 10_2_04898DF1
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047E9100 mov eax, dword ptr fs:[00000030h] 10_2_047E9100
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047E9100 mov eax, dword ptr fs:[00000030h] 10_2_047E9100
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047E9100 mov eax, dword ptr fs:[00000030h] 10_2_047E9100
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047EB1E1 mov eax, dword ptr fs:[00000030h] 10_2_047EB1E1
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047EB1E1 mov eax, dword ptr fs:[00000030h] 10_2_047EB1E1
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047EB1E1 mov eax, dword ptr fs:[00000030h] 10_2_047EB1E1
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047FD5E0 mov eax, dword ptr fs:[00000030h] 10_2_047FD5E0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047FD5E0 mov eax, dword ptr fs:[00000030h] 10_2_047FD5E0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04804120 mov eax, dword ptr fs:[00000030h] 10_2_04804120
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04804120 mov eax, dword ptr fs:[00000030h] 10_2_04804120
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04804120 mov eax, dword ptr fs:[00000030h] 10_2_04804120
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04804120 mov eax, dword ptr fs:[00000030h] 10_2_04804120
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04804120 mov ecx, dword ptr fs:[00000030h] 10_2_04804120
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0486A537 mov eax, dword ptr fs:[00000030h] 10_2_0486A537
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04814D3B mov eax, dword ptr fs:[00000030h] 10_2_04814D3B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04814D3B mov eax, dword ptr fs:[00000030h] 10_2_04814D3B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04814D3B mov eax, dword ptr fs:[00000030h] 10_2_04814D3B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0481513A mov eax, dword ptr fs:[00000030h] 10_2_0481513A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0481513A mov eax, dword ptr fs:[00000030h] 10_2_0481513A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048B8D34 mov eax, dword ptr fs:[00000030h] 10_2_048B8D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04823D43 mov eax, dword ptr fs:[00000030h] 10_2_04823D43
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0480B944 mov eax, dword ptr fs:[00000030h] 10_2_0480B944
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0480B944 mov eax, dword ptr fs:[00000030h] 10_2_0480B944
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04863540 mov eax, dword ptr fs:[00000030h] 10_2_04863540
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04807D50 mov eax, dword ptr fs:[00000030h] 10_2_04807D50
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047E2D8A mov eax, dword ptr fs:[00000030h] 10_2_047E2D8A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047E2D8A mov eax, dword ptr fs:[00000030h] 10_2_047E2D8A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047E2D8A mov eax, dword ptr fs:[00000030h] 10_2_047E2D8A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047E2D8A mov eax, dword ptr fs:[00000030h] 10_2_047E2D8A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047E2D8A mov eax, dword ptr fs:[00000030h] 10_2_047E2D8A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0480C577 mov eax, dword ptr fs:[00000030h] 10_2_0480C577
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0480C577 mov eax, dword ptr fs:[00000030h] 10_2_0480C577
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0487FE87 mov eax, dword ptr fs:[00000030h] 10_2_0487FE87
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047F766D mov eax, dword ptr fs:[00000030h] 10_2_047F766D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0481D294 mov eax, dword ptr fs:[00000030h] 10_2_0481D294
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0481D294 mov eax, dword ptr fs:[00000030h] 10_2_0481D294
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048646A7 mov eax, dword ptr fs:[00000030h] 10_2_048646A7
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048B0EA5 mov eax, dword ptr fs:[00000030h] 10_2_048B0EA5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048B0EA5 mov eax, dword ptr fs:[00000030h] 10_2_048B0EA5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048B0EA5 mov eax, dword ptr fs:[00000030h] 10_2_048B0EA5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0481FAB0 mov eax, dword ptr fs:[00000030h] 10_2_0481FAB0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047E9240 mov eax, dword ptr fs:[00000030h] 10_2_047E9240
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047E9240 mov eax, dword ptr fs:[00000030h] 10_2_047E9240
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047E9240 mov eax, dword ptr fs:[00000030h] 10_2_047E9240
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047E9240 mov eax, dword ptr fs:[00000030h] 10_2_047E9240
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047F7E41 mov eax, dword ptr fs:[00000030h] 10_2_047F7E41
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047F7E41 mov eax, dword ptr fs:[00000030h] 10_2_047F7E41
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047F7E41 mov eax, dword ptr fs:[00000030h] 10_2_047F7E41
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047F7E41 mov eax, dword ptr fs:[00000030h] 10_2_047F7E41
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047F7E41 mov eax, dword ptr fs:[00000030h] 10_2_047F7E41
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047F7E41 mov eax, dword ptr fs:[00000030h] 10_2_047F7E41
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04828EC7 mov eax, dword ptr fs:[00000030h] 10_2_04828EC7
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0489FEC0 mov eax, dword ptr fs:[00000030h] 10_2_0489FEC0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048136CC mov eax, dword ptr fs:[00000030h] 10_2_048136CC
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048B8ED6 mov eax, dword ptr fs:[00000030h] 10_2_048B8ED6
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047EE620 mov eax, dword ptr fs:[00000030h] 10_2_047EE620
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048116E0 mov ecx, dword ptr fs:[00000030h] 10_2_048116E0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047F8A0A mov eax, dword ptr fs:[00000030h] 10_2_047F8A0A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047EC600 mov eax, dword ptr fs:[00000030h] 10_2_047EC600
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047EC600 mov eax, dword ptr fs:[00000030h] 10_2_047EC600
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047EC600 mov eax, dword ptr fs:[00000030h] 10_2_047EC600
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04803A1C mov eax, dword ptr fs:[00000030h] 10_2_04803A1C
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047F76E2 mov eax, dword ptr fs:[00000030h] 10_2_047F76E2
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0481A61C mov eax, dword ptr fs:[00000030h] 10_2_0481A61C
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0481A61C mov eax, dword ptr fs:[00000030h] 10_2_0481A61C
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0489FE3F mov eax, dword ptr fs:[00000030h] 10_2_0489FE3F
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047FAAB0 mov eax, dword ptr fs:[00000030h] 10_2_047FAAB0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047FAAB0 mov eax, dword ptr fs:[00000030h] 10_2_047FAAB0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04874257 mov eax, dword ptr fs:[00000030h] 10_2_04874257
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047E52A5 mov eax, dword ptr fs:[00000030h] 10_2_047E52A5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047E52A5 mov eax, dword ptr fs:[00000030h] 10_2_047E52A5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047E52A5 mov eax, dword ptr fs:[00000030h] 10_2_047E52A5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047E52A5 mov eax, dword ptr fs:[00000030h] 10_2_047E52A5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047E52A5 mov eax, dword ptr fs:[00000030h] 10_2_047E52A5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0489B260 mov eax, dword ptr fs:[00000030h] 10_2_0489B260
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0489B260 mov eax, dword ptr fs:[00000030h] 10_2_0489B260
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048B8A62 mov eax, dword ptr fs:[00000030h] 10_2_048B8A62
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0480AE73 mov eax, dword ptr fs:[00000030h] 10_2_0480AE73
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0480AE73 mov eax, dword ptr fs:[00000030h] 10_2_0480AE73
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0480AE73 mov eax, dword ptr fs:[00000030h] 10_2_0480AE73
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0480AE73 mov eax, dword ptr fs:[00000030h] 10_2_0480AE73
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0480AE73 mov eax, dword ptr fs:[00000030h] 10_2_0480AE73
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0482927A mov eax, dword ptr fs:[00000030h] 10_2_0482927A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048A138A mov eax, dword ptr fs:[00000030h] 10_2_048A138A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0489D380 mov ecx, dword ptr fs:[00000030h] 10_2_0489D380
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0481B390 mov eax, dword ptr fs:[00000030h] 10_2_0481B390
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04867794 mov eax, dword ptr fs:[00000030h] 10_2_04867794
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04867794 mov eax, dword ptr fs:[00000030h] 10_2_04867794
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04867794 mov eax, dword ptr fs:[00000030h] 10_2_04867794
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047EDB60 mov ecx, dword ptr fs:[00000030h] 10_2_047EDB60
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047FFF60 mov eax, dword ptr fs:[00000030h] 10_2_047FFF60
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047EF358 mov eax, dword ptr fs:[00000030h] 10_2_047EF358
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048B5BA5 mov eax, dword ptr fs:[00000030h] 10_2_048B5BA5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047EDB40 mov eax, dword ptr fs:[00000030h] 10_2_047EDB40
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047FEF40 mov eax, dword ptr fs:[00000030h] 10_2_047FEF40
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047E4F2E mov eax, dword ptr fs:[00000030h] 10_2_047E4F2E
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047E4F2E mov eax, dword ptr fs:[00000030h] 10_2_047E4F2E
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048237F5 mov eax, dword ptr fs:[00000030h] 10_2_048237F5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048B070D mov eax, dword ptr fs:[00000030h] 10_2_048B070D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048B070D mov eax, dword ptr fs:[00000030h] 10_2_048B070D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0481A70E mov eax, dword ptr fs:[00000030h] 10_2_0481A70E
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0481A70E mov eax, dword ptr fs:[00000030h] 10_2_0481A70E
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048A131B mov eax, dword ptr fs:[00000030h] 10_2_048A131B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0480F716 mov eax, dword ptr fs:[00000030h] 10_2_0480F716
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0487FF10 mov eax, dword ptr fs:[00000030h] 10_2_0487FF10
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0487FF10 mov eax, dword ptr fs:[00000030h] 10_2_0487FF10
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0481E730 mov eax, dword ptr fs:[00000030h] 10_2_0481E730
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048B8B58 mov eax, dword ptr fs:[00000030h] 10_2_048B8B58
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_048B8F6A mov eax, dword ptr fs:[00000030h] 10_2_048B8F6A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047F8794 mov eax, dword ptr fs:[00000030h] 10_2_047F8794
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047F1B8F mov eax, dword ptr fs:[00000030h] 10_2_047F1B8F
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_047F1B8F mov eax, dword ptr fs:[00000030h] 10_2_047F1B8F
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04813B7A mov eax, dword ptr fs:[00000030h] 10_2_04813B7A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04813B7A mov eax, dword ptr fs:[00000030h] 10_2_04813B7A
Checks if the current process is being debugged
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 6_2_0040ACF0 LdrLoadDll, 6_2_0040ACF0
Source: C:\Users\user\Desktop\Factura de proforma.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.aminobalm.com
Source: C:\Windows\explorer.exe Domain query: www.palmonlae.space
Source: C:\Windows\explorer.exe Network Connect: 13.209.99.177 80 Jump to behavior
Sample uses process hollowing technique
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Section unmapped: C:\Windows\SysWOW64\cscript.exe base address: 260000 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Section loaded: unknown target: C:\Windows\SysWOW64\cscript.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Section loaded: unknown target: C:\Windows\SysWOW64\cscript.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread register set: target process: 3352 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread register set: target process: 3352 Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Thread register set: target process: 3352 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Factura de proforma.exe Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\tskpCbAwtxoaw' /XML 'C:\Users\user\AppData\Local\Temp\tmpD689.tmp' Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe' Jump to behavior
Source: explorer.exe, 00000007.00000000.363404492.00000000011E0000.00000002.00020000.sdmp, cscript.exe, 0000000A.00000002.572235503.0000000003070000.00000002.00020000.sdmp Binary or memory string: Program Manager
Source: explorer.exe, 00000007.00000000.362766747.0000000000B68000.00000004.00000020.sdmp Binary or memory string: Progman\Pr
Source: explorer.exe, 00000007.00000000.363404492.00000000011E0000.00000002.00020000.sdmp, cscript.exe, 0000000A.00000002.572235503.0000000003070000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000007.00000000.363404492.00000000011E0000.00000002.00020000.sdmp, cscript.exe, 0000000A.00000002.572235503.0000000003070000.00000002.00020000.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000007.00000000.363404492.00000000011E0000.00000002.00020000.sdmp, cscript.exe, 0000000A.00000002.572235503.0000000003070000.00000002.00020000.sdmp Binary or memory string: Progmanlock
Source: explorer.exe, 00000007.00000000.337688862.00000000087C2000.00000004.00000001.sdmp Binary or memory string: Shell_TrayWndh

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Users\user\Desktop\Factura de proforma.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Factura de proforma.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 6.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Factura de proforma.exe.3cc0560.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Factura de proforma.exe.3d0ff80.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000002.402637395.0000000001500000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000000.357102552.0000000010B69000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.322614171.0000000003B89000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.570999919.0000000000540000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.401884612.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.402727602.0000000001530000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.571846259.0000000002990000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.571574263.00000000025D0000.00000040.00020000.sdmp, type: MEMORY

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 6.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Factura de proforma.exe.3cc0560.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Factura de proforma.exe.3d0ff80.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000002.402637395.0000000001500000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000000.357102552.0000000010B69000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.322614171.0000000003B89000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.570999919.0000000000540000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.401884612.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.402727602.0000000001530000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.571846259.0000000002990000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.571574263.00000000025D0000.00000040.00020000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 502357 Sample: Factura de proforma.exe Startdate: 13/10/2021 Architecture: WINDOWS Score: 100 36 www.new-post-vehicle-site.xyz 2->36 38 www.festival-du-chanvre.com 2->38 46 Found malware configuration 2->46 48 Malicious sample detected (through community Yara rule) 2->48 50 Yara detected AntiVM3 2->50 52 8 other signatures 2->52 11 Factura de proforma.exe 10 2->11         started        signatures3 process4 file5 32 C:\Users\user\AppData\Local\...\tmpD689.tmp, XML 11->32 dropped 34 C:\Users\user\AppData\...\tskpCbAwtxoaw.exe, PE32 11->34 dropped 14 RegSvcs.exe 11->14         started        17 schtasks.exe 1 11->17         started        process6 signatures7 62 Modifies the context of a thread in another process (thread injection) 14->62 64 Maps a DLL or memory area into another process 14->64 66 Sample uses process hollowing technique 14->66 68 2 other signatures 14->68 19 explorer.exe 14->19 injected 23 conhost.exe 17->23         started        process8 dnsIp9 40 parking3.dnstool.net 13.209.99.177, 49806, 80 AMAZON-02US United States 19->40 42 www.palmonlae.space 19->42 44 www.aminobalm.com 19->44 54 System process connects to network (likely due to code injection or exploit) 19->54 25 cscript.exe 19->25         started        signatures10 process11 signatures12 56 Modifies the context of a thread in another process (thread injection) 25->56 58 Maps a DLL or memory area into another process 25->58 60 Tries to detect virtualization through RDTSC time measurements 25->60 28 cmd.exe 1 25->28         started        process13 process14 30 conhost.exe 28->30         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
13.209.99.177
 parking3.dnstool.net United States
16509 AMAZON-02US true

Contacted Domains

Name IP Active
parking3.dnstool.net 13.209.99.177 true
www.festival-du-chanvre.com unknown unknown
www.aminobalm.com unknown unknown
www.palmonlae.space unknown unknown
www.new-post-vehicle-site.xyz unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.aminobalm.com/cb3b/?c6=kr386M7znJup/B2j4KhdpwCgkxfUSLFq19BV4h8BDsMel0JC//DVwypubzBUvp11Q9BD&A0DXb=eZk4rh9h true
  • Avira URL Cloud: safe
 unknown
www.thefanlounge.com/cb3b/ true
  • Avira URL Cloud: safe
 low